Edit tour

Windows Analysis Report
edlyEKgpaz.exe

Overview

General Information

Sample name:	edlyEKgpaz.exe renamed because original name is a hash value
Original sample name:	461bcd6658a32970b9bd12d978229b8d3c8c1f4bdf00688db287b2b7ce6c880e.exe
Analysis ID:	1422328
MD5:	ccfdbf07643aed4c333fad91828e4a80
SHA1:	ccb1efa6c2ef21eb912bfdabb9a6bccb374dc248
SHA256:	461bcd6658a32970b9bd12d978229b8d3c8c1f4bdf00688db287b2b7ce6c880e
Tags:	exe
Infos:

Detection

Snake Keylogger

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

Machine Learning detection for sample

Self deletion via cmd or bat file

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses a known web browser user agent for HTTP communication

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

edlyEKgpaz.exe (PID: 1736 cmdline: "C:\Users\user\Desktop\edlyEKgpaz.exe" MD5: CCFDBF07643AED4C333FAD91828E4A80)

cmd.exe (PID: 2828 cmdline: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\edlyEKgpaz.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 2884 cmdline: choice /C Y /N /D Y /T 3 MD5: 1A9804F0C374283B094E9E55DC5EE128)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "info@stpgig.com", "Password": "Stpgig#Login21", "Host": "mail.stpgig.com", "Port": "587"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
edlyEKgpaz.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
edlyEKgpaz.exe	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
edlyEKgpaz.exe	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1497a:$a1: get_encryptedPassword 0x14c70:$a2: get_encryptedUsername 0x14786:$a3: get_timePasswordChanged 0x14881:$a4: get_passwordField 0x14990:$a5: set_encryptedPassword 0x15fc2:$a7: get_logins 0x15f25:$a10: KeyLoggerEventArgs 0x15bbe:$a11: KeyLoggerEventArgsEventHandler
edlyEKgpaz.exe	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c2e1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b513:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b946:$a4: \Orbitum\User Data\Default\Login Data 0x1c985:$a5: \Kometa\User Data\Default\Login Data
edlyEKgpaz.exe	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1552c:$s1: UnHook 0x15533:$s2: SetHook 0x1553b:$s3: CallNextHook 0x15548:$s4: _hook
edlyEKgpaz.exe	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18388:$x1: $%SMTPDV$ 0x183ec:$x2: $#TheHashHere%& 0x199dd:$x3: %FTPDV$ 0x19ad1:$x4: $%TelegramDv$ 0x15bbe:$x5: KeyLoggerEventArgs 0x15f25:$x5: KeyLoggerEventArgs 0x19a01:$m2: Clipboard Logs ID 0x19bcd:$m2: Screenshot Logs ID 0x19c99:$m2: keystroke Logs ID 0x19ba5:$m4: \SnakeKeylogger\
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1416628093.0000000000922000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1416628093.0000000000922000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000000.1416628093.0000000000922000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1477a:$a1: get_encryptedPassword 0x14a70:$a2: get_encryptedUsername 0x14586:$a3: get_timePasswordChanged 0x14681:$a4: get_passwordField 0x14790:$a5: set_encryptedPassword 0x15dc2:$a7: get_logins 0x15d25:$a10: KeyLoggerEventArgs 0x159be:$a11: KeyLoggerEventArgsEventHandler
00000000.00000000.1416628093.0000000000922000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18188:$x1: $%SMTPDV$ 0x181ec:$x2: $#TheHashHere%& 0x197dd:$x3: %FTPDV$ 0x198d1:$x4: $%TelegramDv$ 0x159be:$x5: KeyLoggerEventArgs 0x15d25:$x5: KeyLoggerEventArgs 0x19801:$m2: Clipboard Logs ID 0x199cd:$m2: Screenshot Logs ID 0x19a99:$m2: keystroke Logs ID 0x199a5:$m4: \SnakeKeylogger\
00000000.00000002.1511341797.0000000003BB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: edlyEKgpaz.exe PID: 1736	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: edlyEKgpaz.exe PID: 1736	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: edlyEKgpaz.exe PID: 1736	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x29f0b:$a1: get_encryptedPassword 0x2a1f7:$a2: get_encryptedUsername 0x29d21:$a3: get_timePasswordChanged 0x29e1c:$a4: get_passwordField 0x29f21:$a5: set_encryptedPassword 0x2c389:$a7: get_logins 0x2c2ec:$a10: KeyLoggerEventArgs 0x2bf85:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: edlyEKgpaz.exe PID: 1736	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x2bf85:$x5: KeyLoggerEventArgs 0x2c2ec:$x5: KeyLoggerEventArgs 0x2cbda:$x5: KeyLoggerEventArgs 0x2cf0e:$x5: KeyLoggerEventArgs 0x2e4e9:$m2: Clipboard Logs ID 0x2e5c9:$m2: Screenshot Logs ID 0x2e5fd:$m2: keystroke Logs ID 0x2e5b5:$m4: \SnakeKeylogger\
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.edlyEKgpaz.exe.920000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.edlyEKgpaz.exe.920000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.0.edlyEKgpaz.exe.920000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1497a:$a1: get_encryptedPassword 0x14c70:$a2: get_encryptedUsername 0x14786:$a3: get_timePasswordChanged 0x14881:$a4: get_passwordField 0x14990:$a5: set_encryptedPassword 0x15fc2:$a7: get_logins 0x15f25:$a10: KeyLoggerEventArgs 0x15bbe:$a11: KeyLoggerEventArgsEventHandler
0.0.edlyEKgpaz.exe.920000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c2e1:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b513:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b946:$a4: \Orbitum\User Data\Default\Login Data 0x1c985:$a5: \Kometa\User Data\Default\Login Data
0.0.edlyEKgpaz.exe.920000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1552c:$s1: UnHook 0x15533:$s2: SetHook 0x1553b:$s3: CallNextHook 0x15548:$s4: _hook
0.0.edlyEKgpaz.exe.920000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18388:$x1: $%SMTPDV$ 0x183ec:$x2: $#TheHashHere%& 0x199dd:$x3: %FTPDV$ 0x19ad1:$x4: $%TelegramDv$ 0x15bbe:$x5: KeyLoggerEventArgs 0x15f25:$x5: KeyLoggerEventArgs 0x19a01:$m2: Clipboard Logs ID 0x19bcd:$m2: Screenshot Logs ID 0x19c99:$m2: keystroke Logs ID 0x19ba5:$m4: \SnakeKeylogger\
Click to see the 1 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://scratchdreams.tk

Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1511341797.0000000003BB1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "info@stpgig.com", "Password": "Stpgig#Login21", "Host": "mail.stpgig.com", "Port": "587"}

Multi AV Scanner detection for domain / URL

Source: https://scratchdreams.tk

Virustotal: Detection: 15%

Perma Link

Multi AV Scanner detection for submitted file

Source: edlyEKgpaz.exe	ReversingLabs: Detection: 65%
Source: edlyEKgpaz.exe	Virustotal: Detection: 71%			Perma Link

Machine Learning detection for sample

Source: edlyEKgpaz.exe

Joe Sandbox ML: detected

Source: unknown

HTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.8:49705 version: TLS 1.0

Source: edlyEKgpaz.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.67.152 104.21.67.152
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 104.21.67.152:443 -> 192.168.2.8:49705 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.152.231 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: checkip.dyndns.org

Source: edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003D8D000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003DD7000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003CC2000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003D7A000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003D66000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003D66000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003BB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: edlyEKgpaz.exe	String found in binary or memory: http://checkip.dyndns.org/q
Source: edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003D8D000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003DD7000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003D7A000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003D66000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003DA1000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003CE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003BB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003D8D000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003DD7000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003CC2000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003D7A000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003D10000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003D66000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: edlyEKgpaz.exe	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/102.129.152.231
Source: edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/102.129.152.231p
Source: edlyEKgpaz.exe	String found in binary or memory: https://scratchdreams.tk

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

System Summary

Malicious sample detected (through community Yara rule)

Source: edlyEKgpaz.exe, type: SAMPLE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: edlyEKgpaz.exe, type: SAMPLE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: edlyEKgpaz.exe, type: SAMPLE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: edlyEKgpaz.exe, type: SAMPLE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.0.edlyEKgpaz.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.0.edlyEKgpaz.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.0.edlyEKgpaz.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.0.edlyEKgpaz.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000000.1416628093.0000000000922000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000000.1416628093.0000000000922000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: edlyEKgpaz.exe PID: 1736, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: edlyEKgpaz.exe PID: 1736, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: edlyEKgpaz.exe

Static PE information: No import functions for PE file found

Source: edlyEKgpaz.exe, 00000000.00000002.1512202901.000000001C822000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs edlyEKgpaz.exe
Source: edlyEKgpaz.exe, 00000000.00000000.1416628093.0000000000922000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamefbXfjPLUOxpHounQOLpg.exeX vs edlyEKgpaz.exe
Source: edlyEKgpaz.exe	Binary or memory string: OriginalFilenamefbXfjPLUOxpHounQOLpg.exeX vs edlyEKgpaz.exe

Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\choice.exe	Section loaded: version.dll	Jump to behavior

Source: edlyEKgpaz.exe, type: SAMPLE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: edlyEKgpaz.exe, type: SAMPLE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: edlyEKgpaz.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: edlyEKgpaz.exe, type: SAMPLE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.0.edlyEKgpaz.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.0.edlyEKgpaz.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.edlyEKgpaz.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.0.edlyEKgpaz.exe.920000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000000.1416628093.0000000000922000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000000.1416628093.0000000000922000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: edlyEKgpaz.exe PID: 1736, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: edlyEKgpaz.exe PID: 1736, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: edlyEKgpaz.exe, .cs	Cryptographic APIs: 'TransformFinalBlock'
Source: edlyEKgpaz.exe, .cs	Cryptographic APIs: 'TransformFinalBlock'
Source: edlyEKgpaz.exe, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: edlyEKgpaz.exe, --.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal96.troj.winEXE@6/1@2/2

Source: C:\Users\user\Desktop\edlyEKgpaz.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\edlyEKgpaz.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3984:120:WilError_03

Source: edlyEKgpaz.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: edlyEKgpaz.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Users\user\Desktop\edlyEKgpaz.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\edlyEKgpaz.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: edlyEKgpaz.exe	ReversingLabs: Detection: 65%
Source: edlyEKgpaz.exe	Virustotal: Detection: 71%

Source: edlyEKgpaz.exe

String found in binary or memory: F-Stopw

Source: unknown	Process created: C:\Users\user\Desktop\edlyEKgpaz.exe "C:\Users\user\Desktop\edlyEKgpaz.exe"
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\edlyEKgpaz.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\edlyEKgpaz.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3	Jump to behavior

Source: edlyEKgpaz.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: edlyEKgpaz.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: edlyEKgpaz.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process created: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\edlyEKgpaz.exe"
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process created: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\edlyEKgpaz.exe"			Jump to behavior

Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Memory allocated: 1270000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Memory allocated: 1BBB0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 599436	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 599327	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 598748	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 598640	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 598421	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 597874	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 597546	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 596667	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 596331	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 596093	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 595874	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 595763	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 595644	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 594967	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 594531	Jump to behavior

Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Window / User API: threadDelayed 8191			Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Window / User API: threadDelayed 1665			Jump to behavior

Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -599874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2352	Thread sleep count: 8191 > 30	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2352	Thread sleep count: 1665 > 30	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -599546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -599436s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -599327s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -599218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -598999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -598748s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -598640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -598531s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -598421s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -598312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -598093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -597984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -597874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -597765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -597656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -597546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -597437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -597328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -597218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -597109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -597000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -596890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -596781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -596667s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -596562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -596453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -596331s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -596203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -596093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -595984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -595874s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -595763s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -595644s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -595515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -595406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -595296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -595187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -595078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -594967s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -594859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -594750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -594640s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe TID: 2340	Thread sleep time: -594531s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 599436	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 599327	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 598999	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 598748	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 598640	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 598421	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 597874	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 597546	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 596667	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 596562	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 596331	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 596093	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 595984	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 595874	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 595763	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 595644	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 594967	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 594859	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 594750	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 594640	Jump to behavior
Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Thread delayed: delay time: 594531	Jump to behavior

Source: edlyEKgpaz.exe, 00000000.00000002.1510827584.0000000001183000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\edlyEKgpaz.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\edlyEKgpaz.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\edlyEKgpaz.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\edlyEKgpaz.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\edlyEKgpaz.exe"			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3			Jump to behavior

Source: C:\Users\user\Desktop\edlyEKgpaz.exe

Queries volume information: C:\Users\user\Desktop\edlyEKgpaz.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\edlyEKgpaz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: edlyEKgpaz.exe, type: SAMPLE
Source: Yara match	File source: 0.0.edlyEKgpaz.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1416628093.0000000000922000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1511341797.0000000003BB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: edlyEKgpaz.exe PID: 1736, type: MEMORYSTR

Source: Yara match	File source: edlyEKgpaz.exe, type: SAMPLE
Source: Yara match	File source: 0.0.edlyEKgpaz.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1416628093.0000000000922000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: edlyEKgpaz.exe PID: 1736, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: edlyEKgpaz.exe, type: SAMPLE
Source: Yara match	File source: 0.0.edlyEKgpaz.exe.920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1416628093.0000000000922000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1511341797.0000000003BB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: edlyEKgpaz.exe PID: 1736, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
edlyEKgpaz.exe	66%	ReversingLabs	ByteCode-MSIL.Infostealer.Mintluks
edlyEKgpaz.exe	72%	Virustotal		Browse
edlyEKgpaz.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
reallyfreegeoip.org	1%	Virustotal	Browse
checkip.dyndns.com	0%	Virustotal	Browse
checkip.dyndns.org	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://reallyfreegeoip.org	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://checkip.dyndns.com	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://reallyfreegeoip.org	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
https://scratchdreams.tk	100%	Avira URL Cloud	malware
https://reallyfreegeoip.org/xml/102.129.152.231p	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/102.129.152.231	0%	Avira URL Cloud	safe
https://scratchdreams.tk	15%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
reallyfreegeoip.org	104.21.67.152	true	false	1%, Virustotal, Browse	unknown
checkip.dyndns.com	132.226.247.73	true	false	0%, Virustotal, Browse	unknown
checkip.dyndns.org	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/102.129.152.231	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org	edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003D8D000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003DD7000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003CC2000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003D7A000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003D10000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003D66000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003DA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://checkip.dyndns.org	edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003D66000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003DA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.com	edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003D8D000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003DD7000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003CC2000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003D7A000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003D66000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003DA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/102.129.152.231p	edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003CC2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003BB1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/q	edlyEKgpaz.exe	false	URL Reputation: safe	unknown
https://scratchdreams.tk	edlyEKgpaz.exe	false	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://reallyfreegeoip.org	edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003D8D000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003DD7000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003D7A000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003DE9000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003D66000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003DA1000.00000004.00000800.00020000.00000000.sdmp, edlyEKgpaz.exe, 00000000.00000002.1511341797.0000000003CE2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/	edlyEKgpaz.exe	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.67.152	reallyfreegeoip.org	United States		13335	CLOUDFLARENETUS	false
132.226.247.73	checkip.dyndns.com	United States		16989	UTMEMUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1422328
Start date and time:	2024-04-08 15:28:35 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	edlyEKgpaz.exe renamed because original name is a hash value
Original Sample Name:	461bcd6658a32970b9bd12d978229b8d3c8c1f4bdf00688db287b2b7ce6c880e.exe
Detection:	MAL
Classification:	mal96.troj.winEXE@6/1@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 33 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 40.127.169.103
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, sls.update.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Execution Graph export aborted for target edlyEKgpaz.exe, PID 1736 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:29:33	API Interceptor	64x Sleep call for process: edlyEKgpaz.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.67.152	58208 Teklif.exe	Get hash	malicious	Snake Keylogger	Browse
	Zarefy4bOs.exe	Get hash	malicious	Snake Keylogger	Browse
	SAT8765456000.xlam.xlsx	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse
	1d4D5ndo0x.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse
	D09876500900000H.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse
	23343100IM00270839_Dekont1.exe	Get hash	malicious	Snake Keylogger	Browse
	Payment_Draft_confirmation.xla.xlsx	Get hash	malicious	Snake Keylogger	Browse
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse
132.226.247.73	Remittance_copy.pdf.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Fuy2BDS9W2.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	checkip.dyndns.org/
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	8wvP84hzFu.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Payment_Draft_confirmation.xla.xlsx	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	xdd6BRIg0O.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	checkip.dyndns.org/
	Mquqdysqqv.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Trojan.PackedNET.2725.19533.14530.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Vessel Particulars.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	PsBygexGwH.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	58208 Teklif.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	Zarefy4bOs.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	VI3 Operation Guide_tech Info versionfdp.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	132.226.8.169
	Remittance_copy.pdf.scr.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	SAT8765456000.xlam.xlsx	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	158.101.44.242
	request-2.doc.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	132.226.8.169
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Fuy2BDS9W2.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	132.226.247.73
reallyfreegeoip.org	PsBygexGwH.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	58208 Teklif.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Zarefy4bOs.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Remittance_copy.pdf.scr.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	SAT8765456000.xlam.xlsx	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	104.21.67.152
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Fuy2BDS9W2.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	172.67.177.134
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	P3DuNLpu72.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	oi89NcmKFP.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	ZaDKpv94O0.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	a9wJzPSyH4.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	http://56hytuti5.weebly.com	Get hash	malicious	Unknown	Browse	162.159.136.66
	https://wix-l.in/k-T3DnGkZk	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://777qiuqiu.online/LOVEYOU/	Get hash	malicious	Unknown	Browse	172.67.158.60
	f4CdNDrJp8.exe	Get hash	malicious	FormBook	Browse	172.67.152.117
	https://www.mail2world.com/FileCabinet/Download.asp?User=av044072@mail2world.com&app=web&FID=%7bC96F9402-AB4B-48C3-BCE0-B86B5F3F10A5%7d	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	xnYuUw7KjK.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.146.180
UTMEMUS	VI3 Operation Guide_tech Info versionfdp.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	132.226.8.169
	1WOxWETNbC.elf	Get hash	malicious	Unknown	Browse	132.226.89.213
	Remittance_copy.pdf.scr.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	request-2.doc.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	132.226.8.169
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	Fuy2BDS9W2.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	132.226.247.73
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	FGT5000800000.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	132.226.8.169
	z52OURO08765.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	132.226.8.169

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	PsBygexGwH.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	58208 Teklif.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Zarefy4bOs.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	VI3 Operation Guide_tech Info versionfdp.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	104.21.67.152
	Remittance_copy.pdf.scr.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	file.exe	Get hash	malicious	SmokeLoader, Xehook Stealer	Browse	104.21.67.152
	request-2.doc.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	104.21.67.152
	https://my.visme.co/view/w46vn911-northshore-tractor-ltd	Get hash	malicious	Unknown	Browse	104.21.67.152
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Fuy2BDS9W2.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	104.21.67.152

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\edlyEKgpaz.exe.log

Download File

Process:	C:\Users\user\Desktop\edlyEKgpaz.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1510
Entropy (8bit):	5.380493107040482
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6Kh6+84xp3/VclSKIE4TKBGKoZAE4KKUNb:MxHKQ71qHGIs0HKCYHKGSI6o6+vxp3/l
MD5:	EC75759911B88E93A2B5947380336033
SHA1:	4D1472BBA520DBF76449567159CD927E94454210
SHA-256:	5BFBF7B8E9F9E89881AD3B4E1214A3F0E9F9E36F72A41143226F4DB9E4642E5D
SHA-512:	EF017C70BFB6464CA040FA12C04CE42F9E611D1F79F123F0A7AF7E6CD80002678E1BB97EB835EAF42F7E37B940833CE8422566340A5398115FBB10FC6CCB76C5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.860140512962988
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	edlyEKgpaz.exe
File size:	132'608 bytes
MD5:	ccfdbf07643aed4c333fad91828e4a80
SHA1:	ccb1efa6c2ef21eb912bfdabb9a6bccb374dc248
SHA256:	461bcd6658a32970b9bd12d978229b8d3c8c1f4bdf00688db287b2b7ce6c880e
SHA512:	c9bd1a9ac30e941eae5acf39cff6c6b0ac8a95e7bd0c656496851f15fcce345f4cf0371df6aad709c4f72845ad496291a70d9364572abdd8da0d7444f385b6c7
SSDEEP:	3072:jeHgpwPUTi/GIRhvudmxG9OCAXGtsddlQbgkVcsQvwvxLob3mDbY:VpmNZMm7Lqbfcb30b
TLSH:	B3D3080D37E84804E1FF997316716211C7B6F8430A1ADE1D1AD2F8692A7DB91CE1AF93
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......e.........."...P.................. .....@..... .......................@............@...@......@............... .....

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140000000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x65D908AD [Fri Feb 23 21:05:49 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x22000	0x108f	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1f1b8	0x1f200	de60aef4ac94b80e62e3bbb03e5293f2	False	0.3577434738955823	data	5.859891373349516	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x22000	0x108f	0x1200	a9748b2af48eaa26a49411e60c15061d	False	0.3665364583333333	data	4.872208135586403	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x220a0	0x394	OpenPGP Secret Key			0.4203056768558952
RT_MANIFEST	0x22434	0xc5b	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.3926651912741069

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 8, 2024 15:29:32.242369890 CEST	49704	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:32.474802971 CEST	80	49704	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:32.474919081 CEST	49704	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:32.476269960 CEST	49704	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:32.708703995 CEST	80	49704	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:32.709810019 CEST	80	49704	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:32.717508078 CEST	49704	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:32.950448990 CEST	80	49704	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:33.004457951 CEST	49704	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:33.172341108 CEST	49705	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:33.172385931 CEST	443	49705	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:33.172461987 CEST	49705	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:33.202338934 CEST	49705	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:33.202377081 CEST	443	49705	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:33.467482090 CEST	443	49705	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:33.467607975 CEST	49705	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:33.473843098 CEST	49705	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:33.473866940 CEST	443	49705	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:33.474220037 CEST	443	49705	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:33.520134926 CEST	49705	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:33.554683924 CEST	49705	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:33.600238085 CEST	443	49705	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:33.761903048 CEST	443	49705	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:33.761998892 CEST	443	49705	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:33.762079954 CEST	49705	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:33.777395964 CEST	49705	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:33.780790091 CEST	49704	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:34.013850927 CEST	80	49704	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:34.017411947 CEST	49706	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:34.017450094 CEST	443	49706	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:34.017539978 CEST	49706	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:34.017925024 CEST	49706	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:34.017944098 CEST	443	49706	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:34.067121983 CEST	49704	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:34.278276920 CEST	443	49706	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:34.280539036 CEST	49706	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:34.280575991 CEST	443	49706	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:34.605941057 CEST	443	49706	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:34.606055021 CEST	443	49706	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:34.606138945 CEST	49706	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:34.606705904 CEST	49706	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:34.609831095 CEST	49704	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:34.611051083 CEST	49707	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:34.842236042 CEST	80	49704	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:34.842344046 CEST	49704	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:34.843441010 CEST	80	49707	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:34.843522072 CEST	49707	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:34.843703032 CEST	49707	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:35.076200962 CEST	80	49707	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:35.076780081 CEST	80	49707	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:35.077127934 CEST	49707	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:35.078536987 CEST	49708	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:35.078572035 CEST	443	49708	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:35.078661919 CEST	49708	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:35.078896999 CEST	49708	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:35.078907967 CEST	443	49708	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:35.309700966 CEST	80	49707	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:35.309782982 CEST	49707	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:35.337280989 CEST	443	49708	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:35.338691950 CEST	49708	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:35.338711977 CEST	443	49708	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:35.637871027 CEST	443	49708	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:35.637974024 CEST	443	49708	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:35.638039112 CEST	49708	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:35.638744116 CEST	49708	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:35.643413067 CEST	49709	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:35.878104925 CEST	80	49709	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:35.878273010 CEST	49709	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:35.878436089 CEST	49709	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:36.113179922 CEST	80	49709	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:36.113852024 CEST	80	49709	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:36.115309000 CEST	49710	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:36.115353107 CEST	443	49710	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:36.115463018 CEST	49710	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:36.115705967 CEST	49710	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:36.115725040 CEST	443	49710	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:36.160743952 CEST	49709	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:36.372653961 CEST	443	49710	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:36.374281883 CEST	49710	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:36.374310970 CEST	443	49710	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:36.677896976 CEST	443	49710	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:36.677994967 CEST	443	49710	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:36.678339005 CEST	49710	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:36.678920984 CEST	49710	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:36.682307005 CEST	49709	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:36.683299065 CEST	49711	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:36.917772055 CEST	80	49711	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:36.917887926 CEST	49711	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:36.918076992 CEST	49711	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:36.922163963 CEST	80	49709	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:36.922231913 CEST	49709	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:37.148087978 CEST	80	49711	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:37.148477077 CEST	80	49711	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:37.150207043 CEST	49712	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:37.150250912 CEST	443	49712	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:37.150326014 CEST	49712	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:37.150638103 CEST	49712	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:37.150652885 CEST	443	49712	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:37.192271948 CEST	49711	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:37.408540010 CEST	443	49712	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:37.410118103 CEST	49712	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:37.410152912 CEST	443	49712	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:37.711469889 CEST	443	49712	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:37.711581945 CEST	443	49712	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:37.711646080 CEST	49712	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:37.712297916 CEST	49712	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:37.715440035 CEST	49711	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:37.716449022 CEST	49713	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:37.946436882 CEST	80	49711	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:37.946501017 CEST	49711	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:37.947906971 CEST	80	49713	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:37.947981119 CEST	49713	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:37.948175907 CEST	49713	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:38.178535938 CEST	80	49713	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:38.179604053 CEST	80	49713	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:38.180947065 CEST	49714	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:38.180979967 CEST	443	49714	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:38.181051016 CEST	49714	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:38.181304932 CEST	49714	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:38.181318998 CEST	443	49714	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:38.223234892 CEST	49713	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:38.442370892 CEST	443	49714	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:38.443614960 CEST	49714	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:38.443646908 CEST	443	49714	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:38.745842934 CEST	443	49714	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:38.745938063 CEST	443	49714	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:38.746001959 CEST	49714	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:38.746584892 CEST	49714	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:38.749851942 CEST	49713	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:38.751106977 CEST	49715	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:38.980233908 CEST	80	49713	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:38.980297089 CEST	49713	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:38.983973980 CEST	80	49715	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:38.984050989 CEST	49715	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:38.984246969 CEST	49715	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:39.218877077 CEST	80	49715	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:39.229159117 CEST	80	49715	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:39.230760098 CEST	49716	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:39.230787992 CEST	443	49716	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:39.230866909 CEST	49716	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:39.231151104 CEST	49716	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:39.231159925 CEST	443	49716	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:39.270109892 CEST	49715	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:39.490221024 CEST	443	49716	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:39.491635084 CEST	49716	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:39.491660118 CEST	443	49716	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:39.788252115 CEST	443	49716	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:39.788357973 CEST	443	49716	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:39.788429022 CEST	49716	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:39.788935900 CEST	49716	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:39.792196035 CEST	49715	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:39.793320894 CEST	49717	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:40.026935101 CEST	80	49715	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:40.027036905 CEST	49715	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:40.027349949 CEST	80	49717	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:40.027426004 CEST	49717	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:40.027584076 CEST	49717	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:40.260595083 CEST	80	49717	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:40.261059046 CEST	80	49717	132.226.247.73	192.168.2.8
Apr 8, 2024 15:29:40.262202024 CEST	49718	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:40.262231112 CEST	443	49718	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:40.262293100 CEST	49718	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:40.262603045 CEST	49718	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:40.262609005 CEST	443	49718	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:40.301373005 CEST	49717	80	192.168.2.8	132.226.247.73
Apr 8, 2024 15:29:40.523495913 CEST	443	49718	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:40.524779081 CEST	49718	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:40.524806023 CEST	443	49718	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:40.829890013 CEST	443	49718	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:40.829998970 CEST	443	49718	104.21.67.152	192.168.2.8
Apr 8, 2024 15:29:40.830068111 CEST	49718	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:40.830488920 CEST	49718	443	192.168.2.8	104.21.67.152
Apr 8, 2024 15:29:40.962914944 CEST	49717	80	192.168.2.8	132.226.247.73

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 8, 2024 15:29:32.110373974 CEST	58989	53	192.168.2.8	1.1.1.1
Apr 8, 2024 15:29:32.235025883 CEST	53	58989	1.1.1.1	192.168.2.8
Apr 8, 2024 15:29:33.040128946 CEST	52700	53	192.168.2.8	1.1.1.1
Apr 8, 2024 15:29:33.171473980 CEST	53	52700	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 8, 2024 15:29:32.110373974 CEST	192.168.2.8	1.1.1.1	0x5988	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Apr 8, 2024 15:29:33.040128946 CEST	192.168.2.8	1.1.1.1	0x4bd1	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 8, 2024 15:29:32.235025883 CEST	1.1.1.1	192.168.2.8	0x5988	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 8, 2024 15:29:32.235025883 CEST	1.1.1.1	192.168.2.8	0x5988	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Apr 8, 2024 15:29:32.235025883 CEST	1.1.1.1	192.168.2.8	0x5988	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Apr 8, 2024 15:29:32.235025883 CEST	1.1.1.1	192.168.2.8	0x5988	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Apr 8, 2024 15:29:32.235025883 CEST	1.1.1.1	192.168.2.8	0x5988	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Apr 8, 2024 15:29:32.235025883 CEST	1.1.1.1	192.168.2.8	0x5988	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Apr 8, 2024 15:29:33.171473980 CEST	1.1.1.1	192.168.2.8	0x4bd1	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Apr 8, 2024 15:29:33.171473980 CEST	1.1.1.1	192.168.2.8	0x4bd1	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	132.226.247.73	80	1736	C:\Users\user\Desktop\edlyEKgpaz.exe

Timestamp	Bytes transferred	Direction	Data
Apr 8, 2024 15:29:32.476269960 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 8, 2024 15:29:32.709810019 CEST	324	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 13:29:32 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: dcfd5907c25f3c6f9cdc17d28c212c5f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>
Apr 8, 2024 15:29:32.717508078 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2024 15:29:32.950448990 CEST	324	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 13:29:32 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 338de7e43cb2a982398a5f55d64213f3 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>
Apr 8, 2024 15:29:33.780790091 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2024 15:29:34.013850927 CEST	324	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 13:29:33 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a6541b3080ec8b75441e502314fc2ab9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	132.226.247.73	80	1736	C:\Users\user\Desktop\edlyEKgpaz.exe

Timestamp	Bytes transferred	Direction	Data
Apr 8, 2024 15:29:34.843703032 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2024 15:29:35.076780081 CEST	324	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 13:29:34 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f0599f760438b22ddb8d334de7341c07 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49709	132.226.247.73	80	1736	C:\Users\user\Desktop\edlyEKgpaz.exe

Timestamp	Bytes transferred	Direction	Data
Apr 8, 2024 15:29:35.878436089 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 8, 2024 15:29:36.113852024 CEST	324	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 13:29:35 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5761035cc255cb292f6e14ee1ea22ff1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49711	132.226.247.73	80	1736	C:\Users\user\Desktop\edlyEKgpaz.exe

Timestamp	Bytes transferred	Direction	Data
Apr 8, 2024 15:29:36.918076992 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 8, 2024 15:29:37.148477077 CEST	324	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 13:29:37 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 083cd1b35955eb43d9045e409adfe7d9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49713	132.226.247.73	80	1736	C:\Users\user\Desktop\edlyEKgpaz.exe

Timestamp	Bytes transferred	Direction	Data
Apr 8, 2024 15:29:37.948175907 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 8, 2024 15:29:38.179604053 CEST	324	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 13:29:38 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8d9aa8839861df1fbc48e19290bffb07 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49715	132.226.247.73	80	1736	C:\Users\user\Desktop\edlyEKgpaz.exe

Timestamp	Bytes transferred	Direction	Data
Apr 8, 2024 15:29:38.984246969 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 8, 2024 15:29:39.229159117 CEST	324	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 13:29:39 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d1d137201b1317f8c6d11967c3dfdedf Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49717	132.226.247.73	80	1736	C:\Users\user\Desktop\edlyEKgpaz.exe

Timestamp	Bytes transferred	Direction	Data
Apr 8, 2024 15:29:40.027584076 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 8, 2024 15:29:40.261059046 CEST	324	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 13:29:40 GMT Content-Type: text/html Content-Length: 107 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c4ee395a2738d9838e22e3501eab5633 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 102.129.152.231</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	104.21.67.152	443	1736	C:\Users\user\Desktop\edlyEKgpaz.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-08 13:29:33 UTC	88	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-08 13:29:33 UTC	708	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 13:29:33 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 84874 Last-Modified: Sun, 07 Apr 2024 13:54:59 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ljmeYjZRbs1Ydy5P7dwCFjl95M9XWAyk00ifO5BmbgIvr7X69bnbGLYOl0n%2FJT7hCgQ1PaAM8Tu5leyDdK7h4Dm%2BWYjqw58BKM%2FUqZiBvUFFoaqXuqJtgjxuYjoZJ0OW%2BMszVvF4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87129b61890c9ab7-MIA alt-svc: h3=":443"; ma=86400
2024-04-08 13:29:33 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-08 13:29:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	104.21.67.152	443	1736	C:\Users\user\Desktop\edlyEKgpaz.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-08 13:29:34 UTC	64	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org
2024-04-08 13:29:34 UTC	712	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 13:29:34 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 84875 Last-Modified: Sun, 07 Apr 2024 13:54:59 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=si7ISH9EMbYq8hGyCs8qBA7%2Bg9Krt9KQAIELC81ezGhJ6LL%2BP11ZwtP8%2F6CdSMP8xcuBLIaR2FEi7%2BM3y9EyKy6EQdHhJ2x8Hiewu6Hrh0ivvfNatkKv2bK2%2F5%2BktfCrxDeWx8vZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87129b66ac79b3e3-MIA alt-svc: h3=":443"; ma=86400
2024-04-08 13:29:34 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-08 13:29:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49708	104.21.67.152	443	1736	C:\Users\user\Desktop\edlyEKgpaz.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-08 13:29:35 UTC	88	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-08 13:29:35 UTC	710	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 13:29:35 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 84876 Last-Modified: Sun, 07 Apr 2024 13:54:59 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o1%2FfwLnqCoRXtqTUiIOByQsPZ3NT2GQ7qznV1y50V7iZE3wtGDI8gM7PLnzyimlzs%2Bef7tCH8zwNd1tMrGY5Gx6SetXl%2B8mVilGk9%2BV6PIGv%2B7ftoPL6lSPfRWmheUfaHFDnZter"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87129b6d4b447472-MIA alt-svc: h3=":443"; ma=86400
2024-04-08 13:29:35 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-08 13:29:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49710	104.21.67.152	443	1736	C:\Users\user\Desktop\edlyEKgpaz.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-08 13:29:36 UTC	88	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-08 13:29:36 UTC	708	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 13:29:36 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 84877 Last-Modified: Sun, 07 Apr 2024 13:54:59 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WtEnj0wYhuehiJ5NExB%2FFW2D2W4cIcoH303sKYRaG72ExOceEqQf8XeD%2F51GMchWZBtdzqfaswJoqAGDQSqxKt1SIocT12Rv%2FHxUbQ8xjvc%2Bv9YvcWddFX0OsVu5xY8xhPcr95VE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87129b73bf79b3e9-MIA alt-svc: h3=":443"; ma=86400
2024-04-08 13:29:36 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-08 13:29:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49712	104.21.67.152	443	1736	C:\Users\user\Desktop\edlyEKgpaz.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-08 13:29:37 UTC	88	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-08 13:29:37 UTC	714	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 13:29:37 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 84878 Last-Modified: Sun, 07 Apr 2024 13:54:59 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BXK4GPadzewI%2B5bZp3hbAu0iw3rJjVgZkz61%2FXXMQ1JPG97%2FOjUYM%2B4FFb6%2FfeeuPchegGYmA3bIZZXh3AwcmpyHCg%2Boj8lCpHIR4kBkfI%2BnZduZYjoSQryglI9Rm0bR9o48zriH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87129b7a3eaa8db5-MIA alt-svc: h3=":443"; ma=86400
2024-04-08 13:29:37 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-08 13:29:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49714	104.21.67.152	443	1736	C:\Users\user\Desktop\edlyEKgpaz.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-08 13:29:38 UTC	88	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-08 13:29:38 UTC	704	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 13:29:38 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 84879 Last-Modified: Sun, 07 Apr 2024 13:54:59 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V2nAPRm4Ygwg4NGAicxNxh8JqQCUpR2T7O%2FjB9sW6ZIg714cUhTHMZpDeOer1LGDaoytSLHFGB003K5eEAH8INBPiT3oROA2KaKlpc4kVwtJ1oLTMnQmxS8lQISeYB%2BL9iPkidrV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87129b80ad6da51b-MIA alt-svc: h3=":443"; ma=86400
2024-04-08 13:29:38 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-08 13:29:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49716	104.21.67.152	443	1736	C:\Users\user\Desktop\edlyEKgpaz.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-08 13:29:39 UTC	88	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-08 13:29:39 UTC	712	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 13:29:39 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 84880 Last-Modified: Sun, 07 Apr 2024 13:54:59 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p280%2BeSKci90icT57YHAdI2TwVcsg7A7FiWiHR8q%2FaBZw5msxMuL%2BDgMIL9ZVbAbybEWNKB%2BPesD0t2vK0VfZhI4hk85egB8BuReh8eS1Z%2Bev98Ik%2F3KBY9rEkMt58ZqwmFER57h"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87129b873e283364-MIA alt-svc: h3=":443"; ma=86400
2024-04-08 13:29:39 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-08 13:29:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49718	104.21.67.152	443	1736	C:\Users\user\Desktop\edlyEKgpaz.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-08 13:29:40 UTC	88	OUT	GET /xml/102.129.152.231 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-04-08 13:29:40 UTC	708	IN	HTTP/1.1 200 OK Date: Mon, 08 Apr 2024 13:29:40 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 84881 Last-Modified: Sun, 07 Apr 2024 13:54:59 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tCClrOWxEni9PLXlCPhA93QRwfb%2Bb6RSkDMmsvkYqHtV01EZ652mLfiZegYx7GKDbJ9DqnVP54whl1uvH4HYgRq6BJnr5gzB4Dq1NOlD5l140Ir1WBI%2B96lgvLACMFB%2B%2FOdws5Gu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87129b8db99d5c77-MIA alt-svc: h3=":443"; ma=86400
2024-04-08 13:29:40 UTC	380	IN	Data Raw: 31 37 35 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 30 32 2e 31 32 39 2e 31 35 32 2e 32 33 31 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 43 41 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 43 61 6c 69 66 6f 72 6e 69 61 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4c 6f 73 20 41 6e 67 65 6c 65 73 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 39 30 30 30 39 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4c 6f 73 Data Ascii: 175<Response><IP>102.129.152.231</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>CA</RegionCode><RegionName>California</RegionName><City>Los Angeles</City><ZipCode>90009</ZipCode><TimeZone>America/Los
2024-04-08 13:29:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: edlyEKgpaz.exePID: 1736, Parent PID: 4084

General

Target ID:	0
Start time:	15:29:30
Start date:	08/04/2024
Path:	C:\Users\user\Desktop\edlyEKgpaz.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\edlyEKgpaz.exe"
Imagebase:	0x920000
File size:	132'608 bytes
MD5 hash:	CCFDBF07643AED4C333FAD91828E4A80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.1416628093.0000000000922000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000000.1416628093.0000000000922000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000000.1416628093.0000000000922000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000000.1416628093.0000000000922000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.1511341797.0000000003BB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 2828, Parent PID: 1736

General

Target ID:	2
Start time:	15:29:40
Start date:	08/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\edlyEKgpaz.exe"
Imagebase:	0x7ff6fbc20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 3984, Parent PID: 2828

General

Target ID:	3
Start time:	15:29:40
Start date:	08/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: choice.exePID: 2884, Parent PID: 2828

General

Target ID:	4
Start time:	15:29:40
Start date:	08/04/2024
Path:	C:\Windows\System32\choice.exe
Wow64 process (32bit):	false
Commandline:	choice /C Y /N /D Y /T 3
Imagebase:	0x7ff691510000
File size:	35'840 bytes
MD5 hash:	1A9804F0C374283B094E9E55DC5EE128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: edlyEKgpaz.exePID: 1736, Parent PID: 4084COMMON

Executed Functions

Function 00007FFB4B2308D3 Relevance: 2.8, Strings: 2, Instructions: 330COMMON

Download Yara Rule

Strings

K;N, xrefs: 00007FFB4B23096F
;N_^, xrefs: 00007FFB4B230901

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID: ;N_^$K;N
API String ID: 0-2106489120
Opcode ID: aa1b24018f4755203921ba3dac74feb3c66dc8f8224c54e26d188610828056dd
Instruction ID: ea10080391e79ae45d204e85e6d593d56a8ee12a4c274c303dc4c55240cb7835
Opcode Fuzzy Hash: aa1b24018f4755203921ba3dac74feb3c66dc8f8224c54e26d188610828056dd
Instruction Fuzzy Hash: F3A11571A0892D8FDB94EF6CD884BEDBBB1FF58311F0041AAD54DD7252DA34A881CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B2308D8 Relevance: 2.8, Strings: 2, Instructions: 324COMMON

Download Yara Rule

Strings

K;N, xrefs: 00007FFB4B23096F
;N_^, xrefs: 00007FFB4B230901

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID: ;N_^$K;N
API String ID: 0-2106489120
Opcode ID: b5f8d2e6abb2cfd6310a68a3e67e6cf25bffe1da7bfdd54f0e6af59b6e098219
Instruction ID: 66b3f8abaeb0aecd572e8f9f34f42d8e62f792fe520a1b71e19b179d0191fd92
Opcode Fuzzy Hash: b5f8d2e6abb2cfd6310a68a3e67e6cf25bffe1da7bfdd54f0e6af59b6e098219
Instruction Fuzzy Hash: 82A10571A0892D8FDB94EF68D884BEDBBE1FF59311F0041AAD54DD7252DA34A881CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B2308E8 Relevance: 2.8, Strings: 2, Instructions: 315COMMON

Download Yara Rule

Strings

K;N, xrefs: 00007FFB4B23096F
;N_^, xrefs: 00007FFB4B230901

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID: ;N_^$K;N
API String ID: 0-2106489120
Opcode ID: 10c45da2c351cce17e130356ab12eaf8dbd96422d6fe4cb5933e62fa2dc94485
Instruction ID: 2920b8f3a3d38b47ec059a9890f0acce2b841e17aea3670909484e8f348a188a
Opcode Fuzzy Hash: 10c45da2c351cce17e130356ab12eaf8dbd96422d6fe4cb5933e62fa2dc94485
Instruction Fuzzy Hash: 4AA11671A0892D8FDB94EF68D885BEDBBF1FF58311F0041AAD54DD7252CA34A881CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B2308F8 Relevance: 2.8, Strings: 2, Instructions: 308COMMON

Download Yara Rule

Strings

K;N, xrefs: 00007FFB4B23096F
;N_^, xrefs: 00007FFB4B230901

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID: ;N_^$K;N
API String ID: 0-2106489120
Opcode ID: a41e6ab348df7de5d2a837f9e4e477a8a5e1794949e427c8acd81f00a0fba260
Instruction ID: ea4f8fc5901c4d4279593b2d2cc1709f0305b2664f9bf1bb2e3f63abfc8d168f
Opcode Fuzzy Hash: a41e6ab348df7de5d2a837f9e4e477a8a5e1794949e427c8acd81f00a0fba260
Instruction Fuzzy Hash: 43A11771A0892D8FDB94EF68D885BEDBBF1FF58311F0041AAD54DD7252CA34A881CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B230898 Relevance: 1.6, Strings: 1, Instructions: 328COMMON

Download Yara Rule

Strings

K;N, xrefs: 00007FFB4B23096F

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID: K;N
API String ID: 0-4198949112
Opcode ID: 6ef2d95ad57a053ec2d26955992fe14056b044407b47ed5f061582de29b55709
Instruction ID: 551787ab3cefd38d6fdb94c04db84ab4eeef99bae9b7adbffe63a02e3ed86095
Opcode Fuzzy Hash: 6ef2d95ad57a053ec2d26955992fe14056b044407b47ed5f061582de29b55709
Instruction Fuzzy Hash: FAA11771A0892D8FDB94EF6CD885BEDBBE1FF58311F0041AAD54DD7252CA34A881CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B2308A8 Relevance: 1.6, Strings: 1, Instructions: 320COMMON

Download Yara Rule

Strings

K;N, xrefs: 00007FFB4B23096F

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID: K;N
API String ID: 0-4198949112
Opcode ID: 249313c1bbc3ebc34bb3f2c65ce89f75a296a9f918d371f20db5fd9c7b9f605e
Instruction ID: ebbdcf66372c07226972bcd90e637a0d6377189262628d361cd1799784a9285d
Opcode Fuzzy Hash: 249313c1bbc3ebc34bb3f2c65ce89f75a296a9f918d371f20db5fd9c7b9f605e
Instruction Fuzzy Hash: 71A10771A0892D8FDB94EF68D885BEDBBF1FF59311F0041AAD54DD7252CA34A881CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B2308B8 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

K;N, xrefs: 00007FFB4B23096F

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID: K;N
API String ID: 0-4198949112
Opcode ID: 315f36ebfb6cf9ffffc54d8dee39e251bea2a86ac94cdca7a098062a4c3dfcee
Instruction ID: 9753248759b5a58e2b19a38377fcf0f6988e9201d261957f70878772ba2e4b55
Opcode Fuzzy Hash: 315f36ebfb6cf9ffffc54d8dee39e251bea2a86ac94cdca7a098062a4c3dfcee
Instruction Fuzzy Hash: 2BA11871A0892D8FDB94EF68D885BEDBBF1FF59311F0041AAD54DD7252CA34A881CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B2308C8 Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

K;N, xrefs: 00007FFB4B23096F

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID: K;N
API String ID: 0-4198949112
Opcode ID: 94864e479d3d84cf5fb6325fbbc89a0170e6fcc87e0ca46ebefb60dd73ecaf61
Instruction ID: f178a7d3ec95b36e79a3586fed9795ac3ba15bb9c90088f3cdf24d9e3cf1478d
Opcode Fuzzy Hash: 94864e479d3d84cf5fb6325fbbc89a0170e6fcc87e0ca46ebefb60dd73ecaf61
Instruction Fuzzy Hash: 20A11971A0892D8FDB94EF68D884BEDBBF1FF59311F0041AAD54DD7252DA34A881CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B230908 Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

K;N, xrefs: 00007FFB4B23096F

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID: K;N
API String ID: 0-4198949112
Opcode ID: 1af63fe5d5595427d28f9fbcab8bd630444aea43cd74b58542888a8f4acd26f1
Instruction ID: 1f2522965518fc6bb114ae4b050de50d06e64a6cfb213cff7b11048b8e5e289e
Opcode Fuzzy Hash: 1af63fe5d5595427d28f9fbcab8bd630444aea43cd74b58542888a8f4acd26f1
Instruction Fuzzy Hash: ECA10871A0892D8FDB94EF68D885BEDBBF1FF59311F0041AAD54DD7252DA34A881CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B230CF0 Relevance: .6, Instructions: 550COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94f0c75921d0dba618caa501e22c8f6357bd2dce51d269275cf68c55fd1e8fed
Instruction ID: 7e6e615b1488cc0345bd2e5f39c4b1333a69509481b966680f6aa67393804d06
Opcode Fuzzy Hash: 94f0c75921d0dba618caa501e22c8f6357bd2dce51d269275cf68c55fd1e8fed
Instruction Fuzzy Hash: 4222D87091992D8FDBD1FF28C899BA9BBB2FB98300F5041A5D40DE3655EE34AD818F50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B235276 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff923287eee15a019e8f27a66b91c9ea8a80ece4567a81dd3efb97001e5eec06
Instruction ID: 43657a719c18a65057e95116f8e966b51600420e1bb5661d629198eac6d56beb
Opcode Fuzzy Hash: ff923287eee15a019e8f27a66b91c9ea8a80ece4567a81dd3efb97001e5eec06
Instruction Fuzzy Hash: 05B12D7190CA5D8FDB95EF68C895BACBBF1FF59300F1041AAD00DE7292DA34A981CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B233A78 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ded6c782e69138fc205fe5f9a5b6d73470d370b23994cd753a4c94dce7e5c023
Instruction ID: 7f21ba3575f6c34b0a133e2d8037c9e093d01f7f7f84259fd246de3b79b2312a
Opcode Fuzzy Hash: ded6c782e69138fc205fe5f9a5b6d73470d370b23994cd753a4c94dce7e5c023
Instruction Fuzzy Hash: EFB17CB1A0CA598FEB95EF68C8557E9BFF1FF19300F0440AAD44DE72A2CA355981CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B2346A6 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 109db1f936a2bd28dd0a1ae7eb215ad764daab543bf6c182c26befba1d6ff6d1
Instruction ID: df3a067ded718aff14dcc0549ac09b2485648e9bb56f24e045420f75e452837e
Opcode Fuzzy Hash: 109db1f936a2bd28dd0a1ae7eb215ad764daab543bf6c182c26befba1d6ff6d1
Instruction Fuzzy Hash: ABB12D7190CA5D8FDB95EF68C895BA8BBF1FF59300F1041EAD00DE72A2DA349981CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B2332FA Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 252054a2d042f168927362d99200a33fe700a01a9e304c444e2eb7a0d8f485e8
Instruction ID: 15855be9a71b2944c5cc2f6b16ddd4d4bc4b857845e83d434a490dbae13b039b
Opcode Fuzzy Hash: 252054a2d042f168927362d99200a33fe700a01a9e304c444e2eb7a0d8f485e8
Instruction Fuzzy Hash: 8DB10DB1908A5D8FDB94EF68C895BADBBF1FF59300F5041AAD00DE3291DB35A981CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B234EAA Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98ed64c5affb4e7a109b5ec7fe1ff3abeca1c2c5a2b59f6b38e8c99b81c1d888
Instruction ID: 1d06ec81c44b30befe411b6398180119b42ab6791b1f6641212a82c1bba49951
Opcode Fuzzy Hash: 98ed64c5affb4e7a109b5ec7fe1ff3abeca1c2c5a2b59f6b38e8c99b81c1d888
Instruction Fuzzy Hash: CBA11EB190CA1D8FDB94EF68C894BACBBF1FF69300F5041AAD04DE3291DA359981CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B234A96 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4d1ccbc507234c10ae43a2719110e408bbeb08cef01f491b3c95eca82c30eb1
Instruction ID: d86c6bd86404a3d3e71c07c19e36f215bc5ee8a62a6af67c209b772bb724b2ae
Opcode Fuzzy Hash: b4d1ccbc507234c10ae43a2719110e408bbeb08cef01f491b3c95eca82c30eb1
Instruction Fuzzy Hash: F1A12B7190CA5D8FDB95EF68C895BA8BBF1FF59300F1441EAD00DE72A2DA346981CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B233B0A Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 962ecad8743d0a17e69bdf089f68504b47aec3e59b0fe61cb52490b908efec6a
Instruction ID: c0fcc13562f3911c3ece9b3bf09a772528d6eed454d8f6d8f36773818efd97b8
Opcode Fuzzy Hash: 962ecad8743d0a17e69bdf089f68504b47aec3e59b0fe61cb52490b908efec6a
Instruction Fuzzy Hash: 8891ECB1D18A1D8FDB94EF68C895BA9BBF1FF68301F5041A9D00DE3291DB35A981CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B233F48 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edd696e539b77195f7bee3a514d31231a5d069d2dfa5f0dec3c11077ea33cda9
Instruction ID: cfadf15c40ee215f92febb67516dbf2f64ea6e1051c084a3375106748d00ae55
Opcode Fuzzy Hash: edd696e539b77195f7bee3a514d31231a5d069d2dfa5f0dec3c11077ea33cda9
Instruction Fuzzy Hash: ED91CBB1A0891D8FDF94EF68C895BACBBF1FF68301F5041AAD00DE3251DA35A981CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B234332 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 876e255d0adbc815905aa627cf75a602e87c672bc3490a07bb043c93aff5dbd5
Instruction ID: fddeea54f74674deba46adf3cb86073d0157974c1294c77f4d8d6b995759249a
Opcode Fuzzy Hash: 876e255d0adbc815905aa627cf75a602e87c672bc3490a07bb043c93aff5dbd5
Instruction Fuzzy Hash: DE91B8B1D1891D8FDB94EF68C895BACBBF1FF68300F5051AAD40DE3261DA35A981CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B23568A Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4658eea6ce716ddd9f860484380a9d2e05094a7b88b2fd6c791f16a8e1b2a885
Instruction ID: b1313bb02902b87cbb8bc020c2f17d4809cecba29dabfff59f6d0b2096235818
Opcode Fuzzy Hash: 4658eea6ce716ddd9f860484380a9d2e05094a7b88b2fd6c791f16a8e1b2a885
Instruction Fuzzy Hash: 5A81B970A08A5D8FDF94EF68C895BACBBF1FF69301F4441AAD44DE7251DA74A881CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B2309A0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd9711b8c02af569157a30369e2a55b52f4f8bacfca8fe3614130cc311ec96ca
Instruction ID: adae77c56b7f0c02522ca4f0dbacd4668baf5b8534b91c95bd911e067a8136e0
Opcode Fuzzy Hash: fd9711b8c02af569157a30369e2a55b52f4f8bacfca8fe3614130cc311ec96ca
Instruction Fuzzy Hash: 43718570A18A1D8FDF94EF68C895BADBBF1FF69301F5041A9E40DE7251DA74A881CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B23204A Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 495e601b1d4f22924385808c1e01e915b3619465096e4810f8f0b4fa73d11af1
Instruction ID: fdeb0b6f376684f450432dd70072f7529973c4ea305b5fed2a062be5f59731ec
Opcode Fuzzy Hash: 495e601b1d4f22924385808c1e01e915b3619465096e4810f8f0b4fa73d11af1
Instruction Fuzzy Hash: 5271E870909A1D9FDF95EF68C895AADBBF1FF59300F4010A9D40DE7266DB35A881CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B232060 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437761d636cb61b292c8e3eb905c2712ef5827ee1eb0cf6abb34fbdd05073d8b
Instruction ID: 0a5a155b2b099578c1cff85433a752fd710a1435e5a899c43c412ecf91376cb1
Opcode Fuzzy Hash: 437761d636cb61b292c8e3eb905c2712ef5827ee1eb0cf6abb34fbdd05073d8b
Instruction Fuzzy Hash: 9571D670A09A1D9FDF94EF68C895BADBBF1FB69300F501069E40DE7255DB35A881CB00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B230B0D Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b18f4fe73a45a0e1e12531b3d9383e3ad3ac40549afb8353d0c44f921ea7c1c
Instruction ID: ddf086eef37261790a72ca30951afceda29b2cfd17f9cee0b9a55c67f1589abb
Opcode Fuzzy Hash: 1b18f4fe73a45a0e1e12531b3d9383e3ad3ac40549afb8353d0c44f921ea7c1c
Instruction Fuzzy Hash: B4315BA291DA4D8FE352BF78C8562E9BFB1EF45214B4441BBC549C71E7ED28240387B1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B235E9E Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b2597c1b7ae40427f0e1bd77dcc34b41bfdfd23525a5ad67792922cb11eda13
Instruction ID: 407fc61e62b8cb65a17858f210d930ceb9b92c11aa15f045e9f983142060bf0e
Opcode Fuzzy Hash: 6b2597c1b7ae40427f0e1bd77dcc34b41bfdfd23525a5ad67792922cb11eda13
Instruction Fuzzy Hash: D631B27194A64A8FDB41EBB8C8516EDBBB1EF4A300F011079D509D3592DA399882CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B230B30 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ad3ea1f325613daf5e09a2059094548fdc5c9649fa73a2877b71f4dea070ab4
Instruction ID: 0b738198f60def8950301403256ccdfd73dd199eb79bdcec2507b3b492e2b41d
Opcode Fuzzy Hash: 6ad3ea1f325613daf5e09a2059094548fdc5c9649fa73a2877b71f4dea070ab4
Instruction Fuzzy Hash: 6C3127A291DA4E8FE792BF78C4552F9BFB2EF85210F4441B6C449D71E6DD28280387B1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B230B38 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c21138566a0cba7eab2da0f57bfd9caf84d79b898f087030081689e1183fb32
Instruction ID: 2090d6b18e5d2edebd5330d0668f2610e0c55a46e210407397d4df9a4ee00786
Opcode Fuzzy Hash: 2c21138566a0cba7eab2da0f57bfd9caf84d79b898f087030081689e1183fb32
Instruction Fuzzy Hash: C1214CA291D94D8FE792BF78C4552F9BFB2EF84310F4440B6D449D71A6DD28280387B1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B230B40 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ab1ad668417fcec4f83542f6078fe686bfee90dbc8cae165ecd52a8b491270a
Instruction ID: 37f49a0ab8ae78fe0d5c290b018f6b1e80fa543eb0597403837f82fc610f4a2e
Opcode Fuzzy Hash: 3ab1ad668417fcec4f83542f6078fe686bfee90dbc8cae165ecd52a8b491270a
Instruction Fuzzy Hash: B2214BA291D94D8FE792BF38C4552F9BFB2EF89310F4440B6D449D72AADD2828038771

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B235D81 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6907108088e79e8f76bf94c30a51ff521e27561b4c985180f52cbd4d4d8b46d
Instruction ID: 0ed97ac285bfc23b5a9c3ebde7912c11918d1ee1c125c46074cdafe9c52600c4
Opcode Fuzzy Hash: b6907108088e79e8f76bf94c30a51ff521e27561b4c985180f52cbd4d4d8b46d
Instruction Fuzzy Hash: DB2126B1C09A1E8EEB41EFA8C5596EDBBF0FF59300F40146AD408E3192DA38A5458B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B230B48 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a483a8f06c3e0c6bb799e56a0c5338723acebe9839eddfd1413638584d7abe2a
Instruction ID: a762edd43382943fca10cbec17438bcfa309ea2281db1d3f6a14f5bfb0bab732
Opcode Fuzzy Hash: a483a8f06c3e0c6bb799e56a0c5338723acebe9839eddfd1413638584d7abe2a
Instruction Fuzzy Hash: 8F212CA291D94D8FE792FF78C4552F9BFB2EF49300F4441B6D449D72AADD2828028771

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B230B50 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ca92296e85e6571ea6a9f04b7aa70fe77f83394989bd2e5fc06aba495b10dcb
Instruction ID: 276abcdde2c53a78fb63e2c52fcbef883d02fd79e1dbf1df363a1ffc762a947b
Opcode Fuzzy Hash: 6ca92296e85e6571ea6a9f04b7aa70fe77f83394989bd2e5fc06aba495b10dcb
Instruction Fuzzy Hash: B921F9A191D94E8FE792BF78C4552F9BFB2EF49300F4441B6D449D72AADD2828028771

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B231F85 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2aa33123fc145b7d7aecb271fe667056a7c30c5a29d9b03d0c5128d1f90dba9
Instruction ID: e448f61213e6dc1a39155c8ee9c95f582cbfd7ea5f97ffd041e420d84b2d5455
Opcode Fuzzy Hash: c2aa33123fc145b7d7aecb271fe667056a7c30c5a29d9b03d0c5128d1f90dba9
Instruction Fuzzy Hash: 6A21F8B1D19A4D8FDF81EFA8C859AEDBBB1FF59311F441166D508E32A1DB38A841CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFB4B230C32 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1512857006.00007FFB4B230000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b230000_edlyEKgpaz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 956096d825913165f6d819b249c18b5259632ac7538488065eaea143e19c44d2
Instruction ID: 3281e2766297f6c125886611d2f6c6c982482187cfb7120adf18e628d22f7f6f
Opcode Fuzzy Hash: 956096d825913165f6d819b249c18b5259632ac7538488065eaea143e19c44d2
Instruction Fuzzy Hash: 29D05EA29388095FE794FE79E855ABDA7A0FF84600B405236A14AC25A1CD2418018220

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report edlyEKgpaz.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\edlyEKgpaz.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Windows Analysis Report
edlyEKgpaz.exe