Edit tour

Windows Analysis Report
HT4YGXBRtx.exe

Overview

General Information

Sample name:	HT4YGXBRtx.exe renamed because original name is a hash value
Original sample name:	e9b6e8ea2ee0c97ed47b022a1b3d433c9fc7b7585dcebe7b52a2254fb68a72af.exe
Analysis ID:	1631788
MD5:	6c22541a5ead0ca30ee07fee745d5eda
SHA1:	227d7f8c7af279d2a9bc0cfeeef8ef3b12a33779
SHA256:	e9b6e8ea2ee0c97ed47b022a1b3d433c9fc7b7585dcebe7b52a2254fb68a72af
Tags:	exeuser-adrian__luca
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

Binary is likely a compiled AutoIt script file

Joe Sandbox ML detected suspicious sample

Maps a DLL or memory area into another process

Sample uses string decryption to hide its real strings

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

HT4YGXBRtx.exe (PID: 6616 cmdline: "C:\Users\user\Desktop\HT4YGXBRtx.exe" MD5: 6C22541A5EAD0CA30EE07FEE745D5EDA)

RegSvcs.exe (PID: 6836 cmdline: "C:\Users\user\Desktop\HT4YGXBRtx.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cmd.exe (PID: 1492 cmdline: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 6116 cmdline: choice /C Y /N /D Y /T 3 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7628028410:AAEpbCbHTWOy3r7fqeLD67OvGFoUK2pQiBw/sendMessage?chat_id=7337843299", "Token": "7628028410:AAEpbCbHTWOy3r7fqeLD67OvGFoUK2pQiBw", "Chat_id": "7337843299", "Version": "5.1"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.1154885264.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1154885264.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000001.00000002.1154885264.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1482a:$a1: get_encryptedPassword 0x14b16:$a2: get_encryptedUsername 0x14636:$a3: get_timePasswordChanged 0x14731:$a4: get_passwordField 0x14840:$a5: set_encryptedPassword 0x15eae:$a7: get_logins 0x15e11:$a10: KeyLoggerEventArgs 0x15a7c:$a11: KeyLoggerEventArgsEventHandler
00000001.00000002.1154885264.0000000000402000.00000040.80000000.00040000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19844:$x1: $%SMTPDV$ 0x18228:$x2: $#TheHashHere%& 0x197ec:$x3: %FTPDV$ 0x181c8:$x4: $%TelegramDv$ 0x15a7c:$x5: KeyLoggerEventArgs 0x15e11:$x5: KeyLoggerEventArgs 0x19810:$m2: Clipboard Logs ID 0x19a4e:$m2: Screenshot Logs ID 0x19b5e:$m2: keystroke Logs ID 0x19e38:$m3: SnakePW 0x19a26:$m4: \SnakeKeylogger\
00000001.00000002.1156067017.00000000031B2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a2a:$a1: get_encryptedPassword 0x14d16:$a2: get_encryptedUsername 0x14836:$a3: get_timePasswordChanged 0x14931:$a4: get_passwordField 0x14a40:$a5: set_encryptedPassword 0x160ae:$a7: get_logins 0x16011:$a10: KeyLoggerEventArgs 0x15c7c:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c3fa:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b62c:$a3: \Google\Chrome\User Data\Default\Login Data 0x1ba5f:$a4: \Orbitum\User Data\Default\Login Data 0x1ca9e:$a5: \Kometa\User Data\Default\Login Data
00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15613:$s1: UnHook 0x1561a:$s2: SetHook 0x15622:$s3: CallNextHook 0x1562f:$s4: _hook
00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19a44:$x1: $%SMTPDV$ 0x18428:$x2: $#TheHashHere%& 0x199ec:$x3: %FTPDV$ 0x183c8:$x4: $%TelegramDv$ 0x15c7c:$x5: KeyLoggerEventArgs 0x16011:$x5: KeyLoggerEventArgs 0x19a10:$m2: Clipboard Logs ID 0x19c4e:$m2: Screenshot Logs ID 0x19d5e:$m2: keystroke Logs ID 0x1a038:$m3: SnakePW 0x19c26:$m4: \SnakeKeylogger\
00000001.00000002.1156067017.0000000003001000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: HT4YGXBRtx.exe PID: 6616	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: HT4YGXBRtx.exe PID: 6616	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: HT4YGXBRtx.exe PID: 6616	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3e1ef4:$a1: get_encryptedPassword 0x3e21d6:$a2: get_encryptedUsername 0x3e1d0a:$a3: get_timePasswordChanged 0x3e1e05:$a4: get_passwordField 0x3e1f0a:$a5: set_encryptedPassword 0x3e43e7:$a7: get_logins 0x3e434a:$a10: KeyLoggerEventArgs 0x3e3fb5:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: HT4YGXBRtx.exe PID: 6616	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x3e3fb5:$x5: KeyLoggerEventArgs 0x3e434a:$x5: KeyLoggerEventArgs 0x3e49a3:$x5: KeyLoggerEventArgs 0x3e4d04:$x5: KeyLoggerEventArgs 0x3e6578:$m2: Clipboard Logs ID 0x3e667e:$m2: Screenshot Logs ID 0x3e66d4:$m2: keystroke Logs ID 0x3e6809:$m3: SnakePW 0x3e666a:$m4: \SnakeKeylogger\
Process Memory Space: RegSvcs.exe PID: 6836	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 6836	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: RegSvcs.exe PID: 6836	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3d42:$a1: get_encryptedPassword 0x4024:$a2: get_encryptedUsername 0x3b58:$a3: get_timePasswordChanged 0x3c53:$a4: get_passwordField 0x3d58:$a5: set_encryptedPassword 0x6235:$a7: get_logins 0x6198:$a10: KeyLoggerEventArgs 0x5e03:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegSvcs.exe PID: 6836	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x5e03:$x5: KeyLoggerEventArgs 0x6198:$x5: KeyLoggerEventArgs 0x67f1:$x5: KeyLoggerEventArgs 0x6b52:$x5: KeyLoggerEventArgs 0x83c6:$m2: Clipboard Logs ID 0x84cc:$m2: Screenshot Logs ID 0x8522:$m2: keystroke Logs ID 0x8657:$m3: SnakePW 0x84b8:$m4: \SnakeKeylogger\
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.HT4YGXBRtx.exe.a50000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.HT4YGXBRtx.exe.a50000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.HT4YGXBRtx.exe.a50000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12c2a:$a1: get_encryptedPassword 0x12f16:$a2: get_encryptedUsername 0x12a36:$a3: get_timePasswordChanged 0x12b31:$a4: get_passwordField 0x12c40:$a5: set_encryptedPassword 0x142ae:$a7: get_logins 0x14211:$a10: KeyLoggerEventArgs 0x13e7c:$a11: KeyLoggerEventArgsEventHandler
1.2.RegSvcs.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a2a:$a1: get_encryptedPassword 0x14d16:$a2: get_encryptedUsername 0x14836:$a3: get_timePasswordChanged 0x14931:$a4: get_passwordField 0x14a40:$a5: set_encryptedPassword 0x160ae:$a7: get_logins 0x16011:$a10: KeyLoggerEventArgs 0x15c7c:$a11: KeyLoggerEventArgsEventHandler
0.2.HT4YGXBRtx.exe.a50000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a5fa:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1982c:$a3: \Google\Chrome\User Data\Default\Login Data 0x19c5f:$a4: \Orbitum\User Data\Default\Login Data 0x1ac9e:$a5: \Kometa\User Data\Default\Login Data
1.2.RegSvcs.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c3fa:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b62c:$a3: \Google\Chrome\User Data\Default\Login Data 0x1ba5f:$a4: \Orbitum\User Data\Default\Login Data 0x1ca9e:$a5: \Kometa\User Data\Default\Login Data
0.2.HT4YGXBRtx.exe.a50000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13813:$s1: UnHook 0x1381a:$s2: SetHook 0x13822:$s3: CallNextHook 0x1382f:$s4: _hook
0.2.HT4YGXBRtx.exe.a50000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x17c44:$x1: $%SMTPDV$ 0x16628:$x2: $#TheHashHere%& 0x17bec:$x3: %FTPDV$ 0x165c8:$x4: $%TelegramDv$ 0x13e7c:$x5: KeyLoggerEventArgs 0x14211:$x5: KeyLoggerEventArgs 0x17c10:$m2: Clipboard Logs ID 0x17e4e:$m2: Screenshot Logs ID 0x17f5e:$m2: keystroke Logs ID 0x18238:$m3: SnakePW 0x17e26:$m4: \SnakeKeylogger\
1.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15613:$s1: UnHook 0x1561a:$s2: SetHook 0x15622:$s3: CallNextHook 0x1562f:$s4: _hook
1.2.RegSvcs.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19a44:$x1: $%SMTPDV$ 0x18428:$x2: $#TheHashHere%& 0x199ec:$x3: %FTPDV$ 0x183c8:$x4: $%TelegramDv$ 0x15c7c:$x5: KeyLoggerEventArgs 0x16011:$x5: KeyLoggerEventArgs 0x19a10:$m2: Clipboard Logs ID 0x19c4e:$m2: Screenshot Logs ID 0x19d5e:$m2: keystroke Logs ID 0x1a038:$m3: SnakePW 0x19c26:$m4: \SnakeKeylogger\
0.2.HT4YGXBRtx.exe.a50000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.HT4YGXBRtx.exe.a50000.0.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.HT4YGXBRtx.exe.a50000.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a2a:$a1: get_encryptedPassword 0x14d16:$a2: get_encryptedUsername 0x14836:$a3: get_timePasswordChanged 0x14931:$a4: get_passwordField 0x14a40:$a5: set_encryptedPassword 0x160ae:$a7: get_logins 0x16011:$a10: KeyLoggerEventArgs 0x15c7c:$a11: KeyLoggerEventArgsEventHandler
0.2.HT4YGXBRtx.exe.a50000.0.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c3fa:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b62c:$a3: \Google\Chrome\User Data\Default\Login Data 0x1ba5f:$a4: \Orbitum\User Data\Default\Login Data 0x1ca9e:$a5: \Kometa\User Data\Default\Login Data
0.2.HT4YGXBRtx.exe.a50000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15613:$s1: UnHook 0x1561a:$s2: SetHook 0x15622:$s3: CallNextHook 0x1562f:$s4: _hook
0.2.HT4YGXBRtx.exe.a50000.0.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19a44:$x1: $%SMTPDV$ 0x18428:$x2: $#TheHashHere%& 0x199ec:$x3: %FTPDV$ 0x183c8:$x4: $%TelegramDv$ 0x15c7c:$x5: KeyLoggerEventArgs 0x16011:$x5: KeyLoggerEventArgs 0x19a10:$m2: Clipboard Logs ID 0x19c4e:$m2: Screenshot Logs ID 0x19d5e:$m2: keystroke Logs ID 0x1a038:$m3: SnakePW 0x19c26:$m4: \SnakeKeylogger\
Click to see the 13 entries

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T15:54:23.909929+0100	2803305	3	Unknown Traffic	192.168.2.7	49683	104.21.64.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T15:54:18.997293+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49681	132.226.247.73	80	TCP
2025-03-07T15:54:21.872338+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49681	132.226.247.73	80	TCP
2025-03-07T15:54:24.684955+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49684	132.226.247.73	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: HT4YGXBRtx.exe

Avira: detected

Found malware configuration

Source: 00000001.00000002.1154885264.0000000000402000.00000040.80000000.00040000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "Telegram", "Telegram URL": "https://api.telegram.org/bot7628028410:AAEpbCbHTWOy3r7fqeLD67OvGFoUK2pQiBw/sendMessage?chat_id=7337843299", "Token": "7628028410:AAEpbCbHTWOy3r7fqeLD67OvGFoUK2pQiBw", "Chat_id": "7337843299", "Version": "5.1"}

Multi AV Scanner detection for submitted file

Source: HT4YGXBRtx.exe	ReversingLabs: Detection: 63%
Source: HT4YGXBRtx.exe	Virustotal: Detection: 64%			Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 0.2.HT4YGXBRtx.exe.a50000.0.unpack	String decryptor:
Source: 0.2.HT4YGXBRtx.exe.a50000.0.unpack	String decryptor: 7628028410:AAEpbCbHTWOy3r7fqeLD67OvGFoUK2pQiBw
Source: 0.2.HT4YGXBRtx.exe.a50000.0.unpack	String decryptor: 7337843299

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: HT4YGXBRtx.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49682 version: TLS 1.0

Source:	Binary string: wntdll.pdbUGP source: HT4YGXBRtx.exe, 00000000.00000003.906139801.00000000036F0000.00000004.00001000.00020000.00000000.sdmp, HT4YGXBRtx.exe, 00000000.00000003.904413088.0000000003550000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: HT4YGXBRtx.exe, 00000000.00000003.906139801.00000000036F0000.00000004.00001000.00020000.00000000.sdmp, HT4YGXBRtx.exe, 00000000.00000003.904413088.0000000003550000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FA445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00FA445A
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FAC6D1 FindFirstFileW,FindClose,	0_2_00FAC6D1
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FAC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00FAC75C
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FAEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00FAEF95
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FAF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00FAF0F2
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FAF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00FAF3F3
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FA37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00FA37EF
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FA3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00FA3B12
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FABCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00FABCBC

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1
Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49684 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49681 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49683 -> 104.21.64.1:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.7:49682 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00FB22EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00FB22EE

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: RegSvcs.exe, 00000001.00000002.1156067017.00000000031B2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.00000000030C8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003184000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.000000000315B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003176000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: RegSvcs.exe, 00000001.00000002.1156067017.00000000031B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.comp
Source: RegSvcs.exe, 00000001.00000002.1156067017.00000000031B2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.00000000030C8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003184000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.000000000315B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.000000000310B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.00000000030B5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003176000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003168000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003192000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegSvcs.exe, 00000001.00000002.1156067017.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: HT4YGXBRtx.exe, 00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1154885264.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegSvcs.exe, 00000001.00000002.1156067017.00000000031B2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003184000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.000000000315B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003176000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: RegSvcs.exe, 00000001.00000002.1156067017.0000000003001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000001.00000002.1156067017.00000000031B2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.00000000030C8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003184000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.000000000315B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.000000000310B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003176000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: HT4YGXBRtx.exe, 00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1154885264.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.00000000030C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegSvcs.exe, 00000001.00000002.1156067017.0000000003168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: RegSvcs.exe, 00000001.00000002.1156067017.00000000031B2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003184000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.000000000315B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.000000000310B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003176000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: RegSvcs.exe, 00000001.00000002.1156067017.000000000310B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189p

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00FB4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00FB4164

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00FB4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00FB4164

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00FB3F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00FB3F66

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00FA001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00FA001C

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00FCCABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00FCCABC

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.HT4YGXBRtx.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.HT4YGXBRtx.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.HT4YGXBRtx.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.HT4YGXBRtx.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.HT4YGXBRtx.exe.a50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.HT4YGXBRtx.exe.a50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.HT4YGXBRtx.exe.a50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.HT4YGXBRtx.exe.a50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000001.00000002.1154885264.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000001.00000002.1154885264.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: HT4YGXBRtx.exe PID: 6616, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: HT4YGXBRtx.exe PID: 6616, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: RegSvcs.exe PID: 6836, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 6836, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00F43B3A
Source: HT4YGXBRtx.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: HT4YGXBRtx.exe, 00000000.00000002.913597479.0000000000FF4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_95dc7109-3
Source: HT4YGXBRtx.exe, 00000000.00000002.913597479.0000000000FF4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_8dfa0fa4-4
Source: HT4YGXBRtx.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_4de997dd-a
Source: HT4YGXBRtx.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_f2fba3eb-6

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00FAA1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00FAA1EF

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00F98310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00F98310

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00FA51BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00FA51BD

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F4E6A0	0_2_00F4E6A0
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F6D975	0_2_00F6D975
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F4FCE0	0_2_00F4FCE0
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F621C5	0_2_00F621C5
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F762D2	0_2_00F762D2
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FC03DA	0_2_00FC03DA
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F7242E	0_2_00F7242E
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F625FA	0_2_00F625FA
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F566E1	0_2_00F566E1
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F9E616	0_2_00F9E616
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F7878F	0_2_00F7878F
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FA8889	0_2_00FA8889
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FC0857	0_2_00FC0857
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F76844	0_2_00F76844
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F58808	0_2_00F58808
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F6CB21	0_2_00F6CB21
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F76DB6	0_2_00F76DB6
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F56F9E	0_2_00F56F9E
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F53030	0_2_00F53030
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F6F1D9	0_2_00F6F1D9
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F63187	0_2_00F63187
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F41287	0_2_00F41287
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F61484	0_2_00F61484
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F55520	0_2_00F55520
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F67696	0_2_00F67696
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F55760	0_2_00F55760
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F61978	0_2_00F61978
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F79AB5	0_2_00F79AB5
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FC7DDB	0_2_00FC7DDB
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F6BDA6	0_2_00F6BDA6
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F61D90	0_2_00F61D90
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F53FE0	0_2_00F53FE0
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F4DF00	0_2_00F4DF00
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00A43670	0_2_00A43670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02E9B328	1_2_02E9B328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02E9C190	1_2_02E9C190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02E96108	1_2_02E96108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02E9C751	1_2_02E9C751
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02E9C470	1_2_02E9C470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02E94AD9	1_2_02E94AD9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02E9CA31	1_2_02E9CA31
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02E9BBD3	1_2_02E9BBD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02E96880	1_2_02E96880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02E99858	1_2_02E99858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02E9BEB0	1_2_02E9BEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02E9B4F3	1_2_02E9B4F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02E93570	1_2_02E93570

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: String function: 00F47DE1 appears 35 times
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: String function: 00F68900 appears 42 times
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: String function: 00F60AE3 appears 70 times

Source: HT4YGXBRtx.exe, 00000000.00000003.905560908.0000000003673000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs HT4YGXBRtx.exe
Source: HT4YGXBRtx.exe, 00000000.00000003.905226515.000000000381D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs HT4YGXBRtx.exe
Source: HT4YGXBRtx.exe, 00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs HT4YGXBRtx.exe

Source: HT4YGXBRtx.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.HT4YGXBRtx.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.HT4YGXBRtx.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.HT4YGXBRtx.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.HT4YGXBRtx.exe.a50000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.HT4YGXBRtx.exe.a50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.HT4YGXBRtx.exe.a50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.HT4YGXBRtx.exe.a50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.HT4YGXBRtx.exe.a50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000001.00000002.1154885264.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000001.00000002.1154885264.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: HT4YGXBRtx.exe PID: 6616, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: HT4YGXBRtx.exe PID: 6616, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: RegSvcs.exe PID: 6836, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 6836, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: 0.2.HT4YGXBRtx.exe.a50000.0.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.HT4YGXBRtx.exe.a50000.0.raw.unpack, ----.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.HT4YGXBRtx.exe.a50000.0.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.HT4YGXBRtx.exe.a50000.0.raw.unpack, ---.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.HT4YGXBRtx.exe.a50000.0.raw.unpack, ----.cs

Base64 encoded string: 'POJ2qtFedhgDXtHiUGcH+oCtXzqG9DpZfgx1QroYhBrCzQ84sv5wHKZ5pnf4O1po'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@8/5@2/2

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00FAA06A GetLastError,FormatMessageW,

0_2_00FAA06A

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F981CB AdjustTokenPrivileges,CloseHandle,		0_2_00F981CB
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F987E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00F987E1

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00FAB3FB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00FAB3FB

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00FBEE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00FBEE0D

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00FB83BB CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00FB83BB

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00F44E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00F44E89

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6500:120:WilError_03

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

File created: C:\Users\user~1\AppData\Local\Temp\autF758.tmp

Jump to behavior

Source: HT4YGXBRtx.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: HT4YGXBRtx.exe	ReversingLabs: Detection: 63%
Source: HT4YGXBRtx.exe	Virustotal: Detection: 64%

Source: unknown	Process created: C:\Users\user\Desktop\HT4YGXBRtx.exe "C:\Users\user\Desktop\HT4YGXBRtx.exe"
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\HT4YGXBRtx.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\HT4YGXBRtx.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3	Jump to behavior

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior

Source: HT4YGXBRtx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: HT4YGXBRtx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: HT4YGXBRtx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: HT4YGXBRtx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: HT4YGXBRtx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: HT4YGXBRtx.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: HT4YGXBRtx.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: HT4YGXBRtx.exe, 00000000.00000003.906139801.00000000036F0000.00000004.00001000.00020000.00000000.sdmp, HT4YGXBRtx.exe, 00000000.00000003.904413088.0000000003550000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: HT4YGXBRtx.exe, 00000000.00000003.906139801.00000000036F0000.00000004.00001000.00020000.00000000.sdmp, HT4YGXBRtx.exe, 00000000.00000003.904413088.0000000003550000.00000004.00001000.00020000.00000000.sdmp

Source: HT4YGXBRtx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: HT4YGXBRtx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: HT4YGXBRtx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: HT4YGXBRtx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: HT4YGXBRtx.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00F44B37 LoadLibraryA,GetProcAddress,

0_2_00F44B37

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00F68945 push ecx; ret

0_2_00F68958

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F448D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00F448D7
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FC5376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00FC5376

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00F63187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00F63187

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

API/Special instruction interceptor: Address: A43294

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598866	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598747	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598639	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596952	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596045	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595936	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595684	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594235	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1884			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7958			Jump to behavior

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

API coverage: 5.2 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FA445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00FA445A
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FAC6D1 FindFirstFileW,FindClose,	0_2_00FAC6D1
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FAC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00FAC75C
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FAEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00FAEF95
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FAF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00FAF0F2
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FAF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00FAF3F3
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FA37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00FA37EF
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FA3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00FA3B12
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FABCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00FABCBC

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00F449A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00F449A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598866	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598747	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598639	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596952	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596045	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595936	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595684	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594235	Jump to behavior

Source: RegSvcs.exe, 00000001.00000002.1155199161.0000000001346000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

API call chain: ExitProcess graph end node

graph_0-104826

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00FB3F09 BlockInput,

0_2_00FB3F09

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00F43B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00F43B3A

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00F75A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00F75A7C

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00F44B37 LoadLibraryA,GetProcAddress,

0_2_00F44B37

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00A43500 mov eax, dword ptr fs:[00000030h]	0_2_00A43500
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00A43560 mov eax, dword ptr fs:[00000030h]	0_2_00A43560
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00A41E70 mov eax, dword ptr fs:[00000030h]	0_2_00A41E70

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00F980A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_00F980A9

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F6A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00F6A155
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00F6A124 SetUnhandledExceptionFilter,		0_2_00F6A124

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 10AA008

Jump to behavior

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00F987B1 LogonUserW,

0_2_00F987B1

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00F43B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00F43B3A

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00F448D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00F448D7

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00FA4C7F mouse_event,

0_2_00FA4C7F

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\HT4YGXBRtx.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3	Jump to behavior

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00F97CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00F97CAF

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00F9874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00F9874B

Source: HT4YGXBRtx.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: HT4YGXBRtx.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00F6862B cpuid

0_2_00F6862B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00F74E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00F74E87

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00F81E06 GetUserNameW,

0_2_00F81E06

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00F73F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00F73F3A

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe

Code function: 0_2_00F449A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00F449A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.HT4YGXBRtx.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HT4YGXBRtx.exe.a50000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1154885264.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1156067017.00000000031B2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1156067017.0000000003001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HT4YGXBRtx.exe PID: 6616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6836, type: MEMORYSTR

Source: HT4YGXBRtx.exe	Binary or memory string: WIN_81
Source: HT4YGXBRtx.exe	Binary or memory string: WIN_XP
Source: HT4YGXBRtx.exe	Binary or memory string: WIN_XPe
Source: HT4YGXBRtx.exe	Binary or memory string: WIN_VISTA
Source: HT4YGXBRtx.exe	Binary or memory string: WIN_7
Source: HT4YGXBRtx.exe	Binary or memory string: WIN_8
Source: HT4YGXBRtx.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 0.2.HT4YGXBRtx.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HT4YGXBRtx.exe.a50000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1154885264.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HT4YGXBRtx.exe PID: 6616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6836, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.HT4YGXBRtx.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HT4YGXBRtx.exe.a50000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.1154885264.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1156067017.00000000031B2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1156067017.0000000003001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HT4YGXBRtx.exe PID: 6616, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6836, type: MEMORYSTR

Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FB6283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00FB6283
Source: C:\Users\user\Desktop\HT4YGXBRtx.exe	Code function: 0_2_00FB6747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00FB6747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	21 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	126 System Information Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	1 Masquerading	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Valid Accounts	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
HT4YGXBRtx.exe	63%	ReversingLabs	Win32.Trojan.DarkCloud
HT4YGXBRtx.exe	65%	Virustotal		Browse
HT4YGXBRtx.exe	100%	Avira	TR/AD.SnakeStealer.tqqbm

Source	Detection	Scanner	Label	Link
http://checkip.dyndns.comp	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.64.1	true	false	high
checkip.dyndns.com	132.226.247.73	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false		high
https://reallyfreegeoip.org/xml/8.46.123.189	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org	RegSvcs.exe, 00000001.00000002.1156067017.00000000031B2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.00000000030C8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003184000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.000000000315B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.000000000310B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003176000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003168000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.comp	RegSvcs.exe, 00000001.00000002.1156067017.00000000031B2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org	RegSvcs.exe, 00000001.00000002.1156067017.00000000031B2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.00000000030C8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003184000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.000000000315B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.000000000310B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.00000000030B5000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003176000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003168000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003192000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	RegSvcs.exe, 00000001.00000002.1156067017.00000000031B2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.00000000030C8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003184000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.000000000315B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003176000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003168000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000001.00000002.1156067017.0000000003001000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.189p	RegSvcs.exe, 00000001.00000002.1156067017.000000000310B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/q	HT4YGXBRtx.exe, 00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1154885264.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.189$	RegSvcs.exe, 00000001.00000002.1156067017.00000000031B2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003184000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.000000000315B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.000000000310B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003176000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003168000.00000004.00000800.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.org	RegSvcs.exe, 00000001.00000002.1156067017.00000000031B2000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003184000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.000000000315B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003176000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.0000000003168000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	HT4YGXBRtx.exe, 00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1154885264.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.1156067017.00000000030C8000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.64.1	reallyfreegeoip.org	United States		13335	CLOUDFLARENETUS	false
132.226.247.73	checkip.dyndns.com	United States		16989	UTMEMUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1631788
Start date and time:	2025-03-07 15:53:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	HT4YGXBRtx.exe renamed because original name is a hash value
Original Sample Name:	e9b6e8ea2ee0c97ed47b022a1b3d433c9fc7b7585dcebe7b52a2254fb68a72af.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@8/5@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 65 Number of non-executed functions: 278
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.199.214.10
Excluded domains from analysis (whitelisted): fs.microsoft.com, ctldl.windowsupdate.com, c.pki.goog
Execution Graph export aborted for target RegSvcs.exe, PID 6836 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:54:21	API Interceptor	174x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.64.1	Payment receipt PO 1437 1_ Payment receipt PO #1437 2.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/fix/five/fre.php
	Payment.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	7RryusxiMtHBz80.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sss2/five/fre.php
	Request for quotation -6001845515-XLSX.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/tking3/five/fre.php
	vsf098633534.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sccc/five/fre.php
	laser.ps1	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/jgkl/
	UPDATED SOA.pdf.exe	Get hash	malicious	FormBook	Browse	www.shlomi.app/t3l4/
	QUOTE OF DRY DOCK REPAIR.exe	Get hash	malicious	FormBook	Browse	www.arryongro-nambe.live/ljgq/
	QUOTATION NO REQ-19-000640.exe	Get hash	malicious	FormBook	Browse	www.askvtwv8.top/2875/
	Revised Order Confirmation.exe	Get hash	malicious	FormBook	Browse	www.lucynoel6465.shop/hbfq/
132.226.247.73	4LJHFzA8jr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	nGI2U2r41E.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	7l3CafRVv7.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/
	C6FGS0I3yn.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	ckHregxJIq.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	jcHIuFAWdB.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Win32.CrypterX-gen.30422.25408.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/
	z1INVOICE4602-FMT25020147.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Ziraat_Bankasi_Swift_Messaji.png.exe	Get hash	malicious	MSIL Logger, MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Repeat Order.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	UOEAjWmusE.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	4LJHFzA8jr.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	nGI2U2r41E.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	7l3CafRVv7.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.80.1
	C6FGS0I3yn.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	ckHregxJIq.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	PvAmrCZENy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	rjRYMApdf9.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	jcHIuFAWdB.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	8JVG9KELay.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
checkip.dyndns.com	UOEAjWmusE.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	193.122.130.0
	4LJHFzA8jr.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	nGI2U2r41E.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	7l3CafRVv7.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
	C6FGS0I3yn.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	ckHregxJIq.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	PvAmrCZENy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	rjRYMApdf9.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	jcHIuFAWdB.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
	8JVG9KELay.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UTMEMUS	4LJHFzA8jr.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	nGI2U2r41E.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	7l3CafRVv7.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
	C6FGS0I3yn.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	ckHregxJIq.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	PvAmrCZENy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	jcHIuFAWdB.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
	uB9KTHzsXJ.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	PENDING PAYMENT FOR March SOA.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	SecuriteInfo.com.Win32.CrypterX-gen.30422.25408.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	132.226.247.73
CLOUDFLARENETUS	PayeeRemittanceNotice_ GQUMJOTASN.eml	Get hash	malicious	Unknown	Browse	104.17.25.14
	UOEAjWmusE.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	4LJHFzA8jr.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	nGI2U2r41E.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	7l3CafRVv7.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.80.1
	C6FGS0I3yn.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	ckHregxJIq.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	oCPGyn28rc.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	CjbMEPJZ3J.exe	Get hash	malicious	FormBook	Browse	104.21.3.103
	PvAmrCZENy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	UOEAjWmusE.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.64.1
	4LJHFzA8jr.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	nGI2U2r41E.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	7l3CafRVv7.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.64.1
	C6FGS0I3yn.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	ckHregxJIq.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	PvAmrCZENy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	rjRYMApdf9.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
	jcHIuFAWdB.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.64.1
	8JVG9KELay.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.353332853270839
Encrypted:	false
SSDEEP:	24:ML9E4KiE4Ko84qXKDE4KhKiKhPKIE4oKNzKoZAE4KzeR:MxHKiHKoviYHKh3oPtHo6hAHKzeR
MD5:	A4AF0F36EC4E0C69DC0F860C891E8BBE
SHA1:	28DD81A1EDDF71CBCBF86DA986E047279EF097CD
SHA-256:	B038D4342E4DD96217BD90CFE32581FCCB381C5C2E6FF257CD32854F840D1FDE
SHA-512:	A675D3E9DB5BDD325A22E82C6BCDBD5409D7A34453DAAEB0E37206BE982C388547E1BDF22DC70393C69D0CE55635E2364502572C3AD2E6753A56A5C3893F6D69
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e

C:\Users\user\AppData\Local\Temp\autF758.tmp

Download File

Process:	C:\Users\user\Desktop\HT4YGXBRtx.exe
File Type:	data
Category:	dropped
Size (bytes):	16776
Entropy (8bit):	7.496052840131281
Encrypted:	false
SSDEEP:	384:GrBdiwBCv1mVmrL8qZ6A1oDqUKKNcPrJfkAL0pN:U4dv1ymrI/DoKNcPrn0v
MD5:	6DC2C7DB76873C55EF868A961F692FCC
SHA1:	382B87431D06179FBE1B07920F386AEF12700DCD
SHA-256:	D9C5B93FD2A768FB12388945DFBE1FFB405264EADBDE2672764018391B0FCD69
SHA-512:	26E4A9FC5B1CD648D31C3E78BA217D3AD0E9C15A16924786F0C6118540A2316265966BB4256CC70BAB970FD88DE88769712689F990927267630E9C7874FA3035
Malicious:	false
Reputation:	low
Preview:	EA06...&......e6.....x.....+...n....(.V.`..4........#92.........M..>i....8.2..@...(.W.6......9........K\|..o....B....V..o.d.i...h~3.!....9...@.?.{....6.....?..(...3.....?.......9....?..!.r.....\|. 8O..j...M..?......6.8..`C.......}..P\|...=....-....@i.........\|.`...<!........y.........:......p.....X...Z....C.-......?.....[2....@<>{(...o4....C..p-...j........0-..Vj.....t~3.)O..l.i...B.?.[ n..8.....?.k n..!I..Y.u?.,........R..V@.O.B..j...~....U.8C......n...'..e....)?..(...!I..YF6?.Y.X'..6....l p....%[....p..,..L..b..Z....-..7..h..p.O.....h..p.O..r.....h\|.qdO..*3.L...f.n....Y..A..h.......Y..7.t..&........HC.....?..g'..a.8.....x...a.8..C.?.k.....7......C....s._.8.B.?..!....!.N@.?...I'...9..B:?..!..&q...h?..-....i....?...`...3..........C........"......`.....0!..V.X!.L.b?...`...i..X..?.Y.....X!..X.h?.C.....i..........f...,.+..,.U....V1>.....d..bq..U...x...n?.k....G1...' M.4......@7..t.'....2...7.......... ......Z~.@.O...q....\|.............s..o......X..`.....

C:\Users\user\AppData\Local\Temp\autFAC4.tmp

Download File

Process:	C:\Users\user\Desktop\HT4YGXBRtx.exe
File Type:	data
Category:	dropped
Size (bytes):	94176
Entropy (8bit):	7.927407946138047
Encrypted:	false
SSDEEP:	1536:21jegkkPSe+rTmnYlg3W0mTKhYLnrjdZOYv+heasRTGf+N6pigx8TngAS:M7VPSemTmf0lTFGIaAMgS8TS
MD5:	BE7EC39E2E20A48D0A300C38F068E7D7
SHA1:	9BCB3DBBE7202409D471B95E73026F30D0FF03F8
SHA-256:	249EACA4B837DA89EDE8377D1CD601E50FA802D006C34597BBAC6CE57F3850E7
SHA-512:	0A4998E95165D4E922C6DCEF3A7C010A8016C1953B6454A93CF80AC0212380C515F56C3DFA868876B62846471EF71152F1DCEAD52F8505603C5EC8110A6C2758
Malicious:	false
Reputation:	low
Preview:	EA06......xT.5^.4.Ti..g3.L..j.R.3.V+S56aK.Sh.....x.T&s9...k.....x..=S.'.....&W..N.^.I.t9T.{@.."....W8.E$.K\|..>...+...t.W'....G..-f)... ..............U.dV.P.Qj4....'.Z.R...."T@.b%M...%..>.N...L.[R...O...6.....r...L...+.......].H&Sh...x.L.5.....U.W.<2.....\|Q9..p.=...M...v=F..`..3W[.Q.....W.M......8.P&..........m".B..8......8.....WJ.O.-3S..... .....L. .....G.......g5.l".j...X.V@.....K...3O.....=..;IW.`u.J..Z.=..6.N.N.`........LU..........@..Z..I......7.<$..D4.h........)....}.M(.u".Z.......^.......M.Pz@?.R.`...\...g4..@.....`..i...z=Q.m..i..W]....9...\.Q..mJ.m..&...J..d.i..[}.T.=..jeB....m..x..4Y...3..'.N...1.G+Se.%5.Sh.;...s..iU..ba..R(.J...X.D'....f..nT..F.L..#2..I6../1.54.h.L,7..N.P.[.6[T..hFf..M[.$..#..=J. .Vj.....O.S/.9..q..U.Y...Z.Y...}BE...'.+.F.H.......).......wz.x,.:.J.}.x,\...m...<.9.b.D.[...]b.k..&.J.>..hFm.).".F...U..>....g..A...R5.i4.e2.Z&`.M2.L.Pe....mR.Ki...f+0.L.s....~.L(.....I..j.j<.B.=....X......6.u.M.=.<.......)E.....<.....k..;sJ%V.H.\.3.n

C:\Users\user\AppData\Local\Temp\oxmanship

Download File

Process:	C:\Users\user\Desktop\HT4YGXBRtx.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	296998
Entropy (8bit):	3.060644820537526
Encrypted:	false
SSDEEP:	12:kRqkJpeIplat42eplZFz6JplhnuRIcycTl7ZTDVVIIeIcNedVp3fRLFjwXjPOad/:N
MD5:	5D57C6CC89D29105BFC79A6CCCD052F8
SHA1:	349A02D86C9C5EB158D7046F2F8360361F735309
SHA-256:	32A423F0767C1459B2BF2219287B64085212470C2DD3AD5B752BC635B6340971
SHA-512:	320755B881AC960EEBD1A997B2A2D9E059ECEF4C21418E0A5B035AB9500011ADFBCA3001C54F9DB41556CDD4D74ACF5CE556D700D23C1ECC2DD5762E927F38CF
Malicious:	false
Reputation:	low
Preview:	7259842650725984265x725984265572598426557259842658725984265b725984265e725984265c72598426587259842651725984265e725984265c725984265c725984265c7259842650725984265272598426507259842650725984265072598426507259842655725984265672598426557259842657725984265b72598426587259842656725984265b72598426507259842650725984265072598426507259842650725984265072598426567259842656725984265872598426597259842654725984265572598426587259842654725984265b72598426597259842656725984265572598426507259842650725984265072598426507259842650725984265072598426567259842656725984265872598426597259842654725984265d72598426587259842656725984265b725984265a7259842657725984265272598426507259842650725984265072598426507259842650725984265072598426567259842656725984265872598426597259842655725984265572598426587259842658725984265b72598426587259842656725984265e7259842650725984265072598426507259842650725984265072598426507259842656725984265672598426587259842659725984265472598426557259842658725984265a725984265b725984265972598426567259842655

C:\Users\user\AppData\Local\Temp\ultraradicalism

Download File

Process:	C:\Users\user\Desktop\HT4YGXBRtx.exe
File Type:	data
Category:	modified
Size (bytes):	133632
Entropy (8bit):	7.065309988474431
Encrypted:	false
SSDEEP:	1536:NAxwYeJ/jIQRqW9HKnLnNXSQJbNpppSEjMTkDTLT5mY+6l0MKSzkiyeI/3M44cj0:NMyyQRVyKgeiyeIEjGmZJIVU2s39xj
MD5:	83643DDF6072DA4953EAD826196F3233
SHA1:	AEFFB042CEF0C6CB34DD529D93AD136150B80FD1
SHA-256:	DB8F86130ADC455F5AC6125647C4D9A63B4DD9CB9112706CDD4647348B9B15AE
SHA-512:	8E2827085CD9D28D36F060E5E594858CC132EEA2CF5EAD0A29C258A0F2B05AB91849A0972A9AF88EE7389C514AD29F364C4628DF3188432732D63A03E4569B75
Malicious:	false
Reputation:	low
Preview:	}..MFWP4@QOH..33.206WTS3.XZ2FM0KRMEWP4DQOHJP330206WTS3XXZ2FM.KRMKH.:D.F.k.2...d^>'sC*7=@' .(3#+8$.&4o:?>.Z^.ty.t>\<=t?KG.KRMEWP4..OH.Q03...PWTS3XXZ2.M2JYL.WP.EQO\JP3302>%UTS.XXZ.DM0K.MEwP4DSOHNP330206STS3XXZ2F-2KROEWP4DQMH..33 20&WTS3HXZ"FM0KRMUWP4DQOHJP33. 26.TS3XxX2.]0KRMEWP4DQOHJP33020vUT_3XXZ2FM0KRMEWP4DQOHJP330206WTS3XXZ2FM0KRMEWP4DQOHJP3.0286WTS3XXZ2FM8kRM.WP4DQOHJP33.FUN#TS3L.[2Fm0KR.DWP6DQOHJP330206WTs3X8t@5?SKRM.GP4DqMHJB330.16WTS3XXZ2FM0K.ME.~F!= +JP?3020vUTS1XXZ:DM0KRMEWP4DQOH.P3q0206WTS3XXZ2FM0K._GWP4DQ.HJP1352..VTg.XXY2FM.KRK.wQ4.QOHJP330206WTS3XXZ2FM0KRMEWP4DQOHJP330206WT.N.W..$C.MEWP4DPMKNV;;0206WTS3&XZ2.M0K.MEWg4DQjHJP^302.6WT-3XX$2FMTKRM7WP4%QOH.P33_2069TS3&XZ2XO.kRMO}v4FynHJZ3..A.6W^.2XX^AeM0A.OEWTG`QOB.S334A.6W^.7XX^A`M0A.HEWT..QL.\V33+].6W^S0.M\2FV.mROmmP4NQenJS.&620-}vS1.QZ2Bgf8OMEQxwDQE<CP31.806S~M1p.Z2Lg.5BMES{4ns1YJP7.0..HETS7sXp.8^0KVfE}rJPQOLaP.-2.$6WPy.&MZ2Bf0ap3SWP0oQej4G334.0.IV.$XX^.@gRK tYW 7+.OHLx.308.VWTU3rbZLfM0OP".WP>b{.HHx020804T)e3X\X6;z0KVg.WRO}Q

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.860043329932603
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	HT4YGXBRtx.exe
File size:	972'800 bytes
MD5:	6c22541a5ead0ca30ee07fee745d5eda
SHA1:	227d7f8c7af279d2a9bc0cfeeef8ef3b12a33779
SHA256:	e9b6e8ea2ee0c97ed47b022a1b3d433c9fc7b7585dcebe7b52a2254fb68a72af
SHA512:	6abe98ae65a3536c5d5251f70ddab074dab433bda11c88fac86ec30263d3f638c3afea4f1fbd865d2f3e772a4fe079ddc1ebc1d0a2c00a5f0016478486a2d140
SSDEEP:	24576:Ku6J33O0c+JY5UZ+XC0kGso6FaFtTyVlEJQbWY:8u0c++OCvkGs9FaFtG3EBY
TLSH:	8925AD2273DEC361CB669133BF29B7016EBF3C614630B95B2F980D7DA950162162D7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67ACB332 [Wed Feb 12 14:41:54 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F95B4B440DAh
jmp 00007F95B4B36EA4h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F95B4B3702Ah
cmp edi, eax
jc 00007F95B4B3738Eh
bt dword ptr [004C31FCh], 01h
jnc 00007F95B4B37029h
rep movsb
jmp 00007F95B4B3733Ch
cmp ecx, 00000080h
jc 00007F95B4B371F4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F95B4B37030h
bt dword ptr [004BE324h], 01h
jc 00007F95B4B37500h
bt dword ptr [004C31FCh], 00000000h
jnc 00007F95B4B371CDh
test edi, 00000003h
jne 00007F95B4B371DEh
test esi, 00000003h
jne 00007F95B4B371BDh
bt edi, 02h
jnc 00007F95B4B3702Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F95B4B37033h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F95B4B37085h
bt esi, 03h
jnc 00007F95B4B370D8h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x24e14	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xec000	0x711c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	d28a820a1d9ff26cda02d12b888ba4b4	False	0.5728679102422908	data	6.676118058520316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x24e14	0x25000	ff91bc8374ddd95167a6583ba3e1e474	False	0.8201673353040541	data	7.602696921745735	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xec000	0x711c	0x7200	6fcae3cbbf6bfbabf5ec5bbe7cf612c3	False	0.7650767543859649	data	6.779031650454199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0x1c0da	data			1.0004003272239919
RT_GROUP_ICON	0xeb894	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xeb90c	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xeb920	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xeb934	0x14	data	English	Great Britain	1.25
RT_VERSION	0xeb948	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xeba24	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Version Infos

Description	Data
Translation	0x0809 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-07T15:54:18.997293+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49681	132.226.247.73	80	TCP
2025-03-07T15:54:21.872338+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49681	132.226.247.73	80	TCP
2025-03-07T15:54:23.909929+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49683	104.21.64.1	443	TCP
2025-03-07T15:54:24.684955+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49684	132.226.247.73	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 7, 2025 15:54:18.022691965 CET	49681	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:18.027942896 CET	80	49681	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:18.028021097 CET	49681	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:18.028352022 CET	49681	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:18.033345938 CET	80	49681	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:18.727929115 CET	80	49681	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:18.735768080 CET	49681	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:18.740987062 CET	80	49681	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:18.945441008 CET	80	49681	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:18.997292995 CET	49681	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:19.008768082 CET	49682	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:19.008817911 CET	443	49682	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:19.008908033 CET	49682	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:19.020752907 CET	49682	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:19.020785093 CET	443	49682	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:20.672631025 CET	443	49682	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:20.672708035 CET	49682	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:20.686599970 CET	49682	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:20.686633110 CET	443	49682	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:20.687000036 CET	443	49682	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:20.731688976 CET	49682	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:20.751705885 CET	49682	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:20.792326927 CET	443	49682	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:21.604089975 CET	443	49682	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:21.604252100 CET	443	49682	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:21.604343891 CET	49682	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:21.612263918 CET	49682	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:21.615669966 CET	49681	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:21.621614933 CET	80	49681	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:21.825989008 CET	80	49681	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:21.831584930 CET	49683	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:21.831688881 CET	443	49683	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:21.831799984 CET	49683	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:21.832086086 CET	49683	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:21.832123041 CET	443	49683	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:21.872338057 CET	49681	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:23.429605961 CET	443	49683	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:23.432125092 CET	49683	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:23.432174921 CET	443	49683	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:23.909970999 CET	443	49683	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:23.910057068 CET	443	49683	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:23.910116911 CET	49683	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:23.910522938 CET	49683	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:23.913656950 CET	49681	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:23.914884090 CET	49684	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:23.919023037 CET	80	49681	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:23.919094086 CET	49681	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:23.920208931 CET	80	49684	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:23.920279980 CET	49684	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:23.920363903 CET	49684	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:23.925426006 CET	80	49684	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:24.635401964 CET	80	49684	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:24.636828899 CET	49685	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:24.636878967 CET	443	49685	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:24.636974096 CET	49685	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:24.637289047 CET	49685	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:24.637305021 CET	443	49685	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:24.684954882 CET	49684	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:26.358549118 CET	443	49685	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:26.362179041 CET	49685	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:26.362215996 CET	443	49685	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:26.872733116 CET	443	49685	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:26.872819901 CET	443	49685	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:26.872971058 CET	49685	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:26.873480082 CET	49685	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:26.878642082 CET	49686	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:26.883763075 CET	80	49686	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:26.883883953 CET	49686	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:26.883949995 CET	49686	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:26.888925076 CET	80	49686	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:27.584841967 CET	80	49686	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:27.586425066 CET	49687	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:27.586477995 CET	443	49687	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:27.586553097 CET	49687	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:27.586798906 CET	49687	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:27.586816072 CET	443	49687	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:27.637986898 CET	49686	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:29.341577053 CET	443	49687	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:29.343466997 CET	49687	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:29.343501091 CET	443	49687	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:29.837810993 CET	443	49687	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:29.838009119 CET	443	49687	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:29.838200092 CET	49687	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:29.838432074 CET	49687	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:29.842405081 CET	49686	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:29.843038082 CET	49688	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:29.847580910 CET	80	49686	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:29.847676992 CET	49686	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:29.848083973 CET	80	49688	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:29.848159075 CET	49688	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:29.852895975 CET	49688	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:29.857896090 CET	80	49688	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:30.547513008 CET	80	49688	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:30.549138069 CET	49689	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:30.549200058 CET	443	49689	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:30.549266100 CET	49689	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:30.549563885 CET	49689	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:30.549583912 CET	443	49689	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:30.591093063 CET	49688	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:32.408379078 CET	443	49689	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:32.410092115 CET	49689	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:32.410126925 CET	443	49689	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:32.894138098 CET	443	49689	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:32.894292116 CET	443	49689	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:32.894354105 CET	49689	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:32.894686937 CET	49689	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:32.898143053 CET	49688	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:32.899389029 CET	49690	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:32.903548002 CET	80	49688	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:32.903629065 CET	49688	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:32.904455900 CET	80	49690	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:32.904541969 CET	49690	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:32.904702902 CET	49690	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:32.909694910 CET	80	49690	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:33.600992918 CET	80	49690	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:33.602514982 CET	49691	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:33.602564096 CET	443	49691	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:33.602643967 CET	49691	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:33.602938890 CET	49691	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:33.602950096 CET	443	49691	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:33.653665066 CET	49690	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:33.823992968 CET	80	49690	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:33.824259996 CET	49690	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:35.401189089 CET	443	49691	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:35.402858973 CET	49691	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:35.402904987 CET	443	49691	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:35.936286926 CET	443	49691	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:35.936376095 CET	443	49691	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:35.936435938 CET	49691	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:35.937011003 CET	49691	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:35.940990925 CET	49690	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:35.942193031 CET	49692	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:35.946193933 CET	80	49690	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:35.946252108 CET	49690	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:35.947216034 CET	80	49692	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:35.947334051 CET	49692	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:35.947442055 CET	49692	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:35.952434063 CET	80	49692	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:36.651015997 CET	80	49692	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:36.652467966 CET	49693	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:36.652513981 CET	443	49693	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:36.652677059 CET	49693	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:36.652863026 CET	49693	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:36.652868986 CET	443	49693	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:36.700485945 CET	49692	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:38.441199064 CET	443	49693	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:38.442950964 CET	49693	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:38.442967892 CET	443	49693	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:38.971431017 CET	443	49693	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:38.971591949 CET	443	49693	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:38.971672058 CET	49693	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:38.972078085 CET	49693	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:38.975095034 CET	49692	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:38.976421118 CET	49694	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:38.980372906 CET	80	49692	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:38.980458975 CET	49692	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:38.981484890 CET	80	49694	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:38.981743097 CET	49694	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:38.981743097 CET	49694	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:38.986810923 CET	80	49694	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:39.721858025 CET	80	49694	132.226.247.73	192.168.2.7
Mar 7, 2025 15:54:39.723495960 CET	49695	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:39.723541975 CET	443	49695	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:39.723611116 CET	49695	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:39.723870039 CET	49695	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:39.723885059 CET	443	49695	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:39.763118982 CET	49694	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:41.375828981 CET	443	49695	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:41.377680063 CET	49695	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:41.377703905 CET	443	49695	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:41.923362970 CET	443	49695	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:41.923496962 CET	443	49695	104.21.64.1	192.168.2.7
Mar 7, 2025 15:54:41.923552990 CET	49695	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:41.924333096 CET	49695	443	192.168.2.7	104.21.64.1
Mar 7, 2025 15:54:42.077404022 CET	49694	80	192.168.2.7	132.226.247.73
Mar 7, 2025 15:54:42.077526093 CET	49684	80	192.168.2.7	132.226.247.73

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 7, 2025 15:54:18.006041050 CET	64667	53	192.168.2.7	1.1.1.1
Mar 7, 2025 15:54:18.013703108 CET	53	64667	1.1.1.1	192.168.2.7
Mar 7, 2025 15:54:19.000191927 CET	58098	53	192.168.2.7	1.1.1.1
Mar 7, 2025 15:54:19.007797003 CET	53	58098	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 7, 2025 15:54:18.006041050 CET	192.168.2.7	1.1.1.1	0xd3cb	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Mar 7, 2025 15:54:19.000191927 CET	192.168.2.7	1.1.1.1	0xa059	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 7, 2025 15:54:18.013703108 CET	1.1.1.1	192.168.2.7	0xd3cb	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 7, 2025 15:54:18.013703108 CET	1.1.1.1	192.168.2.7	0xd3cb	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Mar 7, 2025 15:54:18.013703108 CET	1.1.1.1	192.168.2.7	0xd3cb	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Mar 7, 2025 15:54:18.013703108 CET	1.1.1.1	192.168.2.7	0xd3cb	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Mar 7, 2025 15:54:18.013703108 CET	1.1.1.1	192.168.2.7	0xd3cb	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Mar 7, 2025 15:54:18.013703108 CET	1.1.1.1	192.168.2.7	0xd3cb	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Mar 7, 2025 15:54:19.007797003 CET	1.1.1.1	192.168.2.7	0xa059	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 15:54:19.007797003 CET	1.1.1.1	192.168.2.7	0xa059	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 15:54:19.007797003 CET	1.1.1.1	192.168.2.7	0xa059	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 15:54:19.007797003 CET	1.1.1.1	192.168.2.7	0xa059	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 15:54:19.007797003 CET	1.1.1.1	192.168.2.7	0xa059	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 15:54:19.007797003 CET	1.1.1.1	192.168.2.7	0xa059	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Mar 7, 2025 15:54:19.007797003 CET	1.1.1.1	192.168.2.7	0xa059	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49681	132.226.247.73	80	6836	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 15:54:18.028352022 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 7, 2025 15:54:18.727929115 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 14:54:18 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Mar 7, 2025 15:54:18.735768080 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 7, 2025 15:54:18.945441008 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 14:54:18 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Mar 7, 2025 15:54:21.615669966 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 7, 2025 15:54:21.825989008 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 14:54:21 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49684	132.226.247.73	80	6836	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 15:54:23.920363903 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Mar 7, 2025 15:54:24.635401964 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 14:54:24 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49686	132.226.247.73	80	6836	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 15:54:26.883949995 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 7, 2025 15:54:27.584841967 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 14:54:27 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49688	132.226.247.73	80	6836	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 15:54:29.852895975 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 7, 2025 15:54:30.547513008 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 14:54:30 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49690	132.226.247.73	80	6836	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 15:54:32.904702902 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 7, 2025 15:54:33.600992918 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 14:54:33 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Mar 7, 2025 15:54:33.823992968 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 14:54:33 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49692	132.226.247.73	80	6836	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 15:54:35.947442055 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 7, 2025 15:54:36.651015997 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 14:54:36 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49694	132.226.247.73	80	6836	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Mar 7, 2025 15:54:38.981743097 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Mar 7, 2025 15:54:39.721858025 CET	273	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 14:54:39 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49682	104.21.64.1	443	6836	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 14:54:20 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-03-07 14:54:21 UTC	854	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 14:54:21 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 cf-cache-status: MISS last-modified: Fri, 07 Mar 2025 14:54:21 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=76CdfGpaCGPmW%2Bdl2e%2BYPr1UvgUF8gOjgNIPXy1EObWa2t%2BrQvs9NQhkSCQKKLt7qRdjF%2Fuj4GmPp%2F3FteZLJIYE22Svatz%2F%2BfY8VyuR1ul4mLkWx3jOV7IIdpQkKC6UY3j%2BO0Rt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91caed750ab34cff-BOS alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=26082&min_rtt=22380&rtt_var=15797&sent=6&recv=7&lost=0&retrans=1&sent_bytes=4250&recv_bytes=699&delivery_rate=55894&cwnd=251&unsent_bytes=0&cid=994951f70ac0e18a&ts=986&x=0"
2025-03-07 14:54:21 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49683	104.21.64.1	443	6836	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 14:54:23 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2025-03-07 14:54:23 UTC	855	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 14:54:23 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 07 Mar 2025 14:54:21 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NbRKFyNHUm7vw0SoKY7bzNWo8QywdRvZPr4Jrw5%2BgTNBkRVD6hS1ZTOXdXYNl2Y1i3Hcj7tA2GDv%2B%2BHPUvwm8EPtRAwUYdebouWkNGDcWuJ1%2BfiVoRxhBP8Xys0%2BIEb2k3Jh98I7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91caed863e663061-BOS alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=22364&min_rtt=21783&rtt_var=8583&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=132947&cwnd=251&unsent_bytes=0&cid=291fd2b61cc72c15&ts=492&x=0"
2025-03-07 14:54:23 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49685	104.21.64.1	443	6836	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 14:54:26 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-03-07 14:54:26 UTC	851	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 14:54:26 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 5 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 07 Mar 2025 14:54:21 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dOOo03V44AZL7e8KlCCyIve3fGTxTK77cejN9lM9WyKaICv2%2Br9phAMX1Ek44R%2FQl%2BVYA9klPMatRxmkb0HMYDJYFmTcYmMKxffgrfmHsUY7aik08DZGidpYC6rOfVAbHmhIFZYz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91caed9868904cfb-BOS alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=19470&min_rtt=18713&rtt_var=5940&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=154692&cwnd=251&unsent_bytes=0&cid=10c234d50c2d5e33&ts=634&x=0"
2025-03-07 14:54:26 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49687	104.21.64.1	443	6836	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 14:54:29 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-03-07 14:54:29 UTC	851	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 14:54:29 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 8 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 07 Mar 2025 14:54:21 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wgXfltad%2B2UknteOuwYFFaxhcqpT6tKezn9hdw1KjOjcI5yXtmt9aKWZ5py5eMPAd4irNEJnCsvyvwiRvpNO2%2B7igRLov11lXXCerapTF86izRm0gqyYuOGiSaD%2FD55rLCjMBGwt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91caedab1f299068-BOS alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=19309&min_rtt=18448&rtt_var=6681&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=130886&cwnd=233&unsent_bytes=0&cid=4a96482a2545e973&ts=613&x=0"
2025-03-07 14:54:29 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49689	104.21.64.1	443	6836	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 14:54:32 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-03-07 14:54:32 UTC	854	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 14:54:32 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 11 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 07 Mar 2025 14:54:21 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7NgEak85ZREEQI1MDsBnkb8nYSbl%2BIe0n4m4f0U7SJ%2FYhmBG6iEMxXFuB0LA6WGR20bZe54XzIiVk21saCy%2B2AjDTI1OJwcCczPzGbpdF85VVCxpw1jzeb9DcuAMeHeeiR8FN6%2B9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91caedbe49514cd5-BOS alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=17884&min_rtt=14256&rtt_var=7938&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=203142&cwnd=250&unsent_bytes=0&cid=59666b41b780b87e&ts=627&x=0"
2025-03-07 14:54:32 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49691	104.21.64.1	443	6836	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 14:54:35 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-03-07 14:54:35 UTC	858	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 14:54:35 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 14 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 07 Mar 2025 14:54:21 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FG5OLD5LRu4ISrU4drrDkFa9zzTs5vKzriX9Waf%2BVFqaEo38C6lR0I1jvnWli6mi3eKujeIKSK8OsvrRtqA%2F%2BXFjXeipmPaOlnXZnNmNgRfw8EbQlCrwM1sCyMnT%2Bie4Axw%2BcZfq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91caedd14f903b82-BOS alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18134&min_rtt=18036&rtt_var=6960&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=153862&cwnd=250&unsent_bytes=0&cid=2a2215bfa3b8b5aa&ts=536&x=0"
2025-03-07 14:54:35 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49693	104.21.64.1	443	6836	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 14:54:38 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-03-07 14:54:38 UTC	859	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 14:54:38 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cf-Ray: 91caede40c364cd5-BOS Server: cloudflare Age: 17 Cache-Control: max-age=31536000 Cf-Cache-Status: HIT Last-Modified: Fri, 07 Mar 2025 14:54:21 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2r8GdFWTUZqd%2FkzkGKsFRTLuCrX6zO4Qa%2FlcbCwRqMV2pd%2BOLEKPd%2FhuToCqeGI4SNKlra4Wbr9Z93mO8si4qD%2B0YSwcxLxZva3wIUrGRyow6AAXXZ%2FV92eruYeEmlqkf%2B4q2GGD"}],"group":"cf-nel","max_age":604800} Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=23750&min_rtt=22084&rtt_var=9099&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=99184&cwnd=250&unsent_bytes=0&cid=613f6005a80dc96e&ts=659&x=0"
2025-03-07 14:54:38 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49695	104.21.64.1	443	6836	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 14:54:41 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-03-07 14:54:41 UTC	854	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 14:54:41 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 20 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 07 Mar 2025 14:54:21 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ctVQM6tHK4yc4qrI6eCXZnNCozIa2gb9ia5M2Vmawp8z1w%2Bfac9DXKCaSPqwOMnOGW3GGcZFvA8Z5a3CdzrHa1W5h4m0LY8ogz8w33cJ0%2FWBer%2BDv0Lt%2Fc23JRviRuWFRlPKn6Ix"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 91caedf668668fb8-BOS alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=21990&min_rtt=20845&rtt_var=6888&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=138863&cwnd=248&unsent_bytes=0&cid=bc42f697b5e7088e&ts=493&x=0"
2025-03-07 14:54:41 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	0
Start time:	09:54:14
Start date:	07/03/2025
Path:	C:\Users\user\Desktop\HT4YGXBRtx.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HT4YGXBRtx.exe"
Imagebase:	0xf40000
File size:	972'800 bytes
MD5 hash:	6C22541A5EAD0CA30EE07FEE745D5EDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook, Description: Detects executables with potential process hoocking, Source: 00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.913319880.0000000000A50000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:54:16
Start date:	07/03/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HT4YGXBRtx.exe"
Imagebase:	0xec0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1154885264.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000001.00000002.1154885264.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000001.00000002.1154885264.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000001.00000002.1154885264.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000001.00000002.1156067017.00000000031B2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000001.00000002.1156067017.0000000003001000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:54:41
Start date:	07/03/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x460000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:54:41
Start date:	07/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff642da0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:54:41
Start date:	07/03/2025
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /C Y /N /D Y /T 3
Imagebase:	0x750000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report HT4YGXBRtx.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

C:\Users\user\AppData\Local\Temp\autF758.tmp

C:\Users\user\AppData\Local\Temp\autFAC4.tmp

C:\Users\user\AppData\Local\Temp\oxmanship

C:\Users\user\AppData\Local\Temp\ultraradicalism

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
HT4YGXBRtx.exe