Create Interactive Tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	729270
MD5:	734fcb6992cc87731801713d81f0d557
SHA1:	bf9a42ff5ec69d7945ddee72dd0ffc0315e2ff39
SHA256:	398df90a42c7b3cc43ea5095630ef3d8cf059beeda54e6a5888c839f5d6f5055
Tags:	exe
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Tries to harvest and steal browser information (history, passwords, etc)

Queries the volume information (name, serial number etc) of a device

Installs a raw input device (often for capturing keystrokes)

Detected TCP or UDP traffic on non-standard ports

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Potential time zone aware malware

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Program does not show much activity (idle)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

file.exe (PID: 2556 cmdline: C:\Users\user\Desktop\file.exe MD5: 734FCB6992CC87731801713D81F0D557)

WMIC.exe (PID: 5136 cmdline: wmic os get Caption MD5: EC80E603E0090B3AC3C1234C2BA43A0F)

conhost.exe (PID: 5124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5208 cmdline: cmd /C "wmic path win32_VideoController get name" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 5248 cmdline: wmic path win32_VideoController get name MD5: EC80E603E0090B3AC3C1234C2BA43A0F)

cmd.exe (PID: 1392 cmdline: cmd /C "wmic cpu get name" MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 1372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WMIC.exe (PID: 4504 cmdline: wmic cpu get name MD5: EC80E603E0090B3AC3C1234C2BA43A0F)

cleanup

Joe Sandbox Signatures

• AV Detection
• Compliance
• Spreading
• Networking
• Key, Mouse, Clipboard, Microphone and Screen Capturing
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Stealing of Sensitive Information

Click to jump to signature section

Show All Signature Results

AV Detection

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\	Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.6:49705 -> 176.124.220.67:8081

Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67
Source: unknown	TCP traffic detected without corresponding DNS query: 176.124.220.67

Source: file.exe, 00000000.00000002.300184290.000000000125C000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: is unavailable()<>@,;:\"/[]?=,M3.2.0,M11.1.00601021504Z0700476837158203125: cannot parse <invalid Value>ASCII_Hex_DigitAccept-EncodingAccept-LanguageAddDllDirectoryCLSIDFromStringCallWindowProcWClientAuthType(CreateHardLinkWCreatePopupMenuCreateWindowExWDeviceIoControlDialogBoxParamWDragAcceptFilesDrawThemeTextExDuplicateHandleExcludeClipRectFailed to find Failed to load FindNextVolumeWFindVolumeCloseFlushViewOfFileGateway TimeoutGdiplusShutdownGetActiveWindowGetAdaptersInfoGetCommTimeoutsGetCommandLineWGetDpiForWindowGetEnhMetaFileWGetMonitorInfoWGetProcessTimesGetRawInputDataGetSecurityInfoGetStartupInfoWGetTextMetricsWGetThreadLocaleHanifi_RohingyaIdempotency-KeyImpersonateSelfInsertMenuItemWIsWindowEnabledIsWindowUnicodeIsWindowVisibleIsWow64Process2Length RequiredLiqualityWalletMaiarDeFiWalletNot ImplementedOleUninitializeOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPlayEnhMetaFilePostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSetActiveWindowSetCommTimeoutsSetSecurityInfoSetVolumeLabelWSetWinEventHookStringFromGUID2TrackMouseEventUnmapViewOfFileWindowFromPointX-Forwarded-ForYa Passman Data\AppData\Local\]

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption
Source: C:\Windows\System32\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "wmic path win32_VideoController get name"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "wmic cpu get name"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic cpu get name
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "wmic cpu get name"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic cpu get name	Jump to behavior

Source: C:\Windows\System32\wbem\WMIC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5176:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5124:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1372:120:WilError_01

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR

Source: classification engine

Classification label: mal52.spyw.winEXE@14/0@0/1

Source: file.exe

Static file information: File size 4847238 > 1048576

Source: file.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: file.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x22aa00
Source: file.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x1ee800

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: section name: .symtab

Source: C:\Users\user\Desktop\file.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

System information queried: CurrentTimeZoneInformation

Jump to behavior

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Cache\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\	Jump to behavior

Source: file.exe, 00000000.00000002.307303860.000002CA47678000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic os get Caption	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "wmic path win32_VideoController get name"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe cmd /C "wmic cpu get name"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic cpu get name	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Application Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\History VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\LocalCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\LocalCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temporary Internet Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Application Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\History VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Microsoft3DViewer_8wekyb3d8bbwe\LocalCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\LocalCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temporary Internet Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Application Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.HolographicFirstRun_cw5n1h2txyewy\LocalCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\AppData\Local\Temporary Internet Files VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.300184290.000000000125C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: text= zombie% CPU ((PANIC=, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625:method:scheme:statusAvestanBengaliBrailleBrowserCONNECTCaptionChanDirConvertCookiesCopySidCreatedCypriotDeseretEd25519ElbasanEllipseElymaicEndPageExpiresFillRgnFreeSidGODEBUGGranthaHEADERSHanunooHistoryIM UsedIO waitIridiumIsChildJanuaryK-MelonKannadaMD2-RSAMD5-RSAMUI_DltMUI_StdMail.RuMakasarMandaicMarchenMozillaMultaniMyanmarNRGBA64OctoberOrbitumOsmanyaPATHEXTPhantomProfileRadicalRefererSHA-224SHA-256SHA-384SHA-512SetMenuSetRectSharadaShavianSiddhamSinhalaSleepExSogdianSoyomboSputnikSubjectSwapperTagalogTibetanTirhutaTrailerTuesdayTypeALLTypeOPTTypePTRTypeSOATypeSRVTypeTXTTypeWKSUNKNOWNUpgradeVivaldiWSARecvWSASendtypes value=abortedavx512fcharsetchunkedconnectconsolecpuprofderivedexpiresfloat32float64forcegcgctracehead = http://i < capi < leniWalletinvalidlookup minpc= nil keynumber osxsavepacer: panic: pdh.dllreaddirrefererrefreshrunningserial:signal syscalltraileruintptrunknownupgradeutf-8''waitingwsarecvwsasend bytes, data=%q etypes incr=%v is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= packed= ping=%q pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AbortDocAcceptExAcceptedArmenianBalineseBopomofoBugineseCancelIoCherokeeChromiumChromodoClassANYCoinbaseConflictContinueCurveID(CyrillicDNS nameDSA-SHA1DecemberDeleteDCDuployanElectrumEndPaintEqualSidEthereumEthiopicExtenderFebruaryFullPathGdiFlushGeorgianGetFocusGetPixelGoStringGujaratiGurmukhiHTTP/1.1HTTP/2.0HiraganaIsIconicIsWindowIsZoomedJavaneseK-MeleonKatakanaKayah_LiLinear_ALinear_BLocationMD5+SHA1MahajaniMaxthon3MetamaskMoveToExNO_ERRORNO_PROXYNichromeNovemberOl_ChikiPRIORITYPalettedParseIntPhags_PaPolylineQIP SurfQuestionReadFileReceivedResetDCWSETTINGSSHA1-RSASHA3-224SHA3-256SHA3-384SHA3-512SaturdaySetEventSetFocusSetPixelSetTimerTagbanwaTai_ThamTai_VietTelegramTextOutWThursdayTifinaghTronlinkTypeAAAATypeAXFRUgariticWSAIoctlWaterfoxWeb Data[signal \Desktopstack=[
Source: file.exe, 00000000.00000002.300184290.000000000125C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: m=] = ] n=allgallpasn1avx2basebindbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chancx16datedeaddialermsetagfilefromftpsfuncgziphosthourhttpicmpidleigmpint8itabjaxxjsonkindlinkmap[nonenullopenpathpipepop3profquitreadrootsbrksmtpsse2sse3tRNStag:tcp4tcp6trueudp4uintunixvarywmicxn-- ...
Source: file.exe, 00000000.00000002.300184290.000000000125C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: , i = , not , val 390625<-chanAcceptAnswerArabicArmoryAugustBasic BitBltBrahmiCANCELCarianChakmaChedotCocCocCommonComodoCookieCoowonCopticCryptoEndDocExodusExpectFolderFormatFridayGOAWAYGOROOTGetACPGoogleGothicGray16GuardaHangulHatranHebrewHyphenKaithiKhojkiKometaLepchaLineToLockedLycianLydianMondayMulDivOxygenPADDEDPragmaRGBA64RejangSCHED STREETSaveDCServerStringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11WanchoWombatX25519YandexYezidi[]byte\ufffd^user^acceptactiveatomicavx512chan<-closedcookiedomainefenceexec: expectfijijigopherhangupheaderinternip+netkilledliebaolistenlogs//minutenumberobjectpopcntrdrandrdseedrdtscpsecondselectsendtoserversocketsocks socks5statusstringstructsweep sysmontelnettimersuint16uint32uint64unused %v=%v, (conn) (scan (scan) (trap MB in Value> allocs dying= flags= len=%d locks= m->g0= nmsys= pad1= pad2= s=nil
Source: file.exe, 00000000.00000002.300184290.000000000125C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: text= zombie% CPU ((PANIC=, goid=, j0 = 19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625:method:scheme:statusAvestanBengaliBrailleBrowserCONNECTCaptionChanDirConvertCookiesCopySidCreatedCypriotDeseretEd25519ElbasanEllipseElymaicEndPageExpiresFillRgnFreeSidGODEBUGGranthaHEADERSHanunooHistoryIM UsedIO waitIridiumIsChildJanuaryK-MelonKannadaMD2-RSAMD5-RSAMUI_DltMUI_StdMail.RuMakasarMandaicMarchenMozillaMultaniMyanmarNRGBA64OctoberOrbitumOsmanyaPATHEXTPhantomProfileRadicalRefererSHA-224SHA-256SHA-384SHA-512SetMenuSetRectSharadaShavianSiddhamSinhalaSleepExSogdianSoyomboSputnikSubjectSwapperTagalogTibetanTirhutaTrailerTuesdayTypeALLTypeOPTTypePTRTypeSOATypeSRVTypeTXTTypeWKSUNKNOWNUpgradeVivaldiWSARecvWSASendtypes value=abortedavx512fcharsetchunkedconnectconsolecpuprofderivedexpiresfloat32float64forcegcgctracehead = http://i < capi < leniWalletinvalidlookup minpc= nil keynumber osxsavepacer: panic: pdh.dllreaddirrefererrefreshrunningserial:signal syscalltraileruintptrunknownupgradeutf-8''waitingwsarecvwsasend bytes, data=%q etypes incr=%v is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= packed= ping=%q pointer stack=[ status %!Month(2.5.4.102.5.4.112.5.4.1748828125AbortDocAcceptExAcceptedArmenianBalineseBopomofoBugineseCancelIoCherokeeChromiumChromodoClassANYCoinbaseConflictContinueCurveID(CyrillicDNS nameDSA-SHA1DecemberDeleteDCDuployanElectrumEndPaintEqualSidEthereumEthiopicExtenderFebruaryFullPathGdiFlushGeorgianGetFocusGetPixelGoStringGujaratiGurmukhiHTTP/1.1HTTP/2.0HiraganaIsIconicIsWindowIsZoomedJavaneseK-MeleonKatakanaKayah_LiLinear_ALinear_BLocationMD5+SHA1MahajaniMaxthon3MetamaskMoveToExNO_ERRORNO_PROXYNichromeNovemberOl_ChikiPRIORITYPalettedParseIntPhags_PaPolylineQIP SurfQuestionReadFileReceivedResetDCWSETTINGSSHA1-RSASHA3-224SHA3-256SHA3-384SHA3-512SaturdaySetEventSetFocusSetPixelSetTimerTagbanwaTai_ThamTai_VietTelegramTextOutWThursdayTifinaghTronlinkTypeAAAATypeAXFRUgariticWSAIoctlWaterfoxWeb Data[signal \Desktopstack=[
Source: file.exe, 00000000.00000002.300184290.000000000125C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: non-IPv4 addressnon-IPv6 addressnon-empty stringobject is remoteproxy-connectionread_frame_otherreflect mismatchremote I/O errorruntime: g: g=runtime: addr = runtime: base = runtime: gp: gp=runtime: head = runtime: nelems=schedule: in cgotime: bad [0-9]*unknown network wglCreateContextwglDeleteContextworkbuf is emptywww-authenticate spinningthreads=%%!%c(big.Int=%s), p.searchAddr = 0123456789ABCDEFX0123456789abcdefx060102150405Z07001192092895507812559604644775390625: missing method AdjustTokenGroupsAttachThreadInputCOMPRESSION_ERRORCertFindExtensionChoosePixelFormatCryptDecodeObjectCryptoTab BrowserDeleteEnhMetaFileDnsRecordListFreeENHANCE_YOUR_CALMEndDeferWindowPosEthereum\keystoreFLE Standard TimeFailed DependencyGC assist markingGMT Standard TimeGTB Standard TimeGetCurrentProcessGetProfileStringWGetShortPathNameWGetWindowLongPtrWHEADER_TABLE_SIZEHTTP_1_1_REQUIREDIf-Modified-SinceImageList_DestroyIntersectClipRectIsTokenRestrictedLookupAccountSidWMonitorFromWindowMoved PermanentlyOld_North_ArabianOld_South_ArabianOther_ID_ContinueQueryWorkingSetExReadProcessMemoryRegLoadMUIStringWSHDefExtractIconWSentence_TerminalSetStretchBltModeSetWindowLongPtrWShell_NotifyIconWSystemFunction036Too Many RequestsTransfer-EncodingUnified_IdeographWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseX-Idempotency-Key\AppData\Roaming\bad TinySizeClassdebugPtrmask.lockdecryption failedentersyscallblockexec format errorexec: not startedfractional secondframe_ping_lengthg already scannedglobalAlloc.mutexgp.waiting != nilhandshake failureif-modified-sinceillegal parameterin string literalindex > windowEndinteger too largeinvalid BMPStringinvalid IA5Stringinvalid bit size invalid stream IDkey align too biglocked m0 woke upmark - bad statusmarkBits overflowmissing extensionname offset fieldnil resource bodyno data availablenotetsleepg on g0permission deniedreflect.Value.Capreflect.Value.Intreflect.Value.Lenreflect: New(nil)reflect: call of runtime.newosprocruntime/internal/runtime: level = runtime: nameOff runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0seeker can't seekselect (no cases)sizeof(rtype) > 0stack: frame={sp:swept cached spanthread exhaustiontransfer-encodingtruncated headersunknown caller pcunknown type kindunrecognized namewait for GC cyclewglGetProcAddresswmic cpu get namewrong medium type but memory size because dotdotdot in async preempt

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Cache	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Platform Notifications	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Platform Notifications	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\a1633b1e-f1cf-4fba-86f8-17dcb4bf385e	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Safe Browsing Network	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	11 Windows Management Instrumentation	Path Interception	11 Process Injection	1 Virtualization/Sandbox Evasion	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Input Capture	Exfiltration Over Other Network Medium	1 Non-Standard Port	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Process Injection	11 Input Capture	11 Security Software Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
176.124.220.67	unknown	Russian Federation		59652	GULFSTREAMUA	false

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	729270
Start date and time:	2022-10-24 16:26:05 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	file.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.spyw.winEXE@14/0@0/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 100% (good quality ratio 100%) Quality average: 76.4% Quality standard deviation: 24.6%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com
Execution Graph export aborted for target file.exe, PID 2556 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:27:07	API Interceptor	3x Sleep call for process: WMIC.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
GULFSTREAMUA	Browser_renew.exe	Get hash	malicious	Browse	176.124.216.159
	Browser_renew.exe	Get hash	malicious	Browse	176.124.216.159
	file.exe	Get hash	malicious	Browse	176.124.215.2
	MKux1L12Hd.exe	Get hash	malicious	Browse	176.124.192.220
	M5jKYa84lZ.exe	Get hash	malicious	Browse	176.124.192.220
	YJxaWrcrpx.exe	Get hash	malicious	Browse	176.124.192.220
	file.exe	Get hash	malicious	Browse	176.124.192.220
	file.exe	Get hash	malicious	Browse	176.124.192.220
	file.exe	Get hash	malicious	Browse	176.124.192.220
	RssqBuHzC8.exe	Get hash	malicious	Browse	176.124.192.220
	file.exe	Get hash	malicious	Browse	176.124.192.220
	file.exe	Get hash	malicious	Browse	176.124.192.220
	file.exe	Get hash	malicious	Browse	176.124.192.220
	file.exe	Get hash	malicious	Browse	176.124.192.220
	file.exe	Get hash	malicious	Browse	176.124.192.220
	vBlasFEGDm.exe	Get hash	malicious	Browse	176.124.192.220
	sRsnwIR3OT.exe	Get hash	malicious	Browse	176.124.192.220
	file.exe	Get hash	malicious	Browse	176.124.192.220
	file.exe	Get hash	malicious	Browse	176.124.192.220
	file.exe	Get hash	malicious	Browse	176.124.192.220

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.247898286881813
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	file.exe
File size:	4847238
MD5:	734fcb6992cc87731801713d81f0d557
SHA1:	bf9a42ff5ec69d7945ddee72dd0ffc0315e2ff39
SHA256:	398df90a42c7b3cc43ea5095630ef3d8cf059beeda54e6a5888c839f5d6f5055
SHA512:	3b5883f8fd9e3030726b0d8f7884d270b74ea1e99b0c07ecf6fc17164ef2c339c3e38a793ae9e384936eed65363f1b64f6d14f4a1a5c0bfee7f3e2359cdf48b2
SSDEEP:	98304:ezAv5Q+EAG8l6EW3gWVup6aaIb7b7YEKtayr4dZ1YnvkMK83LhJokenV6Iq2K7z4:eE0u1
TLSH:	12262847F89980F5C1AED1308A268253BA723C991B3063D73B51F7B86B73BD46A79314
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........F......."......."..........^........@..............................pP......PJ...`... ............................

File Icon


Icon Hash:	0030303038181800

Static PE Info

General

Entrypoint:	0x465e80
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	9cbefe68f395e67356e2a5d8d1b285c0

Entrypoint Preview

Instruction
jmp 00007F5270BB25E0h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
pushfd
cld
dec eax
sub esp, 000000E0h
dec eax
mov dword ptr [esp], edi
dec eax
mov dword ptr [esp+08h], esi
dec eax
mov dword ptr [esp+10h], ebp
dec eax
mov dword ptr [esp+18h], ebx
dec esp
mov dword ptr [esp+20h], esp
dec esp
mov dword ptr [esp+28h], ebp
dec esp
mov dword ptr [esp+30h], esi
dec esp
mov dword ptr [esp+38h], edi
movups dqword ptr [esp+40h], xmm6
movups dqword ptr [esp+50h], xmm7
inc esp
movups dqword ptr [esp+60h], xmm0
inc esp
movups dqword ptr [esp+70h], xmm1
inc esp
movups dqword ptr [esp+00000080h], xmm2
inc esp
movups dqword ptr [esp+00000090h], xmm3
inc esp
movups dqword ptr [esp+000000A0h], xmm4
inc esp
movups dqword ptr [esp+000000B0h], xmm5
inc esp
movups dqword ptr [esp+000000C0h], xmm6
inc esp
movups dqword ptr [esp+000000D0h], xmm7
dec eax
sub esp, 30h
dec ecx
mov edi, eax
dec eax
mov edx, dword ptr [00000028h]
dec eax
cmp edx, 00000000h
jne 00007F5270BB610Eh
dec eax
mov eax, 00000000h
jmp 00007F5270BB6185h
dec eax
mov edx, dword ptr [edx+00000000h]
dec eax
cmp edx, 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4bb000	0x47c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4c7000	0x3f0b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4bc000	0x99c0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x41b240	0x140	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x22a815	0x22aa00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x22c000	0x1ee6a0	0x1ee800	False	0.39460728166076847	data	5.582119832029706	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x41b000	0x9fdc0	0x3ca00	False	0.41630557345360825	data	5.300196718182688	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x4bb000	0x47c	0x600	False	0.33203125	data	3.567258212132925	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x4bc000	0x99c0	0x9a00	False	0.276760349025974	data	5.43709646464519	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x4c6000	0x4	0x200	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x4c7000	0x3f0b8	0x3f200	False	0.03193842821782178	data	5.600157130601035	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x4c70ac	0x3eff8	Device independent bitmap graphic, 250 x 500 x 32, image size 250000, resolution 3779 x 3779 px/m
RT_GROUP_ICON	0x5060a4	0x14	data

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, PostQueuedCompletionStatus, LoadLibraryA, LoadLibraryW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetEnvironmentStringsW, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateFileA, CreateEventA, CloseHandle, AddVectoredExceptionHandler

Network Behavior

Download Network PCAP: filtered – full

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2022 16:27:08.139823914 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:08.201853037 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:08.204988956 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.520391941 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.582638979 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.582674026 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.582916021 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.644821882 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.644844055 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.644879103 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.644893885 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.644984961 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.645031929 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.645081997 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.645129919 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.707688093 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.707715034 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.707730055 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.707871914 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.707886934 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.707890034 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.707904100 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.707968950 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.708012104 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.708030939 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.708045959 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.708055019 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.708055019 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.708096027 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.708096981 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.708132982 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.770565987 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.770607948 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.770627975 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.770646095 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.770663977 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.770678997 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.770709038 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.770775080 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.770775080 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.770821095 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.770901918 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.770910025 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.770962954 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.770962954 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.771012068 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.771012068 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.771379948 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.771452904 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.771502972 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.771552086 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.771574020 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.771630049 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.771656036 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.771732092 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.771761894 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.771776915 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.771820068 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.771852970 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.771862030 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.771886110 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.771907091 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.771960974 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.772000074 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.772000074 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.772053957 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.772104025 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.772130013 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.772155046 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.772172928 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.772233009 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.772241116 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.772254944 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.772321939 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.772351027 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.772381067 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.772402048 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.772420883 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.772623062 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.772670031 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.812421083 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.812582970 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.832720995 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.832748890 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.832767963 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.832779884 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.832796097 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.832832098 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.832923889 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.832950115 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.833019972 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.833046913 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.833072901 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.833097935 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.833116055 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.833161116 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.833187103 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.833199024 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.833220959 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.833264112 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.833297014 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.833300114 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.833357096 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.833378077 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.833440065 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.833452940 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.833512068 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.833575010 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.833655119 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.833709955 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.833769083 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.833899021 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.833950043 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.833987951 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.833997011 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.834024906 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.834076881 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.834084034 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.834095955 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.834146976 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.834193945 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.834198952 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.834198952 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.834213018 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.834250927 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.834250927 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.834280014 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.834321022 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.834338903 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.834383011 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.834387064 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.834407091 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.834415913 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.834450960 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.834455967 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.834481955 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.834543943 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.834618092 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.834682941 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.834693909 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.834764957 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.834827900 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.834846020 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.834894896 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.834912062 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.834925890 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.834988117 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.835050106 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.835069895 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.835117102 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.835119963 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.835120916 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.835135937 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.835175037 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.835185051 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.835206032 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.835235119 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.835254908 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.835266113 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.835304022 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.835304976 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.835333109 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.835381031 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.835390091 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.835428953 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.835455894 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.835483074 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.835506916 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.835525036 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.835566044 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.835592031 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.835628033 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.835681915 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.835793018 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.835810900 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.835860014 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.835879087 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.835912943 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.835932970 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.835936069 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.835936069 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.835977077 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.835999012 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:15.836049080 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.836153030 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.836199045 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.836308956 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.836327076 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.836374998 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.836452961 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.836555958 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.836661100 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.836678982 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.874608994 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.894874096 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.895131111 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.895148039 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.895160913 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.895173073 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.895185947 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.895255089 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.895418882 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.895432949 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.895576954 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.895590067 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.895733118 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.895903111 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.895921946 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.896068096 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.896083117 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.896096945 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.896229982 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.896245003 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.896260977 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.896378994 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.896394014 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.896542072 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.896692991 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.897066116 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.897082090 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.897095919 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.897108078 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.897120953 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.897133112 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.897229910 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.897284031 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.897414923 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.897511959 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.897597075 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.897670031 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.898546934 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.898569107 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.900530100 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.900743961 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.901052952 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.901073933 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.901118994 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.901154995 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.901204109 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.901222944 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.901592016 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.901618004 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.901635885 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.901654005 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.901673079 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.901691914 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.901710033 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.901727915 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.901746988 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.902223110 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.902252913 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.902271986 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.902319908 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.902522087 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.902543068 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.902564049 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.902651072 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.902673006 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.902760983 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.902939081 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.902961969 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.902981043 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.902998924 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.903055906 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.903104067 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.915740967 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:15.959901094 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:18.746762991 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:18.746912003 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:18.808749914 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.808778048 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.808789968 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.808805943 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.808849096 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.808862925 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.808876038 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.808952093 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.808964968 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.809009075 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.809149981 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.809221029 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.809253931 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.809359074 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.809393883 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.809540033 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.816302061 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.847671032 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:18.909586906 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.909609079 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.909622908 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.909636021 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.909692049 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.909771919 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.909852028 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.909877062 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.909971952 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.915534019 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:18.959512949 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:19.101619005 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:19.101800919 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:19.101895094 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:19.163708925 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:19.163753033 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:19.163769960 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:19.163822889 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:19.163932085 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:19.164058924 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:19.164223909 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:19.164381027 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:19.164484024 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:19.164619923 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:19.164741039 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:19.164858103 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:19.165021896 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:19.165271997 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:19.165637970 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:19.165811062 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:19.165868998 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:19.166021109 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:19.166183949 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:19.172410965 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:19.223817110 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:25.806915045 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:25.870055914 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:25.870776892 CEST	8081	49705	176.124.220.67	192.168.2.6
Oct 24, 2022 16:27:25.870841980 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:25.870841980 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:26.199008942 CEST	49705	8081	192.168.2.6	176.124.220.67
Oct 24, 2022 16:27:26.260819912 CEST	8081	49705	176.124.220.67	192.168.2.6

Statistics

CPU Usage

• file.exe
• WMIC.exe
• conhost.exe
• cmd.exe
• conhost.exe
• WMIC.exe
• cmd.exe
• conhost.exe
• WMIC.exe

Click to jump to process

Memory Usage

• file.exe
• WMIC.exe
• conhost.exe
• cmd.exe
• conhost.exe
• WMIC.exe
• cmd.exe
• conhost.exe
• WMIC.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry
• Network

Click to dive into process behavior distribution

Click to jump to process

Target ID:	0
Start time:	16:27:05
Start date:	24/10/2022
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x1030000
File size:	4847238 bytes
MD5 hash:	734FCB6992CC87731801713D81F0D557
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	16:27:07
Start date:	24/10/2022
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic os get Caption
Imagebase:	0x7ff77e4d0000
File size:	521728 bytes
MD5 hash:	EC80E603E0090B3AC3C1234C2BA43A0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	2
Start time:	16:27:07
Start date:	24/10/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	3
Start time:	16:27:09
Start date:	24/10/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /C "wmic path win32_VideoController get name"
Imagebase:	0x7ff7cb270000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	4
Start time:	16:27:09
Start date:	24/10/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	5
Start time:	16:27:09
Start date:	24/10/2022
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x7ff77e4d0000
File size:	521728 bytes
MD5 hash:	EC80E603E0090B3AC3C1234C2BA43A0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	6
Start time:	16:27:10
Start date:	24/10/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /C "wmic cpu get name"
Imagebase:	0x7ff7cb270000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	7
Start time:	16:27:10
Start date:	24/10/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	8
Start time:	16:27:10
Start date:	24/10/2022
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic cpu get name
Imagebase:	0x7ff77e4d0000
File size:	521728 bytes
MD5 hash:	EC80E603E0090B3AC3C1234C2BA43A0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

TCP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: file.exePID: 2556, Parent PID: 3452

General

File Activities

File Opened

Windows Analysis Report
file.exe