Edit tour

Windows Analysis Report
2vt65gnmAr.exe

Overview

General Information

Sample name:	2vt65gnmAr.exe renamed because original name is a hash value
Original sample name:	dfd5f2dabc9e48eaf333b76da901ffa387e0753fd00353b8b03f976f36d3e00a.exe
Analysis ID:	1649061
MD5:	a79189ec6015e24cb01ae28574e355b3
SHA1:	fa795dff6bcf25e8dc707829c19f2fe6377055fb
SHA256:	dfd5f2dabc9e48eaf333b76da901ffa387e0753fd00353b8b03f976f36d3e00a
Tags:	exeuser-zhuzhu0009
Infos:

Detection

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Changes autostart functionality of drives

Changes the view of files in windows explorer (hidden files and folders)

Contains functionality to detect sleep reduction / modifications

Creates an autostart registry key pointing to binary in C:\Windows

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Deletes keys related to Windows Defender

Deletes keys which are related to windows safe boot (disables safe mode boot)

Disable UAC(promptonsecuredesktop)

Disables UAC (registry)

Disables Windows Defender (deletes autostart)

Disables the Windows registry editor (regedit)

Disables user account control notifications

Joe Sandbox ML detected suspicious sample

Queries Google from non browser process on port 80

Queries random domain names (often used to prevent blacklisting and sinkholes)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Connects to many different domains

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Executes massive DNS lookups (> 100)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (may stop execution after checking a module file name)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Tries to resolve many domain names, but no domain seems valid

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

2vt65gnmAr.exe (PID: 7260 cmdline: "C:\Users\user\Desktop\2vt65gnmAr.exe" MD5: A79189EC6015E24CB01AE28574E355B3)

jpzchl.exe (PID: 7340 cmdline: "C:\Users\user\AppData\Local\Temp\jpzchl.exe" "-" MD5: 59132A32244B2FEDB6B02A3C7EEE41E2)

jpzchl.exe (PID: 7356 cmdline: "C:\Users\user\AppData\Local\Temp\jpzchl.exe" "-" MD5: 59132A32244B2FEDB6B02A3C7EEE41E2)

rundll32.exe (PID: 7444 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\ytskexxtqfdsupjbwrqic.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\2vt65gnmAr.exe, ProcessId: 7260, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ydmos

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: ldzofvslfrmyxpgvnf.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\2vt65gnmAr.exe, ProcessId: 7260, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wdosydp

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: wpmculjdylhuunfvohe.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\2vt65gnmAr.exe, ProcessId: 7260, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ydmos

Suricata Signatures

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-26T13:43:58.418123+0100	2018141	1	A Network Trojan was detected	13.213.51.196	80	192.168.2.4	49747	TCP

ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-26T13:43:58.418123+0100	2037771	1	A Network Trojan was detected	13.213.51.196	80	192.168.2.4	49747	TCP

ET MALWARE Win32/Pykspa.C Public IP Check

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-26T13:43:29.435875+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49717	104.21.74.56	80	TCP
2025-03-26T13:43:30.706145+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49718	104.21.74.56	80	TCP
2025-03-26T13:43:32.801399+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49719	104.21.74.56	80	TCP
2025-03-26T13:43:36.411030+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49727	172.66.40.87	80	TCP
2025-03-26T13:43:37.732290+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49728	172.66.40.87	80	TCP
2025-03-26T13:43:44.410673+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49734	172.66.40.87	80	TCP
2025-03-26T13:43:45.807791+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49735	104.19.222.79	80	TCP
2025-03-26T13:43:48.221980+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49737	104.19.222.79	80	TCP
2025-03-26T13:43:54.747081+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49744	104.21.74.56	80	TCP
2025-03-26T13:43:55.991615+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49746	104.21.74.56	80	TCP
2025-03-26T13:43:58.383648+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49749	172.66.40.87	80	TCP
2025-03-26T13:44:00.915456+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49751	104.21.74.56	80	TCP
2025-03-26T13:44:05.175528+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49752	104.21.74.56	80	TCP
2025-03-26T13:44:06.436464+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49754	172.66.40.87	80	TCP
2025-03-26T13:44:07.682303+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49755	104.21.74.56	80	TCP
2025-03-26T13:44:10.210292+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49757	172.66.40.87	80	TCP
2025-03-26T13:44:11.494262+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49758	172.66.40.87	80	TCP
2025-03-26T13:44:12.738437+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49759	172.66.40.87	80	TCP
2025-03-26T13:44:13.984957+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49760	172.66.40.87	80	TCP
2025-03-26T13:44:15.224275+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49762	104.21.74.56	80	TCP
2025-03-26T13:44:18.209138+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49764	172.66.40.87	80	TCP
2025-03-26T13:44:20.690657+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49766	104.21.74.56	80	TCP
2025-03-26T13:44:21.962435+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49767	172.66.40.87	80	TCP
2025-03-26T13:44:26.794283+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49771	172.66.40.87	80	TCP
2025-03-26T13:44:28.065009+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49772	104.19.222.79	80	TCP
2025-03-26T13:44:29.361700+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49773	172.66.40.87	80	TCP
2025-03-26T13:44:31.890900+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49775	104.19.222.79	80	TCP
2025-03-26T13:44:33.158123+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49776	104.21.74.56	80	TCP
2025-03-26T13:44:35.491456+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49778	104.19.222.79	80	TCP
2025-03-26T13:44:37.857043+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49780	104.19.222.79	80	TCP
2025-03-26T13:44:39.200226+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49781	104.21.74.56	80	TCP
2025-03-26T13:44:40.598805+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49782	104.21.74.56	80	TCP
2025-03-26T13:44:43.008529+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49784	172.66.40.87	80	TCP
2025-03-26T13:44:47.504859+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49788	172.66.40.87	80	TCP
2025-03-26T13:44:50.278088+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49791	172.66.40.87	80	TCP
2025-03-26T13:44:51.575521+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49792	104.19.222.79	80	TCP
2025-03-26T13:44:55.186683+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49795	104.19.222.79	80	TCP
2025-03-26T13:44:59.816429+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49799	172.66.40.87	80	TCP
2025-03-26T13:45:02.230286+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49801	104.19.222.79	80	TCP
2025-03-26T13:45:03.452139+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49802	104.21.74.56	80	TCP
2025-03-26T13:45:04.771601+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49803	104.19.222.79	80	TCP
2025-03-26T13:45:07.190463+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49805	172.66.40.87	80	TCP
2025-03-26T13:45:08.422906+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49806	104.21.74.56	80	TCP
2025-03-26T13:45:10.682859+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49808	104.21.74.56	80	TCP
2025-03-26T13:45:15.927537+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49813	104.21.74.56	80	TCP
2025-03-26T13:45:18.412506+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49815	104.19.222.79	80	TCP
2025-03-26T13:45:19.742499+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49816	104.19.222.79	80	TCP
2025-03-26T13:45:26.849667+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49824	104.21.74.56	80	TCP
2025-03-26T13:45:28.091767+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49825	104.19.222.79	80	TCP
2025-03-26T13:45:29.345618+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49827	104.21.74.56	80	TCP
2025-03-26T13:45:30.580946+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49828	172.66.40.87	80	TCP
2025-03-26T13:45:31.860361+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49830	104.19.222.79	80	TCP
2025-03-26T13:45:33.107739+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49832	104.19.222.79	80	TCP
2025-03-26T13:45:35.508330+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49834	172.66.40.87	80	TCP
2025-03-26T13:45:38.834451+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49837	172.66.40.87	80	TCP
2025-03-26T13:45:40.078452+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49838	104.21.74.56	80	TCP
2025-03-26T13:45:41.768266+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49840	104.21.74.56	80	TCP
2025-03-26T13:45:44.302219+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49842	104.21.74.56	80	TCP
2025-03-26T13:45:45.565642+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49843	104.21.74.56	80	TCP
2025-03-26T13:45:47.987291+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49845	172.66.40.87	80	TCP
2025-03-26T13:45:49.237135+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49846	104.21.74.56	80	TCP
2025-03-26T13:45:52.791515+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49849	172.66.40.87	80	TCP
2025-03-26T13:45:58.478449+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49854	104.19.222.79	80	TCP
2025-03-26T13:46:01.923265+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49857	172.66.40.87	80	TCP
2025-03-26T13:46:05.436115+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49860	104.21.74.56	80	TCP
2025-03-26T13:46:08.333784+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49863	104.21.74.56	80	TCP
2025-03-26T13:46:09.563579+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49864	104.19.222.79	80	TCP
2025-03-26T13:46:10.786643+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49865	104.19.222.79	80	TCP
2025-03-26T13:46:13.302713+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49867	104.21.74.56	80	TCP
2025-03-26T13:46:14.536480+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49868	104.21.74.56	80	TCP
2025-03-26T13:46:17.921672+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49871	104.19.222.79	80	TCP
2025-03-26T13:46:19.152269+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49872	172.66.40.87	80	TCP
2025-03-26T13:46:20.725220+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49873	104.19.222.79	80	TCP
2025-03-26T13:46:21.954665+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49874	104.21.74.56	80	TCP
2025-03-26T13:46:23.190107+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49875	172.66.40.87	80	TCP
2025-03-26T13:46:25.674847+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49877	104.19.222.79	80	TCP
2025-03-26T13:46:26.940225+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49878	172.66.40.87	80	TCP
2025-03-26T13:46:29.355713+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49880	172.66.40.87	80	TCP
2025-03-26T13:46:31.737094+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49882	104.21.74.56	80	TCP
2025-03-26T13:46:34.560899+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49885	104.19.222.79	80	TCP
2025-03-26T13:46:35.823578+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49886	104.19.222.79	80	TCP
2025-03-26T13:46:37.048215+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49887	104.19.222.79	80	TCP
2025-03-26T13:46:39.517678+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49889	172.66.40.87	80	TCP
2025-03-26T13:46:40.808448+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49890	104.21.74.56	80	TCP
2025-03-26T13:46:44.455309+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49893	104.21.74.56	80	TCP
2025-03-26T13:46:46.813627+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49894	104.21.74.56	80	TCP
2025-03-26T13:46:51.636617+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49898	104.19.222.79	80	TCP
2025-03-26T13:46:52.954610+0100	2018773	1	A Network Trojan was detected	192.168.2.4	49899	104.19.222.79	80	TCP

ETPRO MALWARE Common Downloader Header Pattern General HAUC

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-26T13:43:29.435875+0100	2803307	3	Unknown Traffic	192.168.2.4	49717	104.21.74.56	80	TCP
2025-03-26T13:43:30.706145+0100	2803307	3	Unknown Traffic	192.168.2.4	49718	104.21.74.56	80	TCP
2025-03-26T13:43:32.801399+0100	2803307	3	Unknown Traffic	192.168.2.4	49719	104.21.74.56	80	TCP
2025-03-26T13:43:36.411030+0100	2803307	3	Unknown Traffic	192.168.2.4	49727	172.66.40.87	80	TCP
2025-03-26T13:43:37.732290+0100	2803307	3	Unknown Traffic	192.168.2.4	49728	172.66.40.87	80	TCP
2025-03-26T13:43:44.410673+0100	2803307	3	Unknown Traffic	192.168.2.4	49734	172.66.40.87	80	TCP
2025-03-26T13:43:45.807791+0100	2803307	3	Unknown Traffic	192.168.2.4	49735	104.19.222.79	80	TCP
2025-03-26T13:43:48.221980+0100	2803307	3	Unknown Traffic	192.168.2.4	49737	104.19.222.79	80	TCP
2025-03-26T13:43:52.729008+0100	2803307	3	Unknown Traffic	192.168.2.4	49741	142.250.65.164	80	TCP
2025-03-26T13:43:53.368136+0100	2803307	3	Unknown Traffic	192.168.2.4	49742	34.111.176.156	80	TCP
2025-03-26T13:43:54.747081+0100	2803307	3	Unknown Traffic	192.168.2.4	49744	104.21.74.56	80	TCP
2025-03-26T13:43:55.886535+0100	2803307	3	Unknown Traffic	192.168.2.4	49745	85.214.228.140	80	TCP
2025-03-26T13:43:55.991615+0100	2803307	3	Unknown Traffic	192.168.2.4	49746	104.21.74.56	80	TCP
2025-03-26T13:43:57.857675+0100	2803307	3	Unknown Traffic	192.168.2.4	49747	13.213.51.196	80	TCP
2025-03-26T13:43:58.383648+0100	2803307	3	Unknown Traffic	192.168.2.4	49749	172.66.40.87	80	TCP
2025-03-26T13:44:00.915456+0100	2803307	3	Unknown Traffic	192.168.2.4	49751	104.21.74.56	80	TCP
2025-03-26T13:44:05.175528+0100	2803307	3	Unknown Traffic	192.168.2.4	49752	104.21.74.56	80	TCP
2025-03-26T13:44:05.800083+0100	2803307	3	Unknown Traffic	192.168.2.4	49753	104.156.155.94	80	TCP
2025-03-26T13:44:06.436464+0100	2803307	3	Unknown Traffic	192.168.2.4	49754	172.66.40.87	80	TCP
2025-03-26T13:44:07.682303+0100	2803307	3	Unknown Traffic	192.168.2.4	49755	104.21.74.56	80	TCP
2025-03-26T13:44:10.210292+0100	2803307	3	Unknown Traffic	192.168.2.4	49757	172.66.40.87	80	TCP
2025-03-26T13:44:11.494262+0100	2803307	3	Unknown Traffic	192.168.2.4	49758	172.66.40.87	80	TCP
2025-03-26T13:44:12.738437+0100	2803307	3	Unknown Traffic	192.168.2.4	49759	172.66.40.87	80	TCP
2025-03-26T13:44:13.984957+0100	2803307	3	Unknown Traffic	192.168.2.4	49760	172.66.40.87	80	TCP
2025-03-26T13:44:15.224275+0100	2803307	3	Unknown Traffic	192.168.2.4	49762	104.21.74.56	80	TCP
2025-03-26T13:44:18.209138+0100	2803307	3	Unknown Traffic	192.168.2.4	49764	172.66.40.87	80	TCP
2025-03-26T13:44:20.690657+0100	2803307	3	Unknown Traffic	192.168.2.4	49766	104.21.74.56	80	TCP
2025-03-26T13:44:21.962435+0100	2803307	3	Unknown Traffic	192.168.2.4	49767	172.66.40.87	80	TCP
2025-03-26T13:44:23.743258+0100	2803307	3	Unknown Traffic	192.168.2.4	49768	151.101.0.81	80	TCP
2025-03-26T13:44:26.794283+0100	2803307	3	Unknown Traffic	192.168.2.4	49771	172.66.40.87	80	TCP
2025-03-26T13:44:28.065009+0100	2803307	3	Unknown Traffic	192.168.2.4	49772	104.19.222.79	80	TCP
2025-03-26T13:44:29.361700+0100	2803307	3	Unknown Traffic	192.168.2.4	49773	172.66.40.87	80	TCP
2025-03-26T13:44:31.890900+0100	2803307	3	Unknown Traffic	192.168.2.4	49775	104.19.222.79	80	TCP
2025-03-26T13:44:33.158123+0100	2803307	3	Unknown Traffic	192.168.2.4	49776	104.21.74.56	80	TCP
2025-03-26T13:44:35.491456+0100	2803307	3	Unknown Traffic	192.168.2.4	49778	104.19.222.79	80	TCP
2025-03-26T13:44:37.857043+0100	2803307	3	Unknown Traffic	192.168.2.4	49780	104.19.222.79	80	TCP
2025-03-26T13:44:39.200226+0100	2803307	3	Unknown Traffic	192.168.2.4	49781	104.21.74.56	80	TCP
2025-03-26T13:44:40.598805+0100	2803307	3	Unknown Traffic	192.168.2.4	49782	104.21.74.56	80	TCP
2025-03-26T13:44:43.008529+0100	2803307	3	Unknown Traffic	192.168.2.4	49784	172.66.40.87	80	TCP
2025-03-26T13:44:47.504859+0100	2803307	3	Unknown Traffic	192.168.2.4	49788	172.66.40.87	80	TCP
2025-03-26T13:44:50.059686+0100	2803307	3	Unknown Traffic	192.168.2.4	49790	69.147.82.60	80	TCP
2025-03-26T13:44:50.278088+0100	2803307	3	Unknown Traffic	192.168.2.4	49791	172.66.40.87	80	TCP
2025-03-26T13:44:51.575521+0100	2803307	3	Unknown Traffic	192.168.2.4	49792	104.19.222.79	80	TCP
2025-03-26T13:44:55.186683+0100	2803307	3	Unknown Traffic	192.168.2.4	49795	104.19.222.79	80	TCP
2025-03-26T13:44:59.816429+0100	2803307	3	Unknown Traffic	192.168.2.4	49799	172.66.40.87	80	TCP
2025-03-26T13:45:02.230286+0100	2803307	3	Unknown Traffic	192.168.2.4	49801	104.19.222.79	80	TCP
2025-03-26T13:45:03.452139+0100	2803307	3	Unknown Traffic	192.168.2.4	49802	104.21.74.56	80	TCP
2025-03-26T13:45:04.771601+0100	2803307	3	Unknown Traffic	192.168.2.4	49803	104.19.222.79	80	TCP
2025-03-26T13:45:07.190463+0100	2803307	3	Unknown Traffic	192.168.2.4	49805	172.66.40.87	80	TCP
2025-03-26T13:45:08.422906+0100	2803307	3	Unknown Traffic	192.168.2.4	49806	104.21.74.56	80	TCP
2025-03-26T13:45:10.682859+0100	2803307	3	Unknown Traffic	192.168.2.4	49808	104.21.74.56	80	TCP
2025-03-26T13:45:15.683264+0100	2803307	3	Unknown Traffic	192.168.2.4	49812	142.251.32.105	80	TCP
2025-03-26T13:45:15.927537+0100	2803307	3	Unknown Traffic	192.168.2.4	49813	104.21.74.56	80	TCP
2025-03-26T13:45:18.412506+0100	2803307	3	Unknown Traffic	192.168.2.4	49815	104.19.222.79	80	TCP
2025-03-26T13:45:19.742499+0100	2803307	3	Unknown Traffic	192.168.2.4	49816	104.19.222.79	80	TCP
2025-03-26T13:45:26.849667+0100	2803307	3	Unknown Traffic	192.168.2.4	49824	104.21.74.56	80	TCP
2025-03-26T13:45:28.091767+0100	2803307	3	Unknown Traffic	192.168.2.4	49825	104.19.222.79	80	TCP
2025-03-26T13:45:29.345618+0100	2803307	3	Unknown Traffic	192.168.2.4	49827	104.21.74.56	80	TCP
2025-03-26T13:45:30.580946+0100	2803307	3	Unknown Traffic	192.168.2.4	49828	172.66.40.87	80	TCP
2025-03-26T13:45:31.860361+0100	2803307	3	Unknown Traffic	192.168.2.4	49830	104.19.222.79	80	TCP
2025-03-26T13:45:33.107739+0100	2803307	3	Unknown Traffic	192.168.2.4	49832	104.19.222.79	80	TCP
2025-03-26T13:45:35.508330+0100	2803307	3	Unknown Traffic	192.168.2.4	49834	172.66.40.87	80	TCP
2025-03-26T13:45:38.834451+0100	2803307	3	Unknown Traffic	192.168.2.4	49837	172.66.40.87	80	TCP
2025-03-26T13:45:40.078452+0100	2803307	3	Unknown Traffic	192.168.2.4	49838	104.21.74.56	80	TCP
2025-03-26T13:45:41.545360+0100	2803307	3	Unknown Traffic	192.168.2.4	49839	34.111.176.156	80	TCP
2025-03-26T13:45:41.768266+0100	2803307	3	Unknown Traffic	192.168.2.4	49840	104.21.74.56	80	TCP
2025-03-26T13:45:44.302219+0100	2803307	3	Unknown Traffic	192.168.2.4	49842	104.21.74.56	80	TCP
2025-03-26T13:45:45.565642+0100	2803307	3	Unknown Traffic	192.168.2.4	49843	104.21.74.56	80	TCP
2025-03-26T13:45:47.987291+0100	2803307	3	Unknown Traffic	192.168.2.4	49845	172.66.40.87	80	TCP
2025-03-26T13:45:49.237135+0100	2803307	3	Unknown Traffic	192.168.2.4	49846	104.21.74.56	80	TCP
2025-03-26T13:45:52.791515+0100	2803307	3	Unknown Traffic	192.168.2.4	49849	172.66.40.87	80	TCP
2025-03-26T13:45:58.478449+0100	2803307	3	Unknown Traffic	192.168.2.4	49854	104.19.222.79	80	TCP
2025-03-26T13:46:01.923265+0100	2803307	3	Unknown Traffic	192.168.2.4	49857	172.66.40.87	80	TCP
2025-03-26T13:46:05.436115+0100	2803307	3	Unknown Traffic	192.168.2.4	49860	104.21.74.56	80	TCP
2025-03-26T13:46:07.095221+0100	2803307	3	Unknown Traffic	192.168.2.4	49861	69.147.82.60	80	TCP
2025-03-26T13:46:08.333784+0100	2803307	3	Unknown Traffic	192.168.2.4	49863	104.21.74.56	80	TCP
2025-03-26T13:46:09.563579+0100	2803307	3	Unknown Traffic	192.168.2.4	49864	104.19.222.79	80	TCP
2025-03-26T13:46:10.786643+0100	2803307	3	Unknown Traffic	192.168.2.4	49865	104.19.222.79	80	TCP
2025-03-26T13:46:13.302713+0100	2803307	3	Unknown Traffic	192.168.2.4	49867	104.21.74.56	80	TCP
2025-03-26T13:46:14.536480+0100	2803307	3	Unknown Traffic	192.168.2.4	49868	104.21.74.56	80	TCP
2025-03-26T13:46:17.921672+0100	2803307	3	Unknown Traffic	192.168.2.4	49871	104.19.222.79	80	TCP
2025-03-26T13:46:19.152269+0100	2803307	3	Unknown Traffic	192.168.2.4	49872	172.66.40.87	80	TCP
2025-03-26T13:46:20.725220+0100	2803307	3	Unknown Traffic	192.168.2.4	49873	104.19.222.79	80	TCP
2025-03-26T13:46:21.954665+0100	2803307	3	Unknown Traffic	192.168.2.4	49874	104.21.74.56	80	TCP
2025-03-26T13:46:23.190107+0100	2803307	3	Unknown Traffic	192.168.2.4	49875	172.66.40.87	80	TCP
2025-03-26T13:46:25.674847+0100	2803307	3	Unknown Traffic	192.168.2.4	49877	104.19.222.79	80	TCP
2025-03-26T13:46:26.940225+0100	2803307	3	Unknown Traffic	192.168.2.4	49878	172.66.40.87	80	TCP
2025-03-26T13:46:29.355713+0100	2803307	3	Unknown Traffic	192.168.2.4	49880	172.66.40.87	80	TCP
2025-03-26T13:46:31.737094+0100	2803307	3	Unknown Traffic	192.168.2.4	49882	104.21.74.56	80	TCP
2025-03-26T13:46:33.186684+0100	2803307	3	Unknown Traffic	192.168.2.4	49883	13.35.98.164	80	TCP
2025-03-26T13:46:34.560899+0100	2803307	3	Unknown Traffic	192.168.2.4	49885	104.19.222.79	80	TCP
2025-03-26T13:46:35.823578+0100	2803307	3	Unknown Traffic	192.168.2.4	49886	104.19.222.79	80	TCP
2025-03-26T13:46:37.048215+0100	2803307	3	Unknown Traffic	192.168.2.4	49887	104.19.222.79	80	TCP
2025-03-26T13:46:39.517678+0100	2803307	3	Unknown Traffic	192.168.2.4	49889	172.66.40.87	80	TCP
2025-03-26T13:46:40.808448+0100	2803307	3	Unknown Traffic	192.168.2.4	49890	104.21.74.56	80	TCP
2025-03-26T13:46:44.455309+0100	2803307	3	Unknown Traffic	192.168.2.4	49893	104.21.74.56	80	TCP
2025-03-26T13:46:46.813627+0100	2803307	3	Unknown Traffic	192.168.2.4	49894	104.21.74.56	80	TCP
2025-03-26T13:46:51.636617+0100	2803307	3	Unknown Traffic	192.168.2.4	49898	104.19.222.79	80	TCP
2025-03-26T13:46:52.954610+0100	2803307	3	Unknown Traffic	192.168.2.4	49899	104.19.222.79	80	TCP

ETPRO MALWARE Common Downloader Header Pattern Specific Mozilla 5 HAUC

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-26T13:43:29.435875+0100	2803306	3	Unknown Traffic	192.168.2.4	49717	104.21.74.56	80	TCP
2025-03-26T13:43:30.706145+0100	2803306	3	Unknown Traffic	192.168.2.4	49718	104.21.74.56	80	TCP
2025-03-26T13:43:32.801399+0100	2803306	3	Unknown Traffic	192.168.2.4	49719	104.21.74.56	80	TCP
2025-03-26T13:43:36.411030+0100	2803306	3	Unknown Traffic	192.168.2.4	49727	172.66.40.87	80	TCP
2025-03-26T13:43:37.732290+0100	2803306	3	Unknown Traffic	192.168.2.4	49728	172.66.40.87	80	TCP
2025-03-26T13:43:44.410673+0100	2803306	3	Unknown Traffic	192.168.2.4	49734	172.66.40.87	80	TCP
2025-03-26T13:43:45.807791+0100	2803306	3	Unknown Traffic	192.168.2.4	49735	104.19.222.79	80	TCP
2025-03-26T13:43:48.221980+0100	2803306	3	Unknown Traffic	192.168.2.4	49737	104.19.222.79	80	TCP
2025-03-26T13:43:52.729008+0100	2803306	3	Unknown Traffic	192.168.2.4	49741	142.250.65.164	80	TCP
2025-03-26T13:43:53.368136+0100	2803306	3	Unknown Traffic	192.168.2.4	49742	34.111.176.156	80	TCP
2025-03-26T13:43:54.747081+0100	2803306	3	Unknown Traffic	192.168.2.4	49744	104.21.74.56	80	TCP
2025-03-26T13:43:55.886535+0100	2803306	3	Unknown Traffic	192.168.2.4	49745	85.214.228.140	80	TCP
2025-03-26T13:43:55.991615+0100	2803306	3	Unknown Traffic	192.168.2.4	49746	104.21.74.56	80	TCP
2025-03-26T13:43:57.857675+0100	2803306	3	Unknown Traffic	192.168.2.4	49747	13.213.51.196	80	TCP
2025-03-26T13:43:58.383648+0100	2803306	3	Unknown Traffic	192.168.2.4	49749	172.66.40.87	80	TCP
2025-03-26T13:44:00.915456+0100	2803306	3	Unknown Traffic	192.168.2.4	49751	104.21.74.56	80	TCP
2025-03-26T13:44:05.175528+0100	2803306	3	Unknown Traffic	192.168.2.4	49752	104.21.74.56	80	TCP
2025-03-26T13:44:05.800083+0100	2803306	3	Unknown Traffic	192.168.2.4	49753	104.156.155.94	80	TCP
2025-03-26T13:44:06.436464+0100	2803306	3	Unknown Traffic	192.168.2.4	49754	172.66.40.87	80	TCP
2025-03-26T13:44:07.682303+0100	2803306	3	Unknown Traffic	192.168.2.4	49755	104.21.74.56	80	TCP
2025-03-26T13:44:10.210292+0100	2803306	3	Unknown Traffic	192.168.2.4	49757	172.66.40.87	80	TCP
2025-03-26T13:44:11.494262+0100	2803306	3	Unknown Traffic	192.168.2.4	49758	172.66.40.87	80	TCP
2025-03-26T13:44:12.738437+0100	2803306	3	Unknown Traffic	192.168.2.4	49759	172.66.40.87	80	TCP
2025-03-26T13:44:13.984957+0100	2803306	3	Unknown Traffic	192.168.2.4	49760	172.66.40.87	80	TCP
2025-03-26T13:44:15.224275+0100	2803306	3	Unknown Traffic	192.168.2.4	49762	104.21.74.56	80	TCP
2025-03-26T13:44:18.209138+0100	2803306	3	Unknown Traffic	192.168.2.4	49764	172.66.40.87	80	TCP
2025-03-26T13:44:20.690657+0100	2803306	3	Unknown Traffic	192.168.2.4	49766	104.21.74.56	80	TCP
2025-03-26T13:44:21.962435+0100	2803306	3	Unknown Traffic	192.168.2.4	49767	172.66.40.87	80	TCP
2025-03-26T13:44:23.743258+0100	2803306	3	Unknown Traffic	192.168.2.4	49768	151.101.0.81	80	TCP
2025-03-26T13:44:26.794283+0100	2803306	3	Unknown Traffic	192.168.2.4	49771	172.66.40.87	80	TCP
2025-03-26T13:44:28.065009+0100	2803306	3	Unknown Traffic	192.168.2.4	49772	104.19.222.79	80	TCP
2025-03-26T13:44:29.361700+0100	2803306	3	Unknown Traffic	192.168.2.4	49773	172.66.40.87	80	TCP
2025-03-26T13:44:31.890900+0100	2803306	3	Unknown Traffic	192.168.2.4	49775	104.19.222.79	80	TCP
2025-03-26T13:44:33.158123+0100	2803306	3	Unknown Traffic	192.168.2.4	49776	104.21.74.56	80	TCP
2025-03-26T13:44:35.491456+0100	2803306	3	Unknown Traffic	192.168.2.4	49778	104.19.222.79	80	TCP
2025-03-26T13:44:37.857043+0100	2803306	3	Unknown Traffic	192.168.2.4	49780	104.19.222.79	80	TCP
2025-03-26T13:44:39.200226+0100	2803306	3	Unknown Traffic	192.168.2.4	49781	104.21.74.56	80	TCP
2025-03-26T13:44:40.598805+0100	2803306	3	Unknown Traffic	192.168.2.4	49782	104.21.74.56	80	TCP
2025-03-26T13:44:43.008529+0100	2803306	3	Unknown Traffic	192.168.2.4	49784	172.66.40.87	80	TCP
2025-03-26T13:44:47.504859+0100	2803306	3	Unknown Traffic	192.168.2.4	49788	172.66.40.87	80	TCP
2025-03-26T13:44:50.059686+0100	2803306	3	Unknown Traffic	192.168.2.4	49790	69.147.82.60	80	TCP
2025-03-26T13:44:50.278088+0100	2803306	3	Unknown Traffic	192.168.2.4	49791	172.66.40.87	80	TCP
2025-03-26T13:44:51.575521+0100	2803306	3	Unknown Traffic	192.168.2.4	49792	104.19.222.79	80	TCP
2025-03-26T13:44:55.186683+0100	2803306	3	Unknown Traffic	192.168.2.4	49795	104.19.222.79	80	TCP
2025-03-26T13:44:59.816429+0100	2803306	3	Unknown Traffic	192.168.2.4	49799	172.66.40.87	80	TCP
2025-03-26T13:45:02.230286+0100	2803306	3	Unknown Traffic	192.168.2.4	49801	104.19.222.79	80	TCP
2025-03-26T13:45:03.452139+0100	2803306	3	Unknown Traffic	192.168.2.4	49802	104.21.74.56	80	TCP
2025-03-26T13:45:04.771601+0100	2803306	3	Unknown Traffic	192.168.2.4	49803	104.19.222.79	80	TCP
2025-03-26T13:45:07.190463+0100	2803306	3	Unknown Traffic	192.168.2.4	49805	172.66.40.87	80	TCP
2025-03-26T13:45:08.422906+0100	2803306	3	Unknown Traffic	192.168.2.4	49806	104.21.74.56	80	TCP
2025-03-26T13:45:10.682859+0100	2803306	3	Unknown Traffic	192.168.2.4	49808	104.21.74.56	80	TCP
2025-03-26T13:45:15.683264+0100	2803306	3	Unknown Traffic	192.168.2.4	49812	142.251.32.105	80	TCP
2025-03-26T13:45:15.927537+0100	2803306	3	Unknown Traffic	192.168.2.4	49813	104.21.74.56	80	TCP
2025-03-26T13:45:18.412506+0100	2803306	3	Unknown Traffic	192.168.2.4	49815	104.19.222.79	80	TCP
2025-03-26T13:45:19.742499+0100	2803306	3	Unknown Traffic	192.168.2.4	49816	104.19.222.79	80	TCP
2025-03-26T13:45:26.849667+0100	2803306	3	Unknown Traffic	192.168.2.4	49824	104.21.74.56	80	TCP
2025-03-26T13:45:28.091767+0100	2803306	3	Unknown Traffic	192.168.2.4	49825	104.19.222.79	80	TCP
2025-03-26T13:45:29.345618+0100	2803306	3	Unknown Traffic	192.168.2.4	49827	104.21.74.56	80	TCP
2025-03-26T13:45:30.580946+0100	2803306	3	Unknown Traffic	192.168.2.4	49828	172.66.40.87	80	TCP
2025-03-26T13:45:31.860361+0100	2803306	3	Unknown Traffic	192.168.2.4	49830	104.19.222.79	80	TCP
2025-03-26T13:45:33.107739+0100	2803306	3	Unknown Traffic	192.168.2.4	49832	104.19.222.79	80	TCP
2025-03-26T13:45:35.508330+0100	2803306	3	Unknown Traffic	192.168.2.4	49834	172.66.40.87	80	TCP
2025-03-26T13:45:38.834451+0100	2803306	3	Unknown Traffic	192.168.2.4	49837	172.66.40.87	80	TCP
2025-03-26T13:45:40.078452+0100	2803306	3	Unknown Traffic	192.168.2.4	49838	104.21.74.56	80	TCP
2025-03-26T13:45:41.545360+0100	2803306	3	Unknown Traffic	192.168.2.4	49839	34.111.176.156	80	TCP
2025-03-26T13:45:41.768266+0100	2803306	3	Unknown Traffic	192.168.2.4	49840	104.21.74.56	80	TCP
2025-03-26T13:45:44.302219+0100	2803306	3	Unknown Traffic	192.168.2.4	49842	104.21.74.56	80	TCP
2025-03-26T13:45:45.565642+0100	2803306	3	Unknown Traffic	192.168.2.4	49843	104.21.74.56	80	TCP
2025-03-26T13:45:47.987291+0100	2803306	3	Unknown Traffic	192.168.2.4	49845	172.66.40.87	80	TCP
2025-03-26T13:45:49.237135+0100	2803306	3	Unknown Traffic	192.168.2.4	49846	104.21.74.56	80	TCP
2025-03-26T13:45:52.791515+0100	2803306	3	Unknown Traffic	192.168.2.4	49849	172.66.40.87	80	TCP
2025-03-26T13:45:58.478449+0100	2803306	3	Unknown Traffic	192.168.2.4	49854	104.19.222.79	80	TCP
2025-03-26T13:46:01.923265+0100	2803306	3	Unknown Traffic	192.168.2.4	49857	172.66.40.87	80	TCP
2025-03-26T13:46:05.436115+0100	2803306	3	Unknown Traffic	192.168.2.4	49860	104.21.74.56	80	TCP
2025-03-26T13:46:07.095221+0100	2803306	3	Unknown Traffic	192.168.2.4	49861	69.147.82.60	80	TCP
2025-03-26T13:46:08.333784+0100	2803306	3	Unknown Traffic	192.168.2.4	49863	104.21.74.56	80	TCP
2025-03-26T13:46:09.563579+0100	2803306	3	Unknown Traffic	192.168.2.4	49864	104.19.222.79	80	TCP
2025-03-26T13:46:10.786643+0100	2803306	3	Unknown Traffic	192.168.2.4	49865	104.19.222.79	80	TCP
2025-03-26T13:46:13.302713+0100	2803306	3	Unknown Traffic	192.168.2.4	49867	104.21.74.56	80	TCP
2025-03-26T13:46:14.536480+0100	2803306	3	Unknown Traffic	192.168.2.4	49868	104.21.74.56	80	TCP
2025-03-26T13:46:17.921672+0100	2803306	3	Unknown Traffic	192.168.2.4	49871	104.19.222.79	80	TCP
2025-03-26T13:46:19.152269+0100	2803306	3	Unknown Traffic	192.168.2.4	49872	172.66.40.87	80	TCP
2025-03-26T13:46:20.725220+0100	2803306	3	Unknown Traffic	192.168.2.4	49873	104.19.222.79	80	TCP
2025-03-26T13:46:21.954665+0100	2803306	3	Unknown Traffic	192.168.2.4	49874	104.21.74.56	80	TCP
2025-03-26T13:46:23.190107+0100	2803306	3	Unknown Traffic	192.168.2.4	49875	172.66.40.87	80	TCP
2025-03-26T13:46:25.674847+0100	2803306	3	Unknown Traffic	192.168.2.4	49877	104.19.222.79	80	TCP
2025-03-26T13:46:26.940225+0100	2803306	3	Unknown Traffic	192.168.2.4	49878	172.66.40.87	80	TCP
2025-03-26T13:46:29.355713+0100	2803306	3	Unknown Traffic	192.168.2.4	49880	172.66.40.87	80	TCP
2025-03-26T13:46:31.737094+0100	2803306	3	Unknown Traffic	192.168.2.4	49882	104.21.74.56	80	TCP
2025-03-26T13:46:33.186684+0100	2803306	3	Unknown Traffic	192.168.2.4	49883	13.35.98.164	80	TCP
2025-03-26T13:46:34.560899+0100	2803306	3	Unknown Traffic	192.168.2.4	49885	104.19.222.79	80	TCP
2025-03-26T13:46:35.823578+0100	2803306	3	Unknown Traffic	192.168.2.4	49886	104.19.222.79	80	TCP
2025-03-26T13:46:37.048215+0100	2803306	3	Unknown Traffic	192.168.2.4	49887	104.19.222.79	80	TCP
2025-03-26T13:46:39.517678+0100	2803306	3	Unknown Traffic	192.168.2.4	49889	172.66.40.87	80	TCP
2025-03-26T13:46:40.808448+0100	2803306	3	Unknown Traffic	192.168.2.4	49890	104.21.74.56	80	TCP
2025-03-26T13:46:44.455309+0100	2803306	3	Unknown Traffic	192.168.2.4	49893	104.21.74.56	80	TCP
2025-03-26T13:46:46.813627+0100	2803306	3	Unknown Traffic	192.168.2.4	49894	104.21.74.56	80	TCP
2025-03-26T13:46:51.636617+0100	2803306	3	Unknown Traffic	192.168.2.4	49898	104.19.222.79	80	TCP
2025-03-26T13:46:52.954610+0100	2803306	3	Unknown Traffic	192.168.2.4	49899	104.19.222.79	80	TCP

ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (com)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-26T13:46:59.239819+0100	2858232	1	A Network Trojan was detected	1.1.1.1	53	192.168.2.4	64445	UDP

ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-26T13:45:33.715342+0100	2811542	1	A Network Trojan was detected	1.1.1.1	53	192.168.2.4	62770	UDP
2025-03-26T13:46:21.972796+0100	2811542	1	A Network Trojan was detected	1.1.1.1	53	192.168.2.4	56114	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 2vt65gnmAr.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://mmiegqks.org/	Avira URL Cloud: Label: malware
Source: http://yvryrqqzi.info/	Avira URL Cloud: Label: malware
Source: http://aafibwgqhfb.info/	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe

Avira: detection malicious, Label: TR/Agent.327680.A

Multi AV Scanner detection for submitted file

Source: 2vt65gnmAr.exe	Virustotal: Detection: 97%			Perma Link
Source: 2vt65gnmAr.exe	ReversingLabs: Detection: 97%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Neural Call Log Analysis: 94.3%

Source: 2vt65gnmAr.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Spreading

Changes autostart functionality of drives

Source: C:\Users\user\Desktop\2vt65gnmAr.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer NoDriveTypeAutoRun

Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_00401000 Sleep,wsprintfA,FindFirstFileA,lstrcpyA,lstrcatA,wsprintfA,lstrcpyA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,lstrcatA,CopyFileA,FindNextFileA,FindClose,	0_2_00401000
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_00408819 Sleep,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,lstrlenA,lstrlenA,lstrlenA,lstrcmpiA,lstrlenA,wsprintfA,GetUserNameA,wsprintfA,ShellExecuteA,wsprintfA,ShellExecuteA,Sleep,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,LoadLibraryA,EnumResourceNamesA,FreeLibrary,MoveFileA,SetFileAttributesA,FindNextFileA,FindClose,	0_2_00408819
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_00407160 Sleep,wsprintfA,wsprintfA,FindFirstFileA,lstrlenA,wsprintfA,lstrlenA,lstrcmpiA,lstrcpyA,lstrlenA,wsprintfA,FindNextFileA,FindClose,	0_2_00407160
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_004091DC Sleep,wsprintfA,wsprintfA,FindFirstFileA,lstrcpyA,lstrcatA,wsprintfA,lstrcpyA,lstrcatA,lstrcatA,FindNextFileA,FindClose,lstrcpyA,	0_2_004091DC
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_004073A9 Sleep,Sleep,wsprintfA,FindFirstFileA,lstrlenA,wsprintfA,lstrlenA,lstrlenA,lstrcmpiA,lstrlenA,wsprintfA,lstrlenA,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_004073A9
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_00407C25 Sleep,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	0_2_00407C25
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_0040661F GetTickCount,Sleep,wsprintfA,wsprintfA,FindFirstFileA,lstrcatA,wsprintfA,lstrcpyA,lstrcatA,lstrcatA,SetFileAttributesA,FindNextFileA,FindClose,	0_2_0040661F
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_00410E31 Sleep,wsprintfA,wsprintfA,FindFirstFileA,FindClose,wsprintfA,FindClose,FindNextFileA,FindClose,	0_2_00410E31
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_00414690 lstrcatA,lstrcpyA,Sleep,wsprintfA,wsprintfA,FindFirstFileA,lstrcatA,wsprintfA,lstrlenA,lstrcmpiA,lstrcpyA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414690
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_00407757 lstrcatA,Sleep,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,FindNextFileA,FindClose,	0_2_00407757
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_0040661F GetTickCount,Sleep,wsprintfA,wsprintfA,FindFirstFileA,lstrcatA,wsprintfA,lstrcpyA,lstrcatA,lstrcatA,SetFileAttributesA,FindNextFileA,FindClose,	2_2_0040661F
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_00401000 Sleep,wsprintfA,FindFirstFileA,lstrcpyA,lstrcatA,wsprintfA,lstrcpyA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,lstrcatA,CopyFileA,FindNextFileA,FindClose,	2_2_00401000
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_00408819 Sleep,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,lstrlenA,lstrlenA,lstrlenA,lstrcmpiA,lstrlenA,wsprintfA,GetUserNameA,wsprintfA,ShellExecuteA,wsprintfA,ShellExecuteA,Sleep,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,LoadLibraryA,EnumResourceNamesA,FreeLibrary,MoveFileA,SetFileAttributesA,FindNextFileA,FindClose,	2_2_00408819
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_00407160 Sleep,wsprintfA,wsprintfA,FindFirstFileA,lstrlenA,wsprintfA,lstrlenA,lstrcmpiA,lstrcpyA,lstrlenA,wsprintfA,FindNextFileA,FindClose,	2_2_00407160
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_004091DC Sleep,wsprintfA,wsprintfA,FindFirstFileA,lstrcpyA,lstrcatA,wsprintfA,lstrcpyA,lstrcatA,lstrcatA,FindNextFileA,FindClose,lstrcpyA,	2_2_004091DC
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_004073A9 Sleep,Sleep,wsprintfA,FindFirstFileA,lstrlenA,wsprintfA,lstrlenA,lstrlenA,lstrcmpiA,lstrlenA,wsprintfA,lstrlenA,lstrcpyA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	2_2_004073A9
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_00407C25 Sleep,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	2_2_00407C25
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_00410E31 Sleep,wsprintfA,wsprintfA,FindFirstFileA,FindClose,wsprintfA,FindClose,FindNextFileA,FindClose,	2_2_00410E31
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_00414690 lstrcatA,lstrcpyA,Sleep,wsprintfA,wsprintfA,FindFirstFileA,lstrcatA,wsprintfA,lstrlenA,lstrcmpiA,lstrcpyA,lstrcatA,lstrcatA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,	2_2_00414690
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_00407757 lstrcatA,Sleep,wsprintfA,wsprintfA,FindFirstFileA,wsprintfA,FindNextFileA,FindClose,	2_2_00407757

Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	File opened: C:\Program Files (x86)\Java\jre-1.8\bin\client\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	File opened: C:\Program Files (x86)\Java\jre-1.8\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	File opened: C:\Program Files (x86)\Java\jre-1.8\bin\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	File opened: C:\Program Files (x86)\Java\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	File opened: C:\Program Files (x86)\Java\jre-1.8\bin\jabswitch.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	File opened: C:\Program Files (x86)\Java\jre-1.8\bin\dtplugin\	Jump to behavior

Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49717 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49718 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49734 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49719 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49749 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49754 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49764 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49746 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49744 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49776 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49735 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49728 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49727 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49737 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49773 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49752 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49757 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49781 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49766 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49758 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49751 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49791 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49759 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49760 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49784 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49802 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49767 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49788 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49775 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49782 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49803 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49762 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49828 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49805 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49808 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49755 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49801 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49799 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49806 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49825 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49771 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49837 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49834 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49857 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49860 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49772 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49874 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49780 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49849 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49865 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49838 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49840 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49842 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49815 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49824 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49872 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49827 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49778 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49898 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49880 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49885 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49867 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49871 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49792 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49893 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49868 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49894 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49882 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49816 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49877 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49830 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49873 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49890 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49887 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49813 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49845 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49875 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49863 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49886 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49832 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49795 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49899 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49864 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49843 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49846 -> 104.21.74.56:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49854 -> 104.19.222.79:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49878 -> 172.66.40.87:80
Source: Network traffic	Suricata IDS: 2018773 - Severity 1 - ET MALWARE Win32/Pykspa.C Public IP Check : 192.168.2.4:49889 -> 172.66.40.87:80

Source: Joe Sandbox View	IP Address: 151.101.0.81 151.101.0.81
Source: Joe Sandbox View	IP Address: 85.214.228.140 85.214.228.140
Source: Joe Sandbox View	IP Address: 85.214.228.140 85.214.228.140

Source: unknown	DNS query: name: www.showmyipaddress.com
Source: unknown	DNS query: name: www.showmyipaddress.com
Source: unknown	DNS query: name: www.showmyipaddress.com
Source: unknown	DNS query: name: www.whatismyip.com
Source: unknown	DNS query: name: www.whatismyip.ca
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: whatismyipaddress.com
Source: unknown	DNS query: name: www.whatismyip.ca
Source: unknown	DNS query: name: www.whatismyip.ca
Source: unknown	DNS query: name: www.whatismyip.ca
Source: unknown	DNS query: name: www.whatismyip.ca
Source: unknown	DNS query: name: www.whatismyip.ca
Source: unknown	DNS query: name: www.whatismyip.ca
Source: unknown	DNS query: name: www.whatismyip.ca
Source: unknown	DNS query: name: www.whatismyip.ca
Source: unknown	DNS query: name: www.whatismyip.ca
Source: unknown	DNS query: name: www.whatismyip.ca
Source: unknown	DNS query: name: www.whatismyip.ca
Source: unknown	DNS query: name: www.whatismyip.ca
Source: unknown	DNS query: name: www.whatismyip.ca
Source: unknown	DNS query: name: www.whatismyip.ca
Source: unknown	DNS query: name: www.whatismyip.ca
Source: unknown	DNS query: name: www.whatismyip.ca
Source: unknown	DNS query: name: www.whatismyip.ca
Source: unknown	DNS query: name: www.whatismyip.ca
Source: unknown	DNS query: name: www.whatismyip.ca
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	DNS query: name: www.whatismyip.ca
Source: unknown	DNS query: name: www.whatismyip.ca
Source: unknown	DNS query: name: www.whatismyip.ca

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: jpzchl.exe, 00000001.00000003.2077644604.0000000000706000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: R=me-ycpi-cf-www.g06.yahoodns.netwww.yahoo.com equals www.yahoo.com (Yahoo)
Source: jpzchl.exe, 00000001.00000003.2077644604.0000000000706000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: pme-ycpi-cf-www.g06.yahoodns.netwww.yahoo.comZp equals www.yahoo.com (Yahoo)
Source: 2vt65gnmAr.exe, jpzchl.exe.0.dr	String found in binary or memory: www.facebook.com/ equals www.facebook.com (Facebook)
Source: 2vt65gnmAr.exe, jpzchl.exe.0.dr	String found in binary or memory: www.myspace.com/ equals www.myspace.com (Myspace)
Source: jpzchl.exe, 00000001.00000003.2185763109.00000000006B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.whatismyip.comom.yahoodns.netwww.yahoo.comc.co.ukwww.bbc.co.uk.pri.bbc.co.uk equals www.yahoo.com (Yahoo)
Source: jpzchl.exe, 00000001.00000003.2077644604.0000000000706000.00000004.00000020.00020000.00000000.sdmp, jpzchl.exe, 00000001.00000003.2185763109.00000000006B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.yahoo.com equals www.yahoo.com (Yahoo)
Source: 2vt65gnmAr.exe, jpzchl.exe.0.dr	String found in binary or memory: www.yahoo.com/ equals www.yahoo.com (Yahoo)
Source: 2vt65gnmAr.exe, jpzchl.exe.0.dr	String found in binary or memory: www.youtube.com/ equals www.youtube.com (Youtube)
Source: jpzchl.exe, 00000001.00000002.3639231535.000000000019F000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com/www.wikipedia.org/www.blogger.com/www.adobe.com/www.http://whatismyipaddress.com/ equals www.youtube.com (Youtube)
Source: 2vt65gnmAr.exe, jpzchl.exe.0.dr	String found in binary or memory: xxwww.ebay.com/www.baidu.com/www.imdb.com/www.bbc.co.uk/www.adobe.com/www.blogger.com/www.wikipedia.org/www.yahoo.com/www.youtube.com/www.myspace.com/www.facebook.com/www.google.com/ .Shell""-shutdown -r equals www.facebook.com (Facebook)
Source: 2vt65gnmAr.exe, jpzchl.exe.0.dr	String found in binary or memory: xxwww.ebay.com/www.baidu.com/www.imdb.com/www.bbc.co.uk/www.adobe.com/www.blogger.com/www.wikipedia.org/www.yahoo.com/www.youtube.com/www.myspace.com/www.facebook.com/www.google.com/ .Shell""-shutdown -r equals www.myspace.com (Myspace)
Source: 2vt65gnmAr.exe, jpzchl.exe.0.dr	String found in binary or memory: xxwww.ebay.com/www.baidu.com/www.imdb.com/www.bbc.co.uk/www.adobe.com/www.blogger.com/www.wikipedia.org/www.yahoo.com/www.youtube.com/www.myspace.com/www.facebook.com/www.google.com/ .Shell""-shutdown -r equals www.yahoo.com (Yahoo)
Source: 2vt65gnmAr.exe, jpzchl.exe.0.dr	String found in binary or memory: xxwww.ebay.com/www.baidu.com/www.imdb.com/www.bbc.co.uk/www.adobe.com/www.blogger.com/www.wikipedia.org/www.yahoo.com/www.youtube.com/www.myspace.com/www.facebook.com/www.google.com/ .Shell""-shutdown -r equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: whatismyip.everdot.org
Source: global traffic	DNS traffic detected: DNS query: www.showmyipaddress.com
Source: global traffic	DNS traffic detected: DNS query: www.whatismyip.com
Source: global traffic	DNS traffic detected: DNS query: www.whatismyip.ca
Source: global traffic	DNS traffic detected: DNS query: whatismyipaddress.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: jnroptvip.org
Source: global traffic	DNS traffic detected: DNS query: www.myspace.com
Source: global traffic	DNS traffic detected: DNS query: zuorczzdatlo.info
Source: global traffic	DNS traffic detected: DNS query: qpfajtyzcw.net
Source: global traffic	DNS traffic detected: DNS query: nwteograjdt.org
Source: global traffic	DNS traffic detected: DNS query: dwxmnjoom.net
Source: global traffic	DNS traffic detected: DNS query: kbxajtvvbn.info
Source: global traffic	DNS traffic detected: DNS query: swgaaiooksau.com
Source: global traffic	DNS traffic detected: DNS query: aafibwgqhfb.info
Source: global traffic	DNS traffic detected: DNS query: fgjabs.net
Source: global traffic	DNS traffic detected: DNS query: cdflxf.net
Source: global traffic	DNS traffic detected: DNS query: mgwftefk.info
Source: global traffic	DNS traffic detected: DNS query: jcnbxl.info
Source: global traffic	DNS traffic detected: DNS query: zupntcptdttz.net
Source: global traffic	DNS traffic detected: DNS query: mmiegqks.org
Source: global traffic	DNS traffic detected: DNS query: bedfrjxhjwy.info
Source: global traffic	DNS traffic detected: DNS query: zcuqywksumqp.info
Source: global traffic	DNS traffic detected: DNS query: orkytvlnfars.info
Source: global traffic	DNS traffic detected: DNS query: vqhwnozt.net
Source: global traffic	DNS traffic detected: DNS query: lwujjelylqeb.net
Source: global traffic	DNS traffic detected: DNS query: bexknytaywt.net
Source: global traffic	DNS traffic detected: DNS query: tmjmesq.org
Source: global traffic	DNS traffic detected: DNS query: ccbaberwh.info
Source: global traffic	DNS traffic detected: DNS query: klfenlandpr.info
Source: global traffic	DNS traffic detected: DNS query: lnauaebz.net
Source: global traffic	DNS traffic detected: DNS query: ogvggwfjrs.info
Source: global traffic	DNS traffic detected: DNS query: yvryrqqzi.info
Source: global traffic	DNS traffic detected: DNS query: jeghaq.info
Source: global traffic	DNS traffic detected: DNS query: hetqsoielt.net
Source: global traffic	DNS traffic detected: DNS query: yuhwzejglaw.net
Source: global traffic	DNS traffic detected: DNS query: nhofhlbxz.net
Source: global traffic	DNS traffic detected: DNS query: fblfnhkvvn.net
Source: global traffic	DNS traffic detected: DNS query: rddeftpst.org
Source: global traffic	DNS traffic detected: DNS query: dyyoucf.net
Source: global traffic	DNS traffic detected: DNS query: rhggmman.net
Source: global traffic	DNS traffic detected: DNS query: xqdwbajebck.org
Source: global traffic	DNS traffic detected: DNS query: icjyrqqzi.info
Source: global traffic	DNS traffic detected: DNS query: jcietot.net
Source: global traffic	DNS traffic detected: DNS query: bwxufvjyz.info
Source: global traffic	DNS traffic detected: DNS query: qrcxqqfmhbpi.net
Source: global traffic	DNS traffic detected: DNS query: mdffoy.net
Source: global traffic	DNS traffic detected: DNS query: uuagovlh.info
Source: global traffic	DNS traffic detected: DNS query: lzesolxwpy.net
Source: global traffic	DNS traffic detected: DNS query: kzryuikb.info
Source: global traffic	DNS traffic detected: DNS query: viuwbkgebxj.com
Source: global traffic	DNS traffic detected: DNS query: iypzceny.info
Source: global traffic	DNS traffic detected: DNS query: vgrtxsh.net
Source: global traffic	DNS traffic detected: DNS query: ixstgqltnjie.info
Source: global traffic	DNS traffic detected: DNS query: phcoydzj.info
Source: global traffic	DNS traffic detected: DNS query: ontfxnwgapp.net
Source: global traffic	DNS traffic detected: DNS query: kwjehu.info
Source: global traffic	DNS traffic detected: DNS query: tpfcrmv.info
Source: global traffic	DNS traffic detected: DNS query: kiwgsm.org
Source: global traffic	DNS traffic detected: DNS query: iudcvwv.info
Source: global traffic	DNS traffic detected: DNS query: siyskq.org
Source: global traffic	DNS traffic detected: DNS query: olqddql.info
Source: global traffic	DNS traffic detected: DNS query: wscsyewaimaa.org
Source: global traffic	DNS traffic detected: DNS query: puashfy.org
Source: global traffic	DNS traffic detected: DNS query: pugsdrf.net
Source: global traffic	DNS traffic detected: DNS query: dbdaveoadmjm.info
Source: global traffic	DNS traffic detected: DNS query: fgifll.info
Source: global traffic	DNS traffic detected: DNS query: zohcdrqk.net
Source: global traffic	DNS traffic detected: DNS query: lklwgdvifo.net
Source: global traffic	DNS traffic detected: DNS query: hzljqttwka.info
Source: global traffic	DNS traffic detected: DNS query: cijsdwwwjap.net
Source: global traffic	DNS traffic detected: DNS query: nsbtgrxt.net
Source: global traffic	DNS traffic detected: DNS query: yhqcpmz.info
Source: global traffic	DNS traffic detected: DNS query: jtxybua.com
Source: global traffic	DNS traffic detected: DNS query: qncxmy.info
Source: global traffic	DNS traffic detected: DNS query: dakalpcoh.org
Source: global traffic	DNS traffic detected: DNS query: rjzylnhw.info
Source: global traffic	DNS traffic detected: DNS query: ejbtpslzukuu.info
Source: global traffic	DNS traffic detected: DNS query: dszxwxjrlev.info
Source: global traffic	DNS traffic detected: DNS query: engyxy.net
Source: global traffic	DNS traffic detected: DNS query: mbnrqlnhtj.net
Source: global traffic	DNS traffic detected: DNS query: yussumkau.net
Source: global traffic	DNS traffic detected: DNS query: hsngrkr.org
Source: global traffic	DNS traffic detected: DNS query: rswwesrbw.net
Source: global traffic	DNS traffic detected: DNS query: zvqhmgsfdbki.info
Source: global traffic	DNS traffic detected: DNS query: wrbxqkby.info
Source: global traffic	DNS traffic detected: DNS query: fadcnhgwlvva.net
Source: global traffic	DNS traffic detected: DNS query: emqoqomi.org
Source: global traffic	DNS traffic detected: DNS query: bavahhrmglpz.net
Source: global traffic	DNS traffic detected: DNS query: zbamqqiwohsw.info
Source: global traffic	DNS traffic detected: DNS query: scogum.org
Source: global traffic	DNS traffic detected: DNS query: ulorxe.info
Source: global traffic	DNS traffic detected: DNS query: ectgtkr.info
Source: global traffic	DNS traffic detected: DNS query: uqgqamoskwoi.com
Source: global traffic	DNS traffic detected: DNS query: sooscqsouy.org
Source: global traffic	DNS traffic detected: DNS query: sukokmae.org
Source: global traffic	DNS traffic detected: DNS query: eagycymieaso.org
Source: global traffic	DNS traffic detected: DNS query: hhftdocw.net
Source: global traffic	DNS traffic detected: DNS query: vrhjwm.info
Source: global traffic	DNS traffic detected: DNS query: ieigsieoyw.org

Source: jpzchl.exe.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: jpzchl.exe, jpzchl.exe, 00000002.00000002.3639697196.000000000042A000.00000002.00000001.01000000.00000005.sdmp, jpzchl.exe, 00000002.00000000.1196641411.000000000042A000.00000002.00000001.01000000.00000005.sdmp, 2vt65gnmAr.exe, jpzchl.exe.0.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: jpzchl.exe, 00000001.00000002.3639231535.000000000019F000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://whatismyipaddress.com/

Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_00413757 OpenClipboard,WriteFile,EmptyClipboard,lstrlenA,GlobalAlloc,GlobalLock,lstrcpyA,GlobalUnlock,SetClipboardData,CloseClipboard,		0_2_00413757
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_00413757 OpenClipboard,WriteFile,EmptyClipboard,lstrlenA,GlobalAlloc,GlobalLock,lstrcpyA,GlobalUnlock,SetClipboardData,CloseClipboard,		2_2_00413757

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.myspace.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: aafibwgqhfb.infoAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: mmiegqks.orgAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: yvryrqqzi.infoAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.bbc.co.ukAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.myspace.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: aafibwgqhfb.infoAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: mmiegqks.orgAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: yvryrqqzi.infoAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.bbc.co.ukAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: whatismyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.showmyipaddress.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.whatismyip.comAccept: /User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3Connection: close

Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_0041EB78 PostQuitMessage,CreateThread,GetTickCount,lstrcpynA,lstrcpyA,wsprintfA,PostQuitMessage,NtdllDefWindowProc_A,		0_2_0041EB78
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_0041EB78 PostQuitMessage,CreateThread,GetTickCount,lstrcpynA,lstrcpyA,wsprintfA,PostQuitMessage,NtdllDefWindowProc_A,		2_2_0041EB78

Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: GetTickCount,Sleep,Sleep,GetTickCount,lstrcpyA,lstrlenA,lstrcatA,ShellExecuteA,CreateThread,GetTickCount,Sleep,Sleep,MessageBoxA,Sleep, shutdown -r	0_2_00415B6F
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: GetTickCount,Sleep,Sleep,GetTickCount,lstrcpyA,lstrlenA,lstrcatA,ShellExecuteA,CreateThread,GetTickCount,Sleep,Sleep,MessageBoxA,Sleep, Shutdown	0_2_00415B6F
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_00413BE5 ExitWindowsEx,	0_2_00413BE5
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: GetTickCount,Sleep,Sleep,GetTickCount,lstrcpyA,lstrlenA,lstrcatA,ShellExecuteA,CreateThread,GetTickCount,Sleep,Sleep,MessageBoxA,Sleep, shutdown -r	2_2_00415B6F
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: GetTickCount,Sleep,Sleep,GetTickCount,lstrcpyA,lstrlenA,lstrcatA,ShellExecuteA,CreateThread,GetTickCount,Sleep,Sleep,MessageBoxA,Sleep, Shutdown	2_2_00415B6F
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_00413BE5 ExitWindowsEx,	2_2_00413BE5

Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	File created: C:\Windows\SysWOW64\ydmosvflsrzykptvafoquxhnutb.mrv	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	File created: C:\Windows\ydmosvflsrzykptvafoquxhnutb.mrv	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	File created: C:\Windows\SysWOW64\vlfshvqhzjcmjzobrhbodrmdvfyifvkxndxkzn.zrb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	File created: C:\Windows\vlfshvqhzjcmjzobrhbodrmdvfyifvkxndxkzn.zrb	Jump to behavior

Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_0040C6E7	0_2_0040C6E7
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_0041B1C4	0_2_0041B1C4
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_00422188	0_2_00422188
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_0041B26C	0_2_0041B26C
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_0040F38F	0_2_0040F38F
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_004284FA	0_2_004284FA
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_0042772B	0_2_0042772B
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_0041A72B	0_2_0041A72B
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_0040C6E7	2_2_0040C6E7
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_0041B1C4	2_2_0041B1C4
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_00422188	2_2_00422188
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_0041B26C	2_2_0041B26C
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_0040F38F	2_2_0040F38F
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_004284FA	2_2_004284FA
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_0042772B	2_2_0042772B
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_0041A72B	2_2_0041A72B

Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: String function: 0041356E appears 46 times
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: String function: 0041356E appears 45 times

Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_00413B5A Sleep,GetCurrentProcess,OpenProcessToken,GetCurrentThread,OpenThreadToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,		0_2_00413B5A
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_00413B5A Sleep,GetCurrentProcess,OpenProcessToken,GetCurrentThread,OpenThreadToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,		2_2_00413B5A

Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Mutant created: \Sessions\1\BaseNamedObjects\ytskexxtqfdsupjbwrqic
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Mutant created: \Sessions\1\BaseNamedObjects\ifgawrtrqhhyczvpmjkeavx
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Mutant created: \Sessions\1\BaseNamedObjects\pllezturpfeuxtohdzzsnh

Source: unknown	Process created: C:\Users\user\Desktop\2vt65gnmAr.exe "C:\Users\user\Desktop\2vt65gnmAr.exe"
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process created: C:\Users\user\AppData\Local\Temp\jpzchl.exe "C:\Users\user\AppData\Local\Temp\jpzchl.exe" "-"
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process created: C:\Users\user\AppData\Local\Temp\jpzchl.exe "C:\Users\user\AppData\Local\Temp\jpzchl.exe" "-"
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process created: C:\Users\user\AppData\Local\Temp\jpzchl.exe "C:\Users\user\AppData\Local\Temp\jpzchl.exe" "-"	Jump to behavior
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process created: C:\Users\user\AppData\Local\Temp\jpzchl.exe "C:\Users\user\AppData\Local\Temp\jpzchl.exe" "-"	Jump to behavior

Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_00422177 push ecx; ret	0_2_00422187
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_00421BA0 push eax; ret	0_2_00421BB4
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_00421BA0 push eax; ret	0_2_00421BDC
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_00422177 push ecx; ret	2_2_00422187
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_00421BA0 push eax; ret	2_2_00421BB4
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_00421BA0 push eax; ret	2_2_00421BDC

Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ltfkrxkt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce clyemthrc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce jpzchl	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ydmos	Jump to behavior

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2vt65gnmAr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
2vt65gnmAr.exe

Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_0040C064	0_2_0040C064
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_00420077	0_2_00420077
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_004208CC	0_2_004208CC
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_0041F485	0_2_0041F485
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_0040E597	0_2_0040E597
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_00405E76	0_2_00405E76
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_00412E03	0_2_00412E03
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_00421605	0_2_00421605
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_00406743	0_2_00406743
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_00405F51	0_2_00405F51
Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: 0_2_0041BF93	0_2_0041BF93
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_0040C064	2_2_0040C064
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_00420077	2_2_00420077
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_004208CC	2_2_004208CC
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_0041F485	2_2_0041F485
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_0040E597	2_2_0040E597
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_00405E76	2_2_00405E76
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_00412E03	2_2_00412E03
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_00421605	2_2_00421605
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_00406743	2_2_00406743
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_00405F51	2_2_00405F51
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: 2_2_0041BF93	2_2_0041BF93

Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: GetCursorPos,Sleep,		0_2_0040C338
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: GetCursorPos,Sleep,		2_2_0040C338

Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Code function: GetTickCount,GetAdaptersInfo,GetTickCount,GetAdaptersInfo,inet_addr,		0_2_0041668B
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Code function: GetTickCount,GetAdaptersInfo,GetTickCount,GetAdaptersInfo,inet_addr,		2_2_0041668B

Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Thread delayed: delay time: 600000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Thread delayed: delay time: 10800000			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Window / User API: threadDelayed 1782	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Window / User API: threadDelayed 1691	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Window / User API: threadDelayed 7507	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Window / User API: threadDelayed 1492	Jump to behavior

Source: C:\Users\user\Desktop\2vt65gnmAr.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_0-27907
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_2-28043

Source: C:\Users\user\Desktop\2vt65gnmAr.exe	API coverage: 6.5 %
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	API coverage: 6.5 %

Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe TID: 7652	Thread sleep count: 1782 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe TID: 7656	Thread sleep count: 1691 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe TID: 8112	Thread sleep count: 133 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe TID: 7600	Thread sleep count: 73 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe TID: 7600	Thread sleep time: -2190000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe TID: 7496	Thread sleep count: 76 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe TID: 7496	Thread sleep time: -2280000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe TID: 7628	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe TID: 7488	Thread sleep count: 75 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe TID: 7344	Thread sleep time: -21600000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe TID: 7604	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe TID: 7632	Thread sleep count: 7507 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe TID: 7632	Thread sleep time: -7507000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe TID: 7648	Thread sleep count: 46 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe TID: 7636	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe TID: 7632	Thread sleep count: 1492 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe TID: 7632	Thread sleep time: -1492000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\jpzchl.exe	Thread delayed: delay time: 10800000	Jump to behavior