Edit tour

Windows Analysis Report
cobaltstrike.dll

Overview

General Information

Sample name:	cobaltstrike.dll (renamed file extension from exe to dll)
Original sample name:	cobaltstrike.exe
Analysis ID:	1555135
MD5:	943afff642b01160380eaae87a33da07
SHA1:	67f575725d10dae057a35aa15691278a2245e158
SHA256:	6e5887670a74b010bff1c5bc11e936b392a12ed48a6afd796bd712c2594d423b
Tags:	cobaltstrikeexeuser-JAMESWT_MHT
Infos:

Detection

CobaltStrike

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected CobaltStrike

C2 URLs / IPs found in malware configuration

Found direct / indirect Syscall (likely to bypass EDR)

Injects code into the Windows Explorer (explorer.exe)

Query firmware table information (likely to detect VMs)

Sigma detected: Execution from Suspicious Folder

Sigma detected: Explorer NOUACCHECK Flag

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Dropped file seen in connection with other malware

Drops PE files

Found dropped PE file which has not been started or loaded

Internet Provider seen in connection with other malware

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries keyboard layouts

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 4832 cmdline: loaddll64.exe "C:\Users\user\Desktop\cobaltstrike.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 6776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4064 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 6088 cmdline: rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

sihost.exe (PID: 1340 cmdline: C:\Windows\System32\sihost.exe MD5: A21E7719D73D0322E2E7D61802CB8F80)

WerFault.exe (PID: 4412 cmdline: C:\Windows\system32\WerFault.exe -u -p 1340 -s 544 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 616 cmdline: rundll32.exe C:\Users\user\Desktop\cobaltstrike.dll,CloseThreadWaitChainSession MD5: EF3179D498793BF4234F708D3BE28633)

Advanced_IP_Scanner.exe (PID: 6516 cmdline: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe MD5: 5537C708EDB9A2C21F88E34E8A0F1744)

Advanced_IP_Scanner.tmp (PID: 2020 cmdline: "C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp" /SL5="$20408,20439558,139776,C:\Users\Public\Downloads\Advanced_IP_Scanner.exe" MD5: B87639F9A6CF5BA8C9E1F297C5745A67)

sihost.exe (PID: 3908 cmdline: C:\Windows\System32\sihost.exe MD5: A21E7719D73D0322E2E7D61802CB8F80)

explorer.exe (PID: 1080 cmdline: explorer.exe /LOADSAVEDWINDOWS MD5: 662F4F92FDE3557E86D110526BB578D5)

rundll32.exe (PID: 6600 cmdline: rundll32.exe C:\Users\user\Desktop\cobaltstrike.dll,GetThreadWaitChain MD5: EF3179D498793BF4234F708D3BE28633)

Advanced_IP_Scanner.exe (PID: 5712 cmdline: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe MD5: 5537C708EDB9A2C21F88E34E8A0F1744)

Advanced_IP_Scanner.tmp (PID: 2100 cmdline: "C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp" /SL5="$30412,20439558,139776,C:\Users\Public\Downloads\Advanced_IP_Scanner.exe" MD5: B87639F9A6CF5BA8C9E1F297C5745A67)

sihost.exe (PID: 516 cmdline: C:\Windows\System32\sihost.exe MD5: A21E7719D73D0322E2E7D61802CB8F80)

explorer.exe (PID: 3992 cmdline: explorer.exe /LOADSAVEDWINDOWS MD5: 662F4F92FDE3557E86D110526BB578D5)

rundll32.exe (PID: 4040 cmdline: rundll32.exe C:\Users\user\Desktop\cobaltstrike.dll,OpenThreadWaitChainSession MD5: EF3179D498793BF4234F708D3BE28633)

Advanced_IP_Scanner.exe (PID: 2432 cmdline: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe MD5: 5537C708EDB9A2C21F88E34E8A0F1744)

Advanced_IP_Scanner.tmp (PID: 5704 cmdline: "C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp" /SL5="$10454,20439558,139776,C:\Users\Public\Downloads\Advanced_IP_Scanner.exe" MD5: B87639F9A6CF5BA8C9E1F297C5745A67)

sihost.exe (PID: 3180 cmdline: C:\Windows\System32\sihost.exe MD5: A21E7719D73D0322E2E7D61802CB8F80)

explorer.exe (PID: 5564 cmdline: explorer.exe /LOADSAVEDWINDOWS MD5: 662F4F92FDE3557E86D110526BB578D5)

Advanced_IP_Scanner.exe (PID: 6084 cmdline: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe MD5: 5537C708EDB9A2C21F88E34E8A0F1744)

Advanced_IP_Scanner.tmp (PID: 1364 cmdline: "C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp" /SL5="$60218,20439558,139776,C:\Users\Public\Downloads\Advanced_IP_Scanner.exe" MD5: B87639F9A6CF5BA8C9E1F297C5745A67)

sihost.exe (PID: 7164 cmdline: C:\Windows\System32\sihost.exe MD5: A21E7719D73D0322E2E7D61802CB8F80)

explorer.exe (PID: 6940 cmdline: explorer.exe /LOADSAVEDWINDOWS MD5: 662F4F92FDE3557E86D110526BB578D5)

rundll32.exe (PID: 4416 cmdline: rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",CloseThreadWaitChainSession MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 1912 cmdline: rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",GetThreadWaitChain MD5: EF3179D498793BF4234F708D3BE28633)

Advanced_IP_Scanner.exe (PID: 776 cmdline: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe MD5: 5537C708EDB9A2C21F88E34E8A0F1744)

rundll32.exe (PID: 2096 cmdline: rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",OpenThreadWaitChainSession MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 2936 cmdline: rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",WerpWalkGatherBlocks MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 5932 cmdline: rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",WerpValidateReportKey MD5: EF3179D498793BF4234F708D3BE28633)

explorer.exe (PID: 6204 cmdline: C:\Windows\explorer.exe /NoUACCheck MD5: 662F4F92FDE3557E86D110526BB578D5)

rundll32.exe (PID: 2352 cmdline: C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Cobalt Strike, CobaltStrike	Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine. Beacon includes a wealth of functionality to the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. Beacon is in-memory/file-less, in that it consists of stageless or multi-stage shellcode that once loaded by exploiting a vulnerability or executing a shellcode loader, will reflectively load itself into the memory of a process without touching the disk. It supports C2 and staging over HTTP, HTTPS, DNS, SMB named pipes as well as forward and reverse TCP; Beacons can be daisy-chained. Cobalt Strike comes with a toolkit for developing shellcode loaders, called Artifact Kit.The Beacon implant has become popular amongst targeted attackers and criminal users as it is well written, stable, and highly customizable.	APT 29 APT32 APT41 AQUATIC PANDA Anunak Cobalt Codoso CopyKittens DarkHydrus Earth Baxia FIN6 FIN7 Leviathan Mustang Panda Shell Crew Stone Panda TianWu UNC1878 UNC2452 Winnti Umbrella	http://blog.morphisec.com/new-global-attack-on-point-of-sale-systems http://blog.nsfocus.net/murenshark http://stillu.cc/assets/slides/2023-08-Unmasking%20CamoFei.pdf http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa http://www.secureworks.com/research/threat-profiles/gold-drake	https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike

Malware Configuration

Threatname: CobaltStrike

{"BeaconType": ["HTTPS"], "Port": 10443, "SleepTime": 15500, "MaxGetSize": 13982519, "Jitter": 15, "C2Server": "91.92.250.70,/broadcast", "HttpPostUri": "/1/events/com.amazon.csm.csa.prod", "Malleable_C2_Instructions": ["Remove 1308 bytes from the end", "Remove 1 bytes from the end", "Remove 194 bytes from the beginning", "Base64 decode"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\gpupdate.exe", "Spawnto_x64": "%windir%\\sysnative\\gpupdate.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 1158277545, "bStageCleanup": "True", "bCFGCaution": "True", "KillDate": 0, "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 8092, "ProcInject_PrependAppend_x86": ["ZofJREVmh9KH20lITEAPHwBDQofSR2aQDx8EAGYPHwQAQEFmh9uHyZBGDx8ADx8A", "Empty"], "ProcInject_PrependAppend_x64": ["ZofJREVmh9KH20lITEAPHwBDQofSR2aQDx8EAGYPHwQAQEFmh9uHyZBGDx8ADx8A", "Empty"], "ProcInject_Execute": ["ntdll.dll:RtlUserThreadStart", "NtQueueApcThread-s", "SetThreadContext", "CreateRemoteThread", "kernel32.dll:LoadLibraryA", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "NtMapViewOfSection", "bUsesCookies": "False", "HostHeader": ""}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000012.00000002.2908078030.00007FFD44420000.00000020.00000001.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000012.00000002.2908078030.00007FFD44420000.00000020.00000001.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000012.00000002.2908078030.00007FFD44420000.00000020.00000001.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x189d8:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19d09:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000014.00000003.2947314162.00007FFD44420000.00000020.00000001.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000014.00000003.2947314162.00007FFD44420000.00000020.00000001.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000014.00000003.2947314162.00007FFD44420000.00000020.00000001.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x189d8:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x19d09:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
00000029.00000002.4999809185.000001BA34866000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_2	Yara detected CobaltStrike	Joe Security
00000029.00000002.4999809185.000001BA34866000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
00000029.00000002.4999809185.000001BA34866000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_CobaltStrike_f0b627fc	Rule for beacon reflective loader	unknown	0x1a7aa:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75 0x1badb:$beacon_loader_x64: 25 FF FF FF 00 3D 41 41 41 00 75 1A 8B 44 24 78 25 FF FF FF 00 3D 42 42 42 00 75
Process Memory Space: sihost.exe PID: 1340	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: sihost.exe PID: 516	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Process Memory Space: rundll32.exe PID: 5932	JoeSecurity_CobaltStrike_3	Yara detected CobaltStrike	Joe Security
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe, CommandLine: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe, CommandLine|base64offset|contains: , Image: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe, NewProcessName: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe, OriginalFileName: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe, ParentCommandLine: rundll32.exe C:\Users\user\Desktop\cobaltstrike.dll,CloseThreadWaitChainSession, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 616, ParentProcessName: rundll32.exe, ProcessCommandLine: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe, ProcessId: 6516, ProcessName: Advanced_IP_Scanner.exe

Sigma detected: Explorer NOUACCHECK Flag

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\explorer.exe /NoUACCheck, CommandLine: C:\Windows\explorer.exe /NoUACCheck, CommandLine|base64offset|contains: y, Image: C:\Windows\explorer.exe, NewProcessName: C:\Windows\explorer.exe, OriginalFileName: C:\Windows\explorer.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1064, ProcessCommandLine: C:\Windows\explorer.exe /NoUACCheck, ProcessId: 6204, ProcessName: explorer.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T14:23:50.611079+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.6	49790	TCP
2024-11-13T14:24:38.680407+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.6	49959	TCP

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T14:24:45.043364+0100	2028765	3	Unknown Traffic	192.168.2.6	49950	91.92.250.70	10443	TCP
2024-11-13T14:25:06.750419+0100	2028765	3	Unknown Traffic	192.168.2.6	49988	91.92.250.70	10443	TCP
2024-11-13T14:25:27.013214+0100	2028765	3	Unknown Traffic	192.168.2.6	49998	91.92.250.70	10443	TCP
2024-11-13T14:25:49.671140+0100	2028765	3	Unknown Traffic	192.168.2.6	50002	91.92.250.70	10443	TCP
2024-11-13T14:26:11.276689+0100	2028765	3	Unknown Traffic	192.168.2.6	50005	91.92.250.70	10443	TCP
2024-11-13T14:26:31.304319+0100	2028765	3	Unknown Traffic	192.168.2.6	50008	91.92.250.70	10443	TCP
2024-11-13T14:26:43.935481+0100	2028765	3	Unknown Traffic	192.168.2.6	50010	91.92.250.70	10443	TCP
2024-11-13T14:26:52.846728+0100	2028765	3	Unknown Traffic	192.168.2.6	50012	91.92.250.70	10443	TCP
2024-11-13T14:27:04.902481+0100	2028765	3	Unknown Traffic	192.168.2.6	50016	91.92.250.70	10443	TCP
2024-11-13T14:27:12.814187+0100	2028765	3	Unknown Traffic	192.168.2.6	50018	91.92.250.70	10443	TCP
2024-11-13T14:27:24.862958+0100	2028765	3	Unknown Traffic	192.168.2.6	50022	91.92.250.70	10443	TCP
2024-11-13T14:27:33.605371+0100	2028765	3	Unknown Traffic	192.168.2.6	50025	91.92.250.70	10443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: cobaltstrike.dll

Avira: detected

Found malware configuration

Source: 00000012.00000002.2908078030.00007FFD44420000.00000020.00000001.00020000.00000000.sdmp

Malware Configuration Extractor: CobaltStrike {"BeaconType": ["HTTPS"], "Port": 10443, "SleepTime": 15500, "MaxGetSize": 13982519, "Jitter": 15, "C2Server": "91.92.250.70,/broadcast", "HttpPostUri": "/1/events/com.amazon.csm.csa.prod", "Malleable_C2_Instructions": ["Remove 1308 bytes from the end", "Remove 1 bytes from the end", "Remove 194 bytes from the beginning", "Base64 decode"], "HttpGet_Verb": "GET", "HttpPost_Verb": "POST", "HttpPostChunk": 0, "Spawnto_x86": "%windir%\\syswow64\\gpupdate.exe", "Spawnto_x64": "%windir%\\sysnative\\gpupdate.exe", "CryptoScheme": 0, "Proxy_Behavior": "Use IE settings", "Watermark": 1158277545, "bStageCleanup": "True", "bCFGCaution": "True", "KillDate": 0, "bProcInject_StartRWX": "False", "bProcInject_UseRWX": "False", "bProcInject_MinAllocSize": 8092, "ProcInject_PrependAppend_x86": ["ZofJREVmh9KH20lITEAPHwBDQofSR2aQDx8EAGYPHwQAQEFmh9uHyZBGDx8ADx8A", "Empty"], "ProcInject_PrependAppend_x64": ["ZofJREVmh9KH20lITEAPHwBDQofSR2aQDx8EAGYPHwQAQEFmh9uHyZBGDx8ADx8A", "Empty"], "ProcInject_Execute": ["ntdll.dll:RtlUserThreadStart", "NtQueueApcThread-s", "SetThreadContext", "CreateRemoteThread", "kernel32.dll:LoadLibraryA", "RtlCreateUserThread"], "ProcInject_AllocationMethod": "NtMapViewOfSection", "bUsesCookies": "False", "HostHeader": ""}

Multi AV Scanner detection for submitted file

Source: cobaltstrike.dll

ReversingLabs: Detection: 47%

Source: cobaltstrike.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: Z:\out\Release\NetUtils\x86\aips_is_install_dll.pdb source: aips_is_install_dll.dll.13.dr, aips_is_install_dll.dll.10.dr
Source:	Binary string: Z:\out\Release\NetUtils\x86\aips_wix_install_dll.pdb source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 91.92.250.70

Source: global traffic

TCP traffic: 192.168.2.6:49950 -> 91.92.250.70:10443

Source: Joe Sandbox View

ASN Name: THEZONEBG THEZONEBG

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49950 -> 91.92.250.70:10443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50008 -> 91.92.250.70:10443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50012 -> 91.92.250.70:10443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50002 -> 91.92.250.70:10443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50022 -> 91.92.250.70:10443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50025 -> 91.92.250.70:10443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50005 -> 91.92.250.70:10443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50018 -> 91.92.250.70:10443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50010 -> 91.92.250.70:10443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:50016 -> 91.92.250.70:10443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49998 -> 91.92.250.70:10443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.6:49988 -> 91.92.250.70:10443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.6:49790
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.6:49959

Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.250.70

Source: global traffic

DNS traffic detected: DNS query: api.msn.com

Source: Advanced_IP_Scanner.tmp, 0000000A.00000002.4924239494.000000000018F000.00000004.00000010.00020000.00000000.sdmp, cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr, aips_is_install_dll.dll.13.dr, aips_is_install_dll.dll.10.dr	String found in binary or memory: http://s.symcb.com/pca3-g5.crl0
Source: Advanced_IP_Scanner.tmp, 0000000A.00000002.4924239494.000000000018F000.00000004.00000010.00020000.00000000.sdmp, cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr, aips_is_install_dll.dll.13.dr, aips_is_install_dll.dll.10.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: Advanced_IP_Scanner.tmp, 0000000A.00000002.4924239494.000000000018F000.00000004.00000010.00020000.00000000.sdmp, cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr, aips_is_install_dll.dll.13.dr, aips_is_install_dll.dll.10.dr	String found in binary or memory: http://s.symcd.com06
Source: Advanced_IP_Scanner.tmp, 0000000A.00000002.4924239494.000000000018F000.00000004.00000010.00020000.00000000.sdmp, cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr, aips_is_install_dll.dll.13.dr, aips_is_install_dll.dll.10.dr	String found in binary or memory: http://s.symcd.com0_
Source: explorer.exe, 0000001C.00000003.2850336534.00000000091C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.micr
Source: Advanced_IP_Scanner.tmp, 0000000A.00000003.2286560487.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://support.radmin.com
Source: Advanced_IP_Scanner.tmp, 0000000A.00000003.2286560487.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://support.radmin.com.
Source: Advanced_IP_Scanner.tmp, 0000000A.00000003.2286560487.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://support.radmin.com.#
Source: Advanced_IP_Scanner.tmp, 0000000A.00000003.2286560487.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://support.radmin.com.#:Finished_MsiErrorFromResource
Source: Advanced_IP_Scanner.tmp, 0000000A.00000003.2286560487.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://support.radmin.comk0T0#
Source: Advanced_IP_Scanner.tmp, 0000000A.00000002.4924239494.000000000018F000.00000004.00000010.00020000.00000000.sdmp, cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr, aips_is_install_dll.dll.13.dr, aips_is_install_dll.dll.10.dr	String found in binary or memory: http://sw.symcb.com/sw.crl0
Source: Advanced_IP_Scanner.tmp, 0000000A.00000002.4924239494.000000000018F000.00000004.00000010.00020000.00000000.sdmp, cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr, aips_is_install_dll.dll.13.dr, aips_is_install_dll.dll.10.dr	String found in binary or memory: http://sw.symcd.com0
Source: Advanced_IP_Scanner.tmp, 0000000A.00000002.4924239494.000000000018F000.00000004.00000010.00020000.00000000.sdmp, cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr, aips_is_install_dll.dll.13.dr, aips_is_install_dll.dll.10.dr	String found in binary or memory: http://sw1.symcb.com/sw.crt0
Source: Advanced_IP_Scanner.tmp, 0000000A.00000002.4924239494.000000000018F000.00000004.00000010.00020000.00000000.sdmp, cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr, aips_is_install_dll.dll.13.dr, aips_is_install_dll.dll.10.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: Advanced_IP_Scanner.tmp, 0000000A.00000002.4924239494.000000000018F000.00000004.00000010.00020000.00000000.sdmp, cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr, aips_is_install_dll.dll.13.dr, aips_is_install_dll.dll.10.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: Advanced_IP_Scanner.tmp, 0000000A.00000002.4924239494.000000000018F000.00000004.00000010.00020000.00000000.sdmp, cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr, aips_is_install_dll.dll.13.dr, aips_is_install_dll.dll.10.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: Amcache.hve.30.dr	String found in binary or memory: http://upx.sf.net
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=bg&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=br&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=cn&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=cz&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=da&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=de&ver=2-5-4594&beta=n&page=helpProductCode
Source: Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=en&ver=2-5-4594&beta=n&page=helpREINSTALLMODEamusINS
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=es&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=et&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=fi&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=fr&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=gr&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=he&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=hr&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=hu&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=id&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=ir&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=it&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=jp&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=kr&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=lt&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=lv&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=nb&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=nl&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=pl&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=ro&1
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=ro&1042
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=ru&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=sa&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=se&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=sk&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=sl&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=sr&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=th&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=tr&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=tw&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=uk&ver=2-5-4594&beta=n&page=helpProductCode
Source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.advanced-ip-scanner.com/link.php?lng=vn&ver=2-5-4594&beta=n&page=helpProductCode
Source: Advanced_IP_Scanner.tmp, 0000000A.00000002.4924239494.000000000018F000.00000004.00000010.00020000.00000000.sdmp, cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr, aips_is_install_dll.dll.13.dr, aips_is_install_dll.dll.10.dr	String found in binary or memory: http://www.advanced-ip-scanner.com0
Source: Advanced_IP_Scanner.exe, 00000006.00000003.2249692168.00000000023A0000.00000004.00001000.00020000.00000000.sdmp, Advanced_IP_Scanner.exe, 00000006.00000003.2257922336.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp, Advanced_IP_Scanner.tmp, 0000000A.00000000.2277316777.0000000000415000.00000020.00000001.01000000.00000006.sdmp, Advanced_IP_Scanner.tmp.40.dr, Advanced_IP_Scanner.tmp.6.dr	String found in binary or memory: http://www.innosetup.com/
Source: Advanced_IP_Scanner.exe, 00000006.00000000.2234411898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: Advanced_IP_Scanner.tmp, 0000000D.00000003.2550554167.0000000003A94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org
Source: Advanced_IP_Scanner.tmp, 0000000A.00000003.2286560487.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, Advanced_IP_Scanner.tmp, 0000000D.00000003.2550554167.0000000003A94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/
Source: Advanced_IP_Scanner.tmp, 0000000D.00000003.2550554167.0000000003A64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/)
Source: Advanced_IP_Scanner.exe, 00000008.00000003.2261826650.00000000022C6000.00000004.00001000.00020000.00000000.sdmp, Advanced_IP_Scanner.tmp, 00000009.00000003.2287543092.000000000338D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.palkornel.hu/innosetup%1
Source: Advanced_IP_Scanner.tmp, 0000000A.00000003.2286560487.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, Advanced_IP_Scanner.tmp, 0000000D.00000003.2550554167.0000000003A64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.qt.io/licensing/
Source: Advanced_IP_Scanner.tmp, 0000000A.00000003.2286560487.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.radmin.com/about/legal/pp.php
Source: Advanced_IP_Scanner.tmp, 0000000D.00000003.2550554167.0000000003A64000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.radmin.com/about/legal/pp.php).
Source: Advanced_IP_Scanner.exe, 00000006.00000003.2237175552.00000000023A0000.00000004.00001000.00020000.00000000.sdmp, Advanced_IP_Scanner.exe, 00000008.00000003.2261826650.00000000022C6000.00000004.00001000.00020000.00000000.sdmp, Advanced_IP_Scanner.tmp, 00000009.00000003.2287543092.000000000338D000.00000004.00001000.00020000.00000000.sdmp, Advanced_IP_Scanner.tmp, 0000000A.00000003.2286560487.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.radmin.com/support/feedba
Source: Advanced_IP_Scanner.tmp, 0000000A.00000003.2286560487.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, Advanced_IP_Scanner.tmp, 0000000D.00000003.2548775849.0000000000878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.radmin.com/support/feedback/php
Source: Advanced_IP_Scanner.tmp, 0000000D.00000003.2550554167.0000000003A64000.00000004.00000020.00020000.00000000.sdmp, Advanced_IP_Scanner.tmp, 0000000D.00000003.2548775849.0000000000878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.radmin.com/support/feedback/php.
Source: Advanced_IP_Scanner.exe, 00000006.00000003.2249692168.00000000023A0000.00000004.00001000.00020000.00000000.sdmp, Advanced_IP_Scanner.exe, 00000006.00000003.2257922336.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp, Advanced_IP_Scanner.tmp, 0000000A.00000000.2277316777.0000000000415000.00000020.00000001.01000000.00000006.sdmp, Advanced_IP_Scanner.tmp.40.dr, Advanced_IP_Scanner.tmp.6.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: sihost.exe, 00000014.00000003.4343208696.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3803856721.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4543176264.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3711474066.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3576433373.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4219916450.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4127862749.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3927157672.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3376744458.0000014316084000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3281533543.0000014316033000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4019404037.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435523241.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435239207.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3812370712.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3484621861.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4635863611.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4019548626.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4220116820.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3376909861.0000014316086000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3281435880.0000014316084000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3576779331.0000014316088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70/
Source: sihost.exe, 00000014.00000003.4343208696.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3927157672.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4019404037.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3576661158.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4635660696.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4219916450.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3803856721.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3165602891.0000014316063000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4127862749.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3576433373.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3711474066.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3484621861.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4543176264.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3281435880.0000014316063000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3376909861.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3376744458.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435239207.0000014316066000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70/.Q
Source: sihost.exe, 00000015.00000003.4355324832.00000208217CB000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4555511112.00000208217BD000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4463495917.00000208217BA000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4663130336.00000208217BD000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4555696679.00000208217BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70/i
Source: sihost.exe, 00000014.00000003.4343208696.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4543176264.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435523241.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435239207.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4635863611.0000014316088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70/n
Source: sihost.exe, 00000014.00000003.3281533543.0000014316033000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70/ows
Source: sihost.exe, 00000014.00000003.3281533543.0000014316053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70/ptography
Source: sihost.exe, 00000014.00000003.4343208696.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3927157672.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4019404037.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3576661158.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4635660696.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4219916450.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3803856721.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3165602891.0000014316063000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4127862749.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3576433373.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3711474066.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3484621861.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4543176264.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3281435880.0000014316063000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3376909861.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3376744458.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435239207.0000014316066000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70/zQ
Source: sihost.exe, 00000014.00000003.4220116820.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3281435880.0000014316084000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3576779331.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4463603936.00000208217F0000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4663130336.00000208217F0000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4555511112.00000208217F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70:10443/
Source: sihost.exe, 00000014.00000003.4343208696.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3803856721.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4543176264.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3711474066.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4219916450.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4127862749.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3927157672.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4019404037.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435523241.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435239207.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3812370712.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4635863611.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4019548626.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4220116820.0000014316088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70:10443/&
Source: sihost.exe, 00000014.00000003.4343208696.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4543176264.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4219916450.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4127862749.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435523241.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435239207.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4220116820.0000014316088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70:10443/b
Source: sihost.exe, 00000015.00000003.4555696679.00000208217BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70:10443/broadcast
Source: sihost.exe, 00000014.00000003.4343208696.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4219916450.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4127862749.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435523241.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435239207.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4220116820.0000014316088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70:10443/broadcast&
Source: sihost.exe, 00000014.00000003.3576433373.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4219916450.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4127862749.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3376744458.0000014316084000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3484621861.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4220116820.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3376909861.0000014316086000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3281435880.0000014316084000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3576779331.0000014316088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70:10443/broadcast(
Source: sihost.exe, 00000014.00000003.3803856721.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3711474066.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3812370712.0000014316088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70:10443/broadcast-
Source: sihost.exe, 00000015.00000003.4355457234.00000208217BA000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4555511112.00000208217BD000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4463495917.00000208217BA000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4663130336.00000208217BD000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4555696679.00000208217BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70:10443/broadcast3
Source: sihost.exe, 00000014.00000003.4343208696.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3803856721.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4543176264.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3711474066.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4219916450.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4127862749.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3927157672.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4019404037.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435523241.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435239207.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3812370712.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4635863611.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4019548626.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4220116820.0000014316088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70:10443/broadcast32
Source: sihost.exe, 00000014.00000003.4543176264.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3927157672.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3376744458.0000014316084000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4019404037.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4635863611.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4019548626.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3376909861.0000014316086000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3281435880.0000014316084000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70:10443/broadcastC
Source: sihost.exe, 00000015.00000003.4663130336.00000208217E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70:10443/broadcastCryptography
Source: sihost.exe, 00000014.00000003.4343208696.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4543176264.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435523241.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435239207.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4635863611.0000014316088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70:10443/broadcastCryptography%
Source: sihost.exe, 00000014.00000003.4219916450.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4127862749.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4220116820.0000014316088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70:10443/broadcastE
Source: sihost.exe, 00000015.00000003.4355457234.00000208217BA000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4555511112.00000208217BD000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4463495917.00000208217BA000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4663130336.00000208217BD000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4555696679.00000208217BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70:10443/broadcastM
Source: sihost.exe, 00000014.00000003.4543176264.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4635863611.0000014316088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70:10443/broadcastT
Source: sihost.exe, 00000014.00000003.3281533543.0000014316053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70:10443/broadcastVj
Source: sihost.exe, 00000014.00000003.3281533543.0000014316053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70:10443/broadcastfj
Source: sihost.exe, 00000014.00000003.4343208696.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4543176264.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435523241.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435239207.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4635863611.0000014316088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.92.250.70:10443/~
Source: explorer.exe, 0000001C.00000003.2945807124.000000000C7E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com?c
Source: Advanced_IP_Scanner.tmp, 0000000A.00000002.4924239494.000000000018F000.00000004.00000010.00020000.00000000.sdmp, cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr, aips_is_install_dll.dll.13.dr, aips_is_install_dll.dll.10.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: aips_is_install_dll.dll.10.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: Advanced_IP_Scanner.tmp, 0000000A.00000002.4924239494.000000000018F000.00000004.00000010.00020000.00000000.sdmp, cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr, aips_is_install_dll.dll.13.dr, aips_is_install_dll.dll.10.dr	String found in binary or memory: https://d.symcb.com/rpa0)
Source: Advanced_IP_Scanner.tmp, 0000000A.00000002.4924239494.000000000018F000.00000004.00000010.00020000.00000000.sdmp, cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr, aips_is_install_dll.dll.13.dr, aips_is_install_dll.dll.10.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: sihost.exe, 00000015.00000003.4463495917.00000208217D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com
Source: sihost.exe, 00000015.00000003.4355457234.00000208217BA000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4463495917.00000208217BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.comm

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000012.00000002.2908078030.00007FFD44420000.00000020.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000014.00000003.2947314162.00007FFD44420000.00000020.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown
Source: 00000029.00000002.4999809185.000001BA34866000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Rule for beacon reflective loader Author: unknown

Source: Joe Sandbox View

Dropped File: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe 26D5748FFE6BD95E3FEE6CE184D388A1A681006DC23A0F08D53C083C593C193B

Source: C:\Windows\System32\sihost.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1340 -s 544

Source: cobaltstrike.dll	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: Advanced_IP_Scanner.tmp.6.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: Advanced_IP_Scanner.tmp.6.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: Advanced_IP_Scanner.tmp.8.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: Advanced_IP_Scanner.tmp.8.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: Advanced_IP_Scanner.tmp.12.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: Advanced_IP_Scanner.tmp.12.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: Advanced_IP_Scanner.tmp.14.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: Advanced_IP_Scanner.tmp.14.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: Advanced_IP_Scanner.tmp.40.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: Advanced_IP_Scanner.tmp.40.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: cobaltstrike.dll

Static PE information: Number of sections : 12 > 10

Source: cobaltstrike.dll

Binary or memory string: OriginalFilenameaips_wix_install_dll.dllH vs cobaltstrike.dll

Source: 00000012.00000002.2908078030.00007FFD44420000.00000020.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000014.00000003.2947314162.00007FFD44420000.00000020.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13
Source: 00000029.00000002.4999809185.000001BA34866000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_CobaltStrike_f0b627fc reference_sample = b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b, os = windows, severity = x86, description = Rule for beacon reflective loader, creation_date = 2021-10-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.CobaltStrike, fingerprint = fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1, id = f0b627fc-97cd-42cb-9eae-1efb0672762d, last_modified = 2022-01-13

Source: explorer.exe, 0000001C.00000003.2946050514.000000000C892000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2950866569.000000000C892000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: /;.VBP

Source: classification engine

Classification label: mal100.troj.evad.winDLL@94/22@1/1

Source: C:\Windows\System32\rundll32.exe

File created: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6776:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1340
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Mutant created: \Sessions\1\BaseNamedObjects\Advanced IP Scanner

Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe

File created: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp

Jump to behavior

Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\explorer.exe	Jump to behavior

Source: cobaltstrike.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\explorer.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\cobaltstrike.dll,CloseThreadWaitChainSession

Source: cobaltstrike.dll

ReversingLabs: Detection: 47%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\cobaltstrike.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\cobaltstrike.dll,CloseThreadWaitChainSession
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",#1
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\cobaltstrike.dll,GetThreadWaitChain
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Process created: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp "C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp" /SL5="$20408,20439558,139776,C:\Users\Public\Downloads\Advanced_IP_Scanner.exe"
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Process created: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp "C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp" /SL5="$30412,20439558,139776,C:\Users\Public\Downloads\Advanced_IP_Scanner.exe"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\cobaltstrike.dll,OpenThreadWaitChainSession
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Process created: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp "C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp" /SL5="$10454,20439558,139776,C:\Users\Public\Downloads\Advanced_IP_Scanner.exe"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Process created: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp "C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp" /SL5="$60218,20439558,139776,C:\Users\Public\Downloads\Advanced_IP_Scanner.exe"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\sihost.exe C:\Windows\System32\sihost.exe
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\sihost.exe C:\Windows\System32\sihost.exe
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\sihost.exe C:\Windows\System32\sihost.exe
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\sihost.exe C:\Windows\System32\sihost.exe
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\explorer.exe explorer.exe /LOADSAVEDWINDOWS
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\sihost.exe C:\Windows\System32\sihost.exe
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\explorer.exe explorer.exe /LOADSAVEDWINDOWS
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\explorer.exe explorer.exe /LOADSAVEDWINDOWS
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\explorer.exe explorer.exe /LOADSAVEDWINDOWS
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /NoUACCheck
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1340 -s 544
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",CloseThreadWaitChainSession
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",GetThreadWaitChain
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",OpenThreadWaitChainSession
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",WerpWalkGatherBlocks
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",WerpValidateReportKey
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\cobaltstrike.dll,CloseThreadWaitChainSession	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\cobaltstrike.dll,GetThreadWaitChain	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\cobaltstrike.dll,OpenThreadWaitChainSession	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\sihost.exe C:\Windows\System32\sihost.exe	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",CloseThreadWaitChainSession	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",GetThreadWaitChain	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",OpenThreadWaitChainSession	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",WerpWalkGatherBlocks	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",WerpValidateReportKey	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",#1	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\sihost.exe C:\Windows\System32\sihost.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\sihost.exe C:\Windows\System32\sihost.exe	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Process created: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp "C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp" /SL5="$20408,20439558,139776,C:\Users\Public\Downloads\Advanced_IP_Scanner.exe"	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\sihost.exe C:\Windows\System32\sihost.exe	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Process created: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp "C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp" /SL5="$30412,20439558,139776,C:\Users\Public\Downloads\Advanced_IP_Scanner.exe"	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\sihost.exe C:\Windows\System32\sihost.exe	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Process created: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp "C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp" /SL5="$10454,20439558,139776,C:\Users\Public\Downloads\Advanced_IP_Scanner.exe"	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Process created: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp "C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp" /SL5="$60218,20439558,139776,C:\Users\Public\Downloads\Advanced_IP_Scanner.exe"	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\explorer.exe explorer.exe /LOADSAVEDWINDOWS	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\explorer.exe explorer.exe /LOADSAVEDWINDOWS	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\explorer.exe explorer.exe /LOADSAVEDWINDOWS	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process created: C:\Windows\explorer.exe explorer.exe /LOADSAVEDWINDOWS	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
Source: C:\Windows\System32\rundll32.exe	Process created: unknown unknown
Source: C:\Windows\System32\rundll32.exe	Process created: unknown unknown
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Process created: unknown unknown
Source: C:\Windows\System32\rundll32.exe	Process created: unknown unknown

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Section loaded: globinputhost.dll	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: desktopshellext.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: desktopshellext.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: desktopshellext.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: wwanmm.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: desktopshellext.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: wwanmm.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: desktopshellext.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: usermgrproxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: structuredquery.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswb7.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.search.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ninput.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.applicationmodel.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sndvolsso.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: usermgrproxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositoryclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cldapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: tiledatarepository.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: staterepository.core.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepository.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinui.pcshell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wincorlib.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.immersiveshell.serviceprovider.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: languageoverlayutil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: appextension.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: photometadatahandler.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinui.appcore.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: twinui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: applicationframe.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ehstorshell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cscui.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.fileexplorer.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uiribbon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: networkexplorer.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: structuredquery.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: holographicextensions.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: virtualmonitormanager.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: abovelockapphost.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: npsm.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.shell.bluelightreduction.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.web.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.signals.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.staterepositorybroker.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mfplat.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rtworkq.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskflowdatauser.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.security.authentication.web.core.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.data.activities.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.system.launcher.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.ui.shell.windowtabmanager.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: notificationcontrollerps.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.devices.enumeration.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswb7.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: devdispitemprovider.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.core.textinput.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windowsudk.shellcommon.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dictationmanager.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: stobject.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wmiclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: workfoldersshell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.ui.xaml.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windowsinternal.composableshell.desktophosting.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: uiamanager.dll	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Section loaded: uxtheme.dll
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Section loaded: apphelp.dll

Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp

Window found: window name: TSelectLanguageForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Automated click: OK

Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: cobaltstrike.dll

Static PE information: More than 144 > 100 exports found

Source: cobaltstrike.dll

Static PE information: Image base 0x2c1a60000 > 0x60000000

Source: cobaltstrike.dll

Static file information: File size 22275072 > 1048576

Source: cobaltstrike.dll

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x145f800

Source: cobaltstrike.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: Z:\out\Release\NetUtils\x86\aips_is_install_dll.pdb source: aips_is_install_dll.dll.13.dr, aips_is_install_dll.dll.10.dr
Source:	Binary string: Z:\out\Release\NetUtils\x86\aips_wix_install_dll.pdb source: cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr

Source: cobaltstrike.dll

Static PE information: section name: .xdata

Source: C:\Windows\System32\sihost.exe	Code function: 18_2_00007FFD4442487D push ebx; iretd	18_2_00007FFD44424885
Source: C:\Windows\System32\sihost.exe	Code function: 18_2_00007FFD444248F0 push ebx; iretd	18_2_00007FFD444248F1
Source: C:\Windows\System32\sihost.exe	Code function: 18_2_00007FFD444211B2 push ebp; ret	18_2_00007FFD444211D1
Source: C:\Windows\System32\sihost.exe	Code function: 18_2_00007FFD44422FAA push ebx; retf	18_2_00007FFD44422FD5
Source: C:\Windows\System32\sihost.exe	Code function: 18_2_00007FFD44423960 push ebp; retf	18_2_00007FFD44423975
Source: C:\Windows\System32\sihost.exe	Code function: 18_2_00007FFD4442123F push ebp; ret	18_2_00007FFD444211D1
Source: C:\Windows\System32\sihost.exe	Code function: 18_2_00007FFD44422FF8 push edx; retf	18_2_00007FFD44422FF9
Source: C:\Windows\System32\sihost.exe	Code function: 18_2_00007FFD44423012 push eax; retf	18_2_00007FFD44423019
Source: C:\Windows\System32\sihost.exe	Code function: 18_2_00007FFD44423004 push edx; retf	18_2_00007FFD44423005
Source: C:\Windows\System32\sihost.exe	Code function: 20_3_00007FFD4442487D push ebx; iretd	20_3_00007FFD44424885
Source: C:\Windows\System32\sihost.exe	Code function: 20_3_00007FFD444248F0 push ebx; iretd	20_3_00007FFD444248F1
Source: C:\Windows\System32\sihost.exe	Code function: 20_3_00007FFD444211B2 push ebp; ret	20_3_00007FFD444211D1
Source: C:\Windows\System32\sihost.exe	Code function: 20_3_00007FFD44422FAA push ebx; retf	20_3_00007FFD44422FD5
Source: C:\Windows\System32\sihost.exe	Code function: 20_3_00007FFD44423960 push ebp; retf	20_3_00007FFD44423975
Source: C:\Windows\System32\sihost.exe	Code function: 20_3_00007FFD4442123F push ebp; ret	20_3_00007FFD444211D1
Source: C:\Windows\System32\sihost.exe	Code function: 20_3_00007FFD44422FF8 push edx; retf	20_3_00007FFD44422FF9
Source: C:\Windows\System32\sihost.exe	Code function: 20_3_00007FFD44423012 push eax; retf	20_3_00007FFD44423019
Source: C:\Windows\System32\sihost.exe	Code function: 20_3_00007FFD44423004 push edx; retf	20_3_00007FFD44423005

Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	File created: C:\Users\user\AppData\Local\Temp\is-2FLEP.tmp\aips_is_install_dll.dll	Jump to dropped file
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	File created: C:\Users\user\AppData\Local\Temp\is-FDD04.tmp\Advanced_IP_Scanner.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	File created: C:\Users\user\AppData\Local\Temp\is-2FLEP.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Windows\System32\rundll32.exe	File created: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Jump to dropped file
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	File created: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	File created: C:\Users\user\AppData\Local\Temp\is-STV6O.tmp\aips_is_install_dll.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	File created: C:\Users\user\AppData\Local\Temp\is-2FLEP.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	File created: C:\Users\user\AppData\Local\Temp\is-BT8N1.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	File created: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	File created: C:\Users\user\AppData\Local\Temp\is-STV6O.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	File created: C:\Users\user\AppData\Local\Temp\is-BT8N1.tmp\aips_is_install_dll.dll	Jump to dropped file
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	File created: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Jump to dropped file
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	File created: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	File created: C:\Users\user\AppData\Local\Temp\is-BT8N1.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	File created: C:\Users\user\AppData\Local\Temp\is-STV6O.tmp\_isetup\_setup64.tmp	Jump to dropped file

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\explorer.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-2FLEP.tmp\aips_is_install_dll.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-2FLEP.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-STV6O.tmp\aips_is_install_dll.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-2FLEP.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-BT8N1.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-STV6O.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-BT8N1.tmp\aips_is_install_dll.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-BT8N1.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-STV6O.tmp\_isetup\_setup64.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\sihost.exe	Last function: Thread delayed
Source: C:\Windows\System32\sihost.exe	Last function: Thread delayed

Source: explorer.exe, 0000001C.00000003.2857128914.0000000009355000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 8PS5\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}""
Source: explorer.exe, 0000001C.00000003.2857066340.00000000093D3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:/q
Source: Amcache.hve.30.dr	Binary or memory string: VMware
Source: Amcache.hve.30.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.30.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.30.dr	Binary or memory string: VMware, Inc.
Source: explorer.exe, 0000001C.00000003.2950866569.000000000C892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: BBSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: Amcache.hve.30.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.30.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.30.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.30.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.30.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: sihost.exe, 00000014.00000003.3576661158.0000014316077000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3927157672.0000014316077000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4219916450.0000014316077000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3281435880.0000014316077000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4127862749.0000014316077000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435239207.0000014316077000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3484621861.0000014316077000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4343208696.0000014316077000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3165602891.0000014316077000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3711474066.0000014316077000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3803856721.0000014316077000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.30.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: explorer.exe, 0000001C.00000003.2946050514.000000000C892000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000003.2950866569.000000000C892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @wgencounter.infgencounter.devicedescMicrosoft Hyper-V Generation Counterwgencounter.infIiXR
Source: explorer.exe, 0000001C.00000003.2946625515.000000000C909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: Amcache.hve.30.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: sihost.exe, 00000014.00000003.3281533543.0000014316033000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: Amcache.hve.30.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.30.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: explorer.exe, 0000001C.00000003.2857776942.0000000009309000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\
Source: explorer.exe, 0000001C.00000003.2857776942.0000000009309000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}\[
Source: Amcache.hve.30.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.30.dr	Binary or memory string: vmci.syshbin`
Source: explorer.exe, 0000001C.00000003.2946625515.000000000C909000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\
Source: Amcache.hve.30.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: explorer.exe, 0000001C.00000003.2950866569.000000000C892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4NECVMWar VMware SATA CD00
Source: Amcache.hve.30.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.30.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.30.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.30.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.30.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.30.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.30.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.30.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.30.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.30.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.30.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.30.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.30.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\sihost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\System32\sihost.exe	Process queried: DebugPort			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\System32\loaddll64.exe	NtCreateUserProcess: Indirect: 0x7FFD91C5B500	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtAllocateVirtualMemory: Indirect: 0x7FFD91C67ED5	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Indirect: 0x7FFD91C68FC8	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtCreateUserProcess: Indirect: 0x7FFD91C6FAFF	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Indirect: 0x7FFD91C69C89	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtWriteVirtualMemory: Indirect: 0x7FFD91C6A0DB	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtWriteVirtualMemory: Indirect: 0x7FFD91C69132	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtWriteVirtualMemory: Indirect: 0x7FFD91C69F18	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Indirect: 0x7FFD91C6A299	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\sihost.exe	Memory written: PID: 1080 base: F0000 value: 00	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: PID: 1080 base: 2582D8 value: 00	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: PID: 3992 base: 780000 value: 00	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: PID: 3992 base: 9992D8 value: 00	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: PID: 5564 base: DF0000 value: 00	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: PID: 5564 base: F0A2D8 value: 00	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: PID: 6940 base: 800000 value: 00	Jump to behavior
Source: C:\Windows\System32\sihost.exe	Memory written: PID: 6940 base: 68B2D8 value: 00	Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",#1

Jump to behavior

Source: C:\Windows\System32\sihost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.30.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.30.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.30.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.30.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.30.dr	Binary or memory string: MsMpEng.exe

Remote Access Functionality

Yara detected CobaltStrike

Source: Yara match	File source: 00000012.00000002.2908078030.00007FFD44420000.00000020.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2947314162.00007FFD44420000.00000020.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.4999809185.000001BA34866000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: sihost.exe PID: 1340, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sihost.exe PID: 516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 5932, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	OS Credential Dumping	121 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	11 Virtualization/Sandbox Evasion	LSASS Memory	11 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	111 Process Injection	Security Account Manager	2 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Abuse Elevation Control Mechanism	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Rundll32	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
cobaltstrike.dll	47%	ReversingLabs	Win64.Trojan.HavokizMarte
cobaltstrike.dll	100%	Avira	TR/FileCoder.hlwyn

Dropped Files

Source	Detection	Scanner
C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-2FLEP.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-2FLEP.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-2FLEP.tmp\aips_is_install_dll.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-BT8N1.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-BT8N1.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-BT8N1.tmp\aips_is_install_dll.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-FDD04.tmp\Advanced_IP_Scanner.tmp	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-STV6O.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-STV6O.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-STV6O.tmp\aips_is_install_dll.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://91.92.250.70:10443/b	0%	Avira URL Cloud	safe
https://91.92.250.70:10443/broadcastM	0%	Avira URL Cloud	safe
https://www.amazon.comm	0%	Avira URL Cloud	safe
https://91.92.250.70:10443/broadcastE	0%	Avira URL Cloud	safe
https://91.92.250.70/zQ	0%	Avira URL Cloud	safe
https://91.92.250.70:10443/broadcast32	0%	Avira URL Cloud	safe
http://www.radmin.com/about/legal/pp.php).	0%	Avira URL Cloud	safe
https://91.92.250.70:10443/broadcastC	0%	Avira URL Cloud	safe
https://91.92.250.70:10443/broadcastCryptography	0%	Avira URL Cloud	safe
http://www.radmin.com/support/feedback/php.	0%	Avira URL Cloud	safe
https://91.92.250.70/i	0%	Avira URL Cloud	safe
https://91.92.250.70:10443/broadcastVj	0%	Avira URL Cloud	safe
https://91.92.250.70:10443/broadcastCryptography%	0%	Avira URL Cloud	safe
http://www.radmin.com/about/legal/pp.php	0%	Avira URL Cloud	safe
https://91.92.250.70/n	0%	Avira URL Cloud	safe
https://91.92.250.70/.Q	0%	Avira URL Cloud	safe
https://91.92.250.70:10443/~	0%	Avira URL Cloud	safe
http://support.radmin.com	0%	Avira URL Cloud	safe
https://91.92.250.70:10443/broadcastT	0%	Avira URL Cloud	safe
http://support.radmin.com.#	0%	Avira URL Cloud	safe
91.92.250.70	0%	Avira URL Cloud	safe
http://support.radmin.comk0T0#	0%	Avira URL Cloud	safe
https://91.92.250.70/	0%	Avira URL Cloud	safe
http://www.radmin.com/support/feedback/php	0%	Avira URL Cloud	safe
https://91.92.250.70:10443/&	0%	Avira URL Cloud	safe
https://91.92.250.70:10443/	0%	Avira URL Cloud	safe
http://www.advanced-ip-scanner.com0	0%	Avira URL Cloud	safe
http://support.radmin.com.	0%	Avira URL Cloud	safe
http://support.radmin.com.#:Finished_MsiErrorFromResource	0%	Avira URL Cloud	safe
https://91.92.250.70:10443/broadcast-	0%	Avira URL Cloud	safe
https://91.92.250.70:10443/broadcast3	0%	Avira URL Cloud	safe
https://91.92.250.70/ows	0%	Avira URL Cloud	safe
https://91.92.250.70/ptography	0%	Avira URL Cloud	safe
https://91.92.250.70:10443/broadcast&	0%	Avira URL Cloud	safe
https://91.92.250.70:10443/broadcastfj	0%	Avira URL Cloud	safe
https://91.92.250.70:10443/broadcast	0%	Avira URL Cloud	safe
http://www.radmin.com/support/feedba	0%	Avira URL Cloud	safe
https://91.92.250.70:10443/broadcast(	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.msn.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
91.92.250.70	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://91.92.250.70:10443/b	sihost.exe, 00000014.00000003.4343208696.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4543176264.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4219916450.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4127862749.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435523241.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435239207.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4220116820.0000014316088000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://91.92.250.70:10443/broadcastM	sihost.exe, 00000015.00000003.4355457234.00000208217BA000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4555511112.00000208217BD000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4463495917.00000208217BA000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4663130336.00000208217BD000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4555696679.00000208217BD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.qt.io/licensing/	Advanced_IP_Scanner.tmp, 0000000A.00000003.2286560487.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, Advanced_IP_Scanner.tmp, 0000000D.00000003.2550554167.0000000003A64000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.radmin.com/about/legal/pp.php).	Advanced_IP_Scanner.tmp, 0000000D.00000003.2550554167.0000000003A64000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://91.92.250.70:10443/broadcast32	sihost.exe, 00000014.00000003.4343208696.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3803856721.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4543176264.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3711474066.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4219916450.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4127862749.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3927157672.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4019404037.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435523241.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435239207.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3812370712.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4635863611.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4019548626.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4220116820.0000014316088000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://91.92.250.70:10443/broadcastE	sihost.exe, 00000014.00000003.4219916450.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4127862749.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4220116820.0000014316088000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com	sihost.exe, 00000015.00000003.4463495917.00000208217D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://91.92.250.70:10443/broadcastCryptography	sihost.exe, 00000015.00000003.4663130336.00000208217E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	Advanced_IP_Scanner.exe, 00000006.00000000.2234411898.0000000000401000.00000020.00000001.01000000.00000004.sdmp, cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
https://91.92.250.70/zQ	sihost.exe, 00000014.00000003.4343208696.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3927157672.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4019404037.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3576661158.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4635660696.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4219916450.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3803856721.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3165602891.0000014316063000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4127862749.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3576433373.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3711474066.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3484621861.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4543176264.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3281435880.0000014316063000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3376909861.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3376744458.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435239207.0000014316066000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.advanced-ip-scanner.com/link.php?lng=ro&1	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
https://www.amazon.comm	sihost.exe, 00000015.00000003.4355457234.00000208217BA000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4463495917.00000208217BA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.radmin.com/support/feedback/php.	Advanced_IP_Scanner.tmp, 0000000D.00000003.2550554167.0000000003A64000.00000004.00000020.00020000.00000000.sdmp, Advanced_IP_Scanner.tmp, 0000000D.00000003.2548775849.0000000000878000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.advanced-ip-scanner.com/link.php?lng=cz&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
https://91.92.250.70:10443/broadcastC	sihost.exe, 00000014.00000003.4543176264.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3927157672.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3376744458.0000014316084000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4019404037.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4635863611.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4019548626.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3376909861.0000014316086000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3281435880.0000014316084000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.advanced-ip-scanner.com/link.php?lng=ro&1042	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
https://91.92.250.70:10443/broadcastVj	sihost.exe, 00000014.00000003.3281533543.0000014316053000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://91.92.250.70/i	sihost.exe, 00000015.00000003.4355324832.00000208217CB000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4555511112.00000208217BD000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4463495917.00000208217BA000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4663130336.00000208217BD000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4555696679.00000208217BD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://91.92.250.70:10443/broadcastCryptography%	sihost.exe, 00000014.00000003.4343208696.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4543176264.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435523241.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435239207.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4635863611.0000014316088000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://91.92.250.70/n	sihost.exe, 00000014.00000003.4343208696.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4543176264.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435523241.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435239207.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4635863611.0000014316088000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.advanced-ip-scanner.com/link.php?lng=nl&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.advanced-ip-scanner.com/link.php?lng=sk&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.advanced-ip-scanner.com/link.php?lng=sl&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
https://91.92.250.70:10443/~	sihost.exe, 00000014.00000003.4343208696.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4543176264.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435523241.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435239207.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4635863611.0000014316088000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://support.radmin.com.#	Advanced_IP_Scanner.tmp, 0000000A.00000003.2286560487.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.advanced-ip-scanner.com/link.php?lng=uk&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.radmin.com/about/legal/pp.php	Advanced_IP_Scanner.tmp, 0000000A.00000003.2286560487.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.advanced-ip-scanner.com/link.php?lng=hu&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.advanced-ip-scanner.com/link.php?lng=it&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.advanced-ip-scanner.com/link.php?lng=et&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.openssl.org/	Advanced_IP_Scanner.tmp, 0000000A.00000003.2286560487.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, Advanced_IP_Scanner.tmp, 0000000D.00000003.2550554167.0000000003A94000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.advanced-ip-scanner.com/link.php?lng=th&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.palkornel.hu/innosetup%1	Advanced_IP_Scanner.exe, 00000008.00000003.2261826650.00000000022C6000.00000004.00001000.00020000.00000000.sdmp, Advanced_IP_Scanner.tmp, 00000009.00000003.2287543092.000000000338D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://91.92.250.70/.Q	sihost.exe, 00000014.00000003.4343208696.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3927157672.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4019404037.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3576661158.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4635660696.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4219916450.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3803856721.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3165602891.0000014316063000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4127862749.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3576433373.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3711474066.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3484621861.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4543176264.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3281435880.0000014316063000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3376909861.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3376744458.0000014316066000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435239207.0000014316066000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.advanced-ip-scanner.com/link.php?lng=jp&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
https://91.92.250.70:10443/broadcastT	sihost.exe, 00000014.00000003.4543176264.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4635863611.0000014316088000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.advanced-ip-scanner.com/link.php?lng=es&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://support.radmin.com	Advanced_IP_Scanner.tmp, 0000000A.00000003.2286560487.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.advanced-ip-scanner.com/link.php?lng=fr&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.advanced-ip-scanner.com/link.php?lng=gr&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.advanced-ip-scanner.com/link.php?lng=pl&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.innosetup.com/	Advanced_IP_Scanner.exe, 00000006.00000003.2249692168.00000000023A0000.00000004.00001000.00020000.00000000.sdmp, Advanced_IP_Scanner.exe, 00000006.00000003.2257922336.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp, Advanced_IP_Scanner.tmp, 0000000A.00000000.2277316777.0000000000415000.00000020.00000001.01000000.00000006.sdmp, Advanced_IP_Scanner.tmp.40.dr, Advanced_IP_Scanner.tmp.6.dr	false		high
http://www.advanced-ip-scanner.com/link.php?lng=hr&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.advanced-ip-scanner.com/link.php?lng=bg&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.advanced-ip-scanner.com/link.php?lng=br&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.advanced-ip-scanner.com/link.php?lng=en&ver=2-5-4594&beta=n&page=helpREINSTALLMODEamusINS	Advanced_IP_Scanner.exe.4.dr	false		high
http://www.advanced-ip-scanner.com/link.php?lng=ir&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.advanced-ip-scanner.com/link.php?lng=se&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.advanced-ip-scanner.com/link.php?lng=kr&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.advanced-ip-scanner.com/link.php?lng=he&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
https://91.92.250.70:10443/&	sihost.exe, 00000014.00000003.4343208696.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3803856721.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4543176264.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3711474066.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4219916450.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4127862749.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3927157672.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4019404037.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435523241.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435239207.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3812370712.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4635863611.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4019548626.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4220116820.0000014316088000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://support.radmin.comk0T0#	Advanced_IP_Scanner.tmp, 0000000A.00000003.2286560487.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.30.dr	false		high
http://www.advanced-ip-scanner.com/link.php?lng=fi&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.radmin.com/support/feedback/php	Advanced_IP_Scanner.tmp, 0000000A.00000003.2286560487.00000000031A0000.00000004.00001000.00020000.00000000.sdmp, Advanced_IP_Scanner.tmp, 0000000D.00000003.2548775849.0000000000878000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.advanced-ip-scanner.com/link.php?lng=cn&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.advanced-ip-scanner.com/link.php?lng=vn&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
https://91.92.250.70/	sihost.exe, 00000014.00000003.4343208696.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3803856721.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4543176264.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3711474066.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3576433373.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4219916450.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4127862749.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3927157672.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3376744458.0000014316084000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3281533543.0000014316033000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4019404037.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435523241.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435239207.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3812370712.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3484621861.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4635863611.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4019548626.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4220116820.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3376909861.0000014316086000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3281435880.0000014316084000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3576779331.0000014316088000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.advanced-ip-scanner.com/link.php?lng=lt&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://schemas.micr	explorer.exe, 0000001C.00000003.2850336534.00000000091C1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://support.radmin.com.	Advanced_IP_Scanner.tmp, 0000000A.00000003.2286560487.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.advanced-ip-scanner.com/link.php?lng=tr&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.advanced-ip-scanner.com/link.php?lng=sr&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.advanced-ip-scanner.com/link.php?lng=lv&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.advanced-ip-scanner.com/link.php?lng=sa&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
https://91.92.250.70:10443/	sihost.exe, 00000014.00000003.4220116820.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3281435880.0000014316084000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3576779331.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4463603936.00000208217F0000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4663130336.00000208217F0000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4555511112.00000208217F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://91.92.250.70:10443/broadcast-	sihost.exe, 00000014.00000003.3803856721.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3711474066.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3812370712.0000014316088000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.advanced-ip-scanner.com0	Advanced_IP_Scanner.tmp, 0000000A.00000002.4924239494.000000000018F000.00000004.00000010.00020000.00000000.sdmp, cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr, aips_is_install_dll.dll.13.dr, aips_is_install_dll.dll.10.dr	false	Avira URL Cloud: safe	unknown
http://support.radmin.com.#:Finished_MsiErrorFromResource	Advanced_IP_Scanner.tmp, 0000000A.00000003.2286560487.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.advanced-ip-scanner.com/link.php?lng=ru&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
https://91.92.250.70/ows	sihost.exe, 00000014.00000003.3281533543.0000014316033000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://91.92.250.70/ptography	sihost.exe, 00000014.00000003.3281533543.0000014316053000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://91.92.250.70:10443/broadcast3	sihost.exe, 00000015.00000003.4355457234.00000208217BA000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4555511112.00000208217BD000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4463495917.00000208217BA000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4663130336.00000208217BD000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000015.00000003.4555696679.00000208217BD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://91.92.250.70:10443/broadcastfj	sihost.exe, 00000014.00000003.3281533543.0000014316053000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.advanced-ip-scanner.com/link.php?lng=da&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
https://91.92.250.70:10443/broadcast&	sihost.exe, 00000014.00000003.4343208696.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4219916450.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4127862749.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435523241.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4435239207.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4220116820.0000014316088000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.advanced-ip-scanner.com/link.php?lng=nb&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
https://91.92.250.70:10443/broadcast(	sihost.exe, 00000014.00000003.3576433373.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4219916450.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4127862749.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3376744458.0000014316084000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3484621861.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.4220116820.0000014316088000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3376909861.0000014316086000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3281435880.0000014316084000.00000004.00000020.00020000.00000000.sdmp, sihost.exe, 00000014.00000003.3576779331.0000014316088000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://91.92.250.70:10443/broadcast	sihost.exe, 00000015.00000003.4555696679.00000208217BD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.advanced-ip-scanner.com/link.php?lng=de&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.advanced-ip-scanner.com/link.php?lng=id&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.openssl.org/)	Advanced_IP_Scanner.tmp, 0000000D.00000003.2550554167.0000000003A64000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.remobjects.com/ps	Advanced_IP_Scanner.exe, 00000006.00000003.2249692168.00000000023A0000.00000004.00001000.00020000.00000000.sdmp, Advanced_IP_Scanner.exe, 00000006.00000003.2257922336.000000007FCC0000.00000004.00001000.00020000.00000000.sdmp, Advanced_IP_Scanner.tmp, 0000000A.00000000.2277316777.0000000000415000.00000020.00000001.01000000.00000006.sdmp, Advanced_IP_Scanner.tmp.40.dr, Advanced_IP_Scanner.tmp.6.dr	false		high
http://www.advanced-ip-scanner.com/link.php?lng=tw&ver=2-5-4594&beta=n&page=helpProductCode	cobaltstrike.dll, Advanced_IP_Scanner.exe.4.dr	false		high
http://www.radmin.com/support/feedba	Advanced_IP_Scanner.exe, 00000006.00000003.2237175552.00000000023A0000.00000004.00001000.00020000.00000000.sdmp, Advanced_IP_Scanner.exe, 00000008.00000003.2261826650.00000000022C6000.00000004.00001000.00020000.00000000.sdmp, Advanced_IP_Scanner.tmp, 00000009.00000003.2287543092.000000000338D000.00000004.00001000.00020000.00000000.sdmp, Advanced_IP_Scanner.tmp, 0000000A.00000003.2286560487.00000000031A0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org	Advanced_IP_Scanner.tmp, 0000000D.00000003.2550554167.0000000003A94000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
91.92.250.70	unknown	Bulgaria		34368	THEZONEBG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1555135
Start date and time:	2024-11-13 14:22:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	cobaltstrike.dll (renamed file extension from exe to dll)
Original Sample Name:	cobaltstrike.exe
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@94/22@1/1
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe, SearchApp.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212, 204.79.197.203
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, a-0003.a-msedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, api-msn-com.a-0003.a-msedge.net
Execution Graph export aborted for target Advanced_IP_Scanner.tmp, PID 2100 because there are no executed function
Execution Graph export aborted for target sihost.exe, PID 1340 because there are no executed function
Execution Graph export aborted for target sihost.exe, PID 516 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: cobaltstrike.dll

Simulations

Behavior and APIs

Time	Type	Description
08:24:12	API Interceptor	14x Sleep call for process: explorer.exe modified
08:24:28	API Interceptor	1x Sleep call for process: WerFault.exe modified
08:24:54	API Interceptor	7x Sleep call for process: sihost.exe modified
14:24:12	Task Scheduler	Run new task: CreateExplorerShellUnelevatedTask path: C:\Windows\explorer.exe s>/NoUACCheck

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
THEZONEBG	sample.bin	Get hash	malicious	Okiru	Browse	91.92.246.113
	mirai.mpsl.elf	Get hash	malicious	Mirai	Browse	85.217.215.190
	SecuriteInfo.com.Win32.BotX-gen.7614.10551.exe	Get hash	malicious	Unknown	Browse	91.92.242.236
	Scan_Revised-SOP_MCA_pdf.js	Get hash	malicious	WSHRAT	Browse	91.92.243.39
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	85.217.208.78
	m7DmyQOKD7.exe	Get hash	malicious	RHADAMANTHYS	Browse	91.92.255.109
	mipsel.nn.elf	Get hash	malicious	Okiru	Browse	91.92.246.113
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	91.92.246.113
	x86_32.nn.elf	Get hash	malicious	Okiru	Browse	91.92.246.113
	x86_64.nn.elf	Get hash	malicious	Okiru	Browse	91.92.246.113

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Downloads\Advanced_IP_Scanner.exe	https://download.advanced-ip-scanner.com/download/files/Advanced_IP_Scanner_2.5.4594.1.exe	Get hash	malicious	Unknown	Browse
	Advanced_IP_Scanner_2.5.4594.1 (1).exe	Get hash	malicious	Unknown	Browse
	ipscan.msi	Get hash	malicious	Darkgate	Browse
	Advanced_IP_Scanner.exe	Get hash	malicious	DanaBot	Browse
	Advanced_IP_Scanner.exe	Get hash	malicious	DanaBot	Browse
	IPAVSCAN_win_version_1.1.3.msi	Get hash	malicious	Unknown	Browse
	Advanced_IP_Scanner_2.5.4594.1_net.exe	Get hash	malicious	Unknown	Browse
	Advanced_IP_Scanner_2.5.4594.1_net.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_sihost.exe_4f573731dbe296f8a4bb927c82d7ce365249268_b82a91b5_74dbb513-3e1b-4626-8bb4-28c5093fd0a2\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8069608834375795
Encrypted:	false
SSDEEP:	96:KOFH7TkXsf43o67JfWQXIDcQ9c6Q+cE2cw3/kd+HbHgrZJJORXkomHBhsv5oOy9h:dF7TkXn0z8+Mbj7YzuiFdZ24lO8A
MD5:	D4FD5A46A9B50FA1AF87DD1F77192EDA
SHA1:	C84AF403F188A09541871CABE96A2603AF6F8831
SHA-256:	163A08509A944C0CA8A81B6E9ECEB932BCAFAF76FE57F25BFDEE21872BD56377
SHA-512:	C5550EEFCFDF855E90FAA25F3C2B4EAE105FCAA2FBC84DF64BC5C8E4CD61DABDA0E5F6E8C2F0BFB241F2CB405E0B1737C5780A60CAC96FC8886870AD16917335
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.5.9.7.7.8.5.2.2.6.6.5.1.4.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.5.9.7.7.8.5.5.9.5.4.0.3.6.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.4.d.b.b.5.1.3.-.3.e.1.b.-.4.6.2.6.-.8.b.b.4.-.2.8.c.5.0.9.3.f.d.0.a.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.6.0.a.c.6.7.4.-.a.2.7.1.-.4.8.9.d.-.a.b.d.0.-.2.0.6.8.7.6.c.a.8.5.e.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.s.i.h.o.s.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.s.i.h.o.s.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.3.c.-.0.0.0.1.-.0.0.1.5.-.9.a.f.1.-.9.7.4.8.c.f.3.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.5.3.1.0.b.a.1.4.a.0.5.2.5.6.e.4.d.9.3.e.0.b.0.4.3.3.8.f.5.3.b.4.e.1.d.6.8.0.c.b.!.s.i.h.o.s.t...e.x.e.....T.a.r.g.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE815.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Nov 13 13:24:12 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	108356
Entropy (8bit):	1.6415575688666364
Encrypted:	false
SSDEEP:	384:0qEsocxvOfl5MEeY44SHtG5Ixla+uSePU2daL55hB:8socxWyrrwo1B
MD5:	8908A46AD58B4712E7A18AB7F5503B85
SHA1:	A825DE910FF2597A565F0DD3BD11C31CA798C612
SHA-256:	99A0D90CD0D2D023AF897E4D12AB3304CBC795558670360BF1E8DF75CC823DCE
SHA-512:	79AC7E977CDB7EAD72A05DF0ACE11776E87E22681D522D00714B453F01AFDD8E1EA1DC617E0ADD01C0CB31CEEC424D13E6D5EB1FEC789B4AC187268B8449B6B5
Malicious:	false
Preview:	MDMP..a..... .......\|.4g............$...............,............;..........T.......8...........T.......................................................................................................................eJ..............Lw......................T.......<...h.4g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9BC.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8578
Entropy (8bit):	3.698100009074635
Encrypted:	false
SSDEEP:	192:R6l7wVeJtAqL6YLN3IgmfdIw9S6pDRN89b7j+f7Jm:R6lXJqQ6YhYgmfd/c8q7af4
MD5:	34E5862987A26BF76A3F34137F4680DE
SHA1:	1B0F6C5FB55C9B1AC275D063E48F77A9062B3968
SHA-256:	8034C46BA0D405E40057AFCE4EE9DFE2088D29CD7665588175FBE0E2CC17BA5E
SHA-512:	F6EEC9E14C09E46AD84A84DBD62828F223BF18F37F194DE097D4072A04B88971ED6043E464FD4D6393B8B2355A591FAD79A70E3D050D6EF21DCE1B66CF279ECE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.3.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA1B.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4740
Entropy (8bit):	4.48120556226066
Encrypted:	false
SSDEEP:	48:cvIwWl8zseJg771I9P0WpW8VYyYm8M4JdXOKFj1tyq85lxOd1nas2d:uIjfUI78t7VqJlnbQA1n92d
MD5:	397CCFB3B4EA562407F483ECE7C86FD4
SHA1:	102466FEBFD18453250E80F3B77EA470489F287B
SHA-256:	9FD6A4BE63F124E3CCBFB65765FFC47702F69639A6031DA609956B3E76ACA684
SHA-512:	70CF376DA06EFACA50A395E0C3AD27D04FE5860EF6462087E91DF344D2F433890A686341E7E3CC5AEC596B797BF8F13D4DA375969FADA1CCF5B4F6AA5399621B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="586346" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\Public\Downloads\Advanced_IP_Scanner.exe

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21050672
Entropy (8bit):	7.991846277981261
Encrypted:	true
SSDEEP:	393216:Plu7Txs0NDmNh9D4HaSYz2Kj0Cz1gEVmWdQOjM/y3tFfs5IRRViGmMQZ+Bw5i:A7Th9mT97S7CzNwWCJK05IRTX+Fi
MD5:	5537C708EDB9A2C21F88E34E8A0F1744
SHA1:	86233A285363C2A6863BF642DEAB7E20F062B8EB
SHA-256:	26D5748FFE6BD95E3FEE6CE184D388A1A681006DC23A0F08D53C083C593C193B
SHA-512:	35F44C0DF4635A1020F52743D7CF3E4346D1BDF9010161326E572250AC93E0285B202532A07D2DB8DBC67F6F0CED864083769E904BD5D82611244339CA8D31A1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: Advanced_IP_Scanner_2.5.4594.1 (1).exe, Detection: malicious, Browse Filename: ipscan.msi, Detection: malicious, Browse Filename: Advanced_IP_Scanner.exe, Detection: malicious, Browse Filename: Advanced_IP_Scanner.exe, Detection: malicious, Browse Filename: IPAVSCAN_win_version_1.1.3.msi, Detection: malicious, Browse Filename: Advanced_IP_Scanner_2.5.4594.1_net.exe, Detection: malicious, Browse Filename: Advanced_IP_Scanner_2.5.4594.1_net.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....,.Q..................... ............... ....@..................................9A..........@....................................................A.(............................................................................................text...,........................... ..`.itext..D........................... ..`.data........ ......................@....bss.....V...0...........................idata..............................@....tls.....................................rdata..............................@..@.rsrc................ ..............@..@.............p......................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001d.db

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	107504
Entropy (8bit):	3.99886998801198
Encrypted:	false
SSDEEP:	768:cY18vKkRGbgCMzjk0Yc/ImXkrgQNKLlFRjwHGpPhYDR1vI3XQ1/mOypZr3E5UhyD:cHKk2gB/ImXkEqLUh2i4GGndrFkEKtJ8
MD5:	AA5AF62540E19BB6B59DD7C9AAA52EC9
SHA1:	7BE4CFB705EEC4418504782DF7E9BA70DE953B8C
SHA-256:	E743A9726991FDF4108EAEAFE8B2CD30CB4AF54D22203652708ED5E6F88D40A1
SHA-512:	FA12F4F0CDE2AFCB23BB70B7A3EE09D696D2904E8BE499E75FA6C04105F4A0EDF8ED41B242CB5631B49E34FF58272E656B9A992B488CDD97BF08436710C0D4E7
Malicious:	false
Preview:	....h... ..............P...............X.......]...P..................V.......e.n.-.C.H.;.e.n.-.G.B...............p..............P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....Z.1...........user..B............................................e.n.g.i.n.e.e.r.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....Z.1...........user..B.........................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\Windows[2].json

Download File

Process:	C:\Windows\explorer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	5.142156644904079
Encrypted:	false
SSDEEP:	12:YWgc2Wi4H+uibfy22KmwhbfH+2yrZMAdrKC8K/y8kEhq1HLxycXNNZ/TCB8Qxc3Z:Yzc2WfHRt2hDHt0drc6hE10g
MD5:	F1102100129EFA4A08486602CDB2CF20
SHA1:	F18E844B09DF38B4873DFC38434CCC4385637839
SHA-256:	D03D6651D6988162013EA0B83D37393CAE1F85DFC44A3B6CA3F84EC30AC71B23
SHA-512:	D88ACF84CD09DF9D6E6F203641ED4F6971D2D9E31DD90FFB9E507216B7BAB4BCA99C4BFF7044400B09D21504F4C79121164964720B7B16752B2136128DAD04CD
Malicious:	false
Preview:	{"serviceContext":{"serviceActivityId":"e3047d3b-ddec-4932-a678-56546160ad2d","responseCreationDateTime":"0001-01-01T00:00:00","debugId":"e3047d3b-ddec-4932-a678-56546160ad2d\|2024-11-13T13:24:38.2294730Z\|fabric_msn\|EUS2-A\|News_870","tier":"\u0000"},"expirationDateTime":"0001-01-01T00:00:00","showBadge":false,"settings":{"refreshIntervalMinutes":0,"feedEnabled":true,"evolvedNotificationLifecycleEnabled":false,"showBadgeOnRotationsForEvolvedNotificationLifecycle":false,"webView2Enabled":false,"webView2EnabledV1":false,"windowsSuppressClientRace":false,"flyoutV2EndpointEnabled":false,"showAnimation":false,"useTallerFlyoutSize":false,"useDynamicHeight":false,"useWiderFlyoutSize":false,"reclaimEnabled":false,"isPreviewDurationsEnabled":false,"1SlockscreenContentEnabled":true},"isPartial":false}

C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp

Download File

Process:	C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1190912
Entropy (8bit):	6.396170525244629
Encrypted:	false
SSDEEP:	24576:Z4VN4kkKF3hDXq8xeidJLvkU99kkkkJE58dlX3IiAtp3Nq3E/HoQYx96BxYx9v1:iT90guMXEdqwHkUBK3
MD5:	B87639F9A6CF5BA8C9E1F297C5745A67
SHA1:	CE4758849B53AF582D2D8A1BC0DB20683E139FCC
SHA-256:	EC8252A333F68865160E26DC95607F2C49AF00F78C657F7F8417AB9D86E90BF7
SHA-512:	9626FC4AA4604EEE7EDEDA62B9DC78A3F6FE388EAF1FA6C916A3715B0DFF65C417EEDE156D82398C2400977A36457122565E15E0ED0E435B28CB9F796005C1C0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....,.Q.....................P....................@..............................................@...............................7......\|...........................................................................t................................text...t........................... ..`.itext.. ........................... ..`.data...00.......2..................@....bss.....a...@...........................idata...7.......8..................@....tls....<............F...................rdata...............F..............@..@.rsrc...\|............H..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-2FLEP.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.289297026665552
Encrypted:	false
SSDEEP:	48:Sv1LfWvPcXegCPUo1vlZQrAxoONfHFZONfH3d1xCWMBFNL2pGSS4k+bkg6j0KHc:wfkcXegaJ/ZAYNzcld1xaX12pfSKvkc
MD5:	C8871EFD8AF2CF4D9D42D1FF8FADBF89
SHA1:	D0EACD5322C036554D509C7566F0BCC7607209BD
SHA-256:	E4FC574A01B272C2D0AED0EC813F6D75212E2A15A5F5C417129DD65D69768F40
SHA-512:	2735BB610060F749E26ACD86F2DF2B8A05F2BDD3DCCF3E4B2946EBB21BA0805FB492C474B1EEB2C5B8BF1A421F7C1B8728245F649C644F4A9ECC5BD8770A16F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....HP..........#............................@.............................`..............................................................<!.......P.......@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-2FLEP.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-2FLEP.tmp\aips_is_install_dll.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	152616
Entropy (8bit):	6.538512364495765
Encrypted:	false
SSDEEP:	3072:RMmLlzH5vVOS6vHZM+70gxvlou/xq+1f2auYpLAbPTxTTtFBImEQ3F65D:dZ/OSO7gK5q+N2ahjOF65D
MD5:	57E73855FAD786A59893D6581E9FB5B9
SHA1:	630E52B9E88A05ADD68401BD62790ED8E2C3282A
SHA-256:	3A7A8AA906C65124C4EE82AACB81D723CE69864CCAF041F631B8131DE59E4A88
SHA-512:	BE0CF0925535DD667488175F2EAC660D1EBF8429CE6725252C59FB70B00FC2F21B1E0B7CE632EAA53337AE25E44C641E13A3DF0B415724498D30DAF00B296F4D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W..j9..j9..j9...:..j9...<.^j9...=..j9...=..j9...:..j9...8..j9..j8._j9...<..j9.j.:..j9.j.<..j9.j.9..j9.j...j9.j.;..j9.Rich.j9.........PE..L....gb.........."!................OD.......................................p......fk....@..........................................@...............8..(....P......L...T...............................@............................................text............................... ..`.rdata.............................@..@.data........ ......................@....rsrc........@......................@..@.reloc.......P......."..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-BT8N1.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.289297026665552
Encrypted:	false
SSDEEP:	48:Sv1LfWvPcXegCPUo1vlZQrAxoONfHFZONfH3d1xCWMBFNL2pGSS4k+bkg6j0KHc:wfkcXegaJ/ZAYNzcld1xaX12pfSKvkc
MD5:	C8871EFD8AF2CF4D9D42D1FF8FADBF89
SHA1:	D0EACD5322C036554D509C7566F0BCC7607209BD
SHA-256:	E4FC574A01B272C2D0AED0EC813F6D75212E2A15A5F5C417129DD65D69768F40
SHA-512:	2735BB610060F749E26ACD86F2DF2B8A05F2BDD3DCCF3E4B2946EBB21BA0805FB492C474B1EEB2C5B8BF1A421F7C1B8728245F649C644F4A9ECC5BD8770A16F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....HP..........#............................@.............................`..............................................................<!.......P.......@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-BT8N1.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-BT8N1.tmp\aips_is_install_dll.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	152616
Entropy (8bit):	6.538512364495765
Encrypted:	false
SSDEEP:	3072:RMmLlzH5vVOS6vHZM+70gxvlou/xq+1f2auYpLAbPTxTTtFBImEQ3F65D:dZ/OSO7gK5q+N2ahjOF65D
MD5:	57E73855FAD786A59893D6581E9FB5B9
SHA1:	630E52B9E88A05ADD68401BD62790ED8E2C3282A
SHA-256:	3A7A8AA906C65124C4EE82AACB81D723CE69864CCAF041F631B8131DE59E4A88
SHA-512:	BE0CF0925535DD667488175F2EAC660D1EBF8429CE6725252C59FB70B00FC2F21B1E0B7CE632EAA53337AE25E44C641E13A3DF0B415724498D30DAF00B296F4D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W..j9..j9..j9...:..j9...<.^j9...=..j9...=..j9...:..j9...8..j9..j8._j9...<..j9.j.:..j9.j.<..j9.j.9..j9.j...j9.j.;..j9.Rich.j9.........PE..L....gb.........."!................OD.......................................p......fk....@..........................................@...............8..(....P......L...T...............................@............................................text............................... ..`.rdata.............................@..@.data........ ......................@....rsrc........@......................@..@.reloc.......P......."..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp

Download File

Process:	C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1190912
Entropy (8bit):	6.396170525244629
Encrypted:	false
SSDEEP:	24576:Z4VN4kkKF3hDXq8xeidJLvkU99kkkkJE58dlX3IiAtp3Nq3E/HoQYx96BxYx9v1:iT90guMXEdqwHkUBK3
MD5:	B87639F9A6CF5BA8C9E1F297C5745A67
SHA1:	CE4758849B53AF582D2D8A1BC0DB20683E139FCC
SHA-256:	EC8252A333F68865160E26DC95607F2C49AF00F78C657F7F8417AB9D86E90BF7
SHA-512:	9626FC4AA4604EEE7EDEDA62B9DC78A3F6FE388EAF1FA6C916A3715B0DFF65C417EEDE156D82398C2400977A36457122565E15E0ED0E435B28CB9F796005C1C0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....,.Q.....................P....................@..............................................@...............................7......\|...........................................................................t................................text...t........................... ..`.itext.. ........................... ..`.data...00.......2..................@....bss.....a...@...........................idata...7.......8..................@....tls....<............F...................rdata...............F..............@..@.rsrc...\|............H..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-FDD04.tmp\Advanced_IP_Scanner.tmp

Download File

Process:	C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1190912
Entropy (8bit):	6.396170525244629
Encrypted:	false
SSDEEP:	24576:Z4VN4kkKF3hDXq8xeidJLvkU99kkkkJE58dlX3IiAtp3Nq3E/HoQYx96BxYx9v1:iT90guMXEdqwHkUBK3
MD5:	B87639F9A6CF5BA8C9E1F297C5745A67
SHA1:	CE4758849B53AF582D2D8A1BC0DB20683E139FCC
SHA-256:	EC8252A333F68865160E26DC95607F2C49AF00F78C657F7F8417AB9D86E90BF7
SHA-512:	9626FC4AA4604EEE7EDEDA62B9DC78A3F6FE388EAF1FA6C916A3715B0DFF65C417EEDE156D82398C2400977A36457122565E15E0ED0E435B28CB9F796005C1C0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....,.Q.....................P....................@..............................................@...............................7......\|...........................................................................t................................text...t........................... ..`.itext.. ........................... ..`.data...00.......2..................@....bss.....a...@...........................idata...7.......8..................@....tls....<............F...................rdata...............F..............@..@.rsrc...\|............H..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp

Download File

Process:	C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1190912
Entropy (8bit):	6.396170525244629
Encrypted:	false
SSDEEP:	24576:Z4VN4kkKF3hDXq8xeidJLvkU99kkkkJE58dlX3IiAtp3Nq3E/HoQYx96BxYx9v1:iT90guMXEdqwHkUBK3
MD5:	B87639F9A6CF5BA8C9E1F297C5745A67
SHA1:	CE4758849B53AF582D2D8A1BC0DB20683E139FCC
SHA-256:	EC8252A333F68865160E26DC95607F2C49AF00F78C657F7F8417AB9D86E90BF7
SHA-512:	9626FC4AA4604EEE7EDEDA62B9DC78A3F6FE388EAF1FA6C916A3715B0DFF65C417EEDE156D82398C2400977A36457122565E15E0ED0E435B28CB9F796005C1C0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....,.Q.....................P....................@..............................................@...............................7......\|...........................................................................t................................text...t........................... ..`.itext.. ........................... ..`.data...00.......2..................@....bss.....a...@...........................idata...7.......8..................@....tls....<............F...................rdata...............F..............@..@.rsrc...\|............H..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp

Download File

Process:	C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1190912
Entropy (8bit):	6.396170525244629
Encrypted:	false
SSDEEP:	24576:Z4VN4kkKF3hDXq8xeidJLvkU99kkkkJE58dlX3IiAtp3Nq3E/HoQYx96BxYx9v1:iT90guMXEdqwHkUBK3
MD5:	B87639F9A6CF5BA8C9E1F297C5745A67
SHA1:	CE4758849B53AF582D2D8A1BC0DB20683E139FCC
SHA-256:	EC8252A333F68865160E26DC95607F2C49AF00F78C657F7F8417AB9D86E90BF7
SHA-512:	9626FC4AA4604EEE7EDEDA62B9DC78A3F6FE388EAF1FA6C916A3715B0DFF65C417EEDE156D82398C2400977A36457122565E15E0ED0E435B28CB9F796005C1C0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....,.Q.....................P....................@..............................................@...............................7......\|...........................................................................t................................text...t........................... ..`.itext.. ........................... ..`.data...00.......2..................@....bss.....a...@...........................idata...7.......8..................@....tls....<............F...................rdata...............F..............@..@.rsrc...\|............H..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-STV6O.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.289297026665552
Encrypted:	false
SSDEEP:	48:Sv1LfWvPcXegCPUo1vlZQrAxoONfHFZONfH3d1xCWMBFNL2pGSS4k+bkg6j0KHc:wfkcXegaJ/ZAYNzcld1xaX12pfSKvkc
MD5:	C8871EFD8AF2CF4D9D42D1FF8FADBF89
SHA1:	D0EACD5322C036554D509C7566F0BCC7607209BD
SHA-256:	E4FC574A01B272C2D0AED0EC813F6D75212E2A15A5F5C417129DD65D69768F40
SHA-512:	2735BB610060F749E26ACD86F2DF2B8A05F2BDD3DCCF3E4B2946EBB21BA0805FB492C474B1EEB2C5B8BF1A421F7C1B8728245F649C644F4A9ECC5BD8770A16F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....HP..........#............................@.............................`..............................................................<!.......P.......@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-STV6O.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-STV6O.tmp\aips_is_install_dll.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	152616
Entropy (8bit):	6.538512364495765
Encrypted:	false
SSDEEP:	3072:RMmLlzH5vVOS6vHZM+70gxvlou/xq+1f2auYpLAbPTxTTtFBImEQ3F65D:dZ/OSO7gK5q+N2ahjOF65D
MD5:	57E73855FAD786A59893D6581E9FB5B9
SHA1:	630E52B9E88A05ADD68401BD62790ED8E2C3282A
SHA-256:	3A7A8AA906C65124C4EE82AACB81D723CE69864CCAF041F631B8131DE59E4A88
SHA-512:	BE0CF0925535DD667488175F2EAC660D1EBF8429CE6725252C59FB70B00FC2F21B1E0B7CE632EAA53337AE25E44C641E13A3DF0B415724498D30DAF00B296F4D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W..j9..j9..j9...:..j9...<.^j9...=..j9...=..j9...:..j9...8..j9..j8._j9...<..j9.j.:..j9.j.<..j9.j.9..j9.j...j9.j.;..j9.Rich.j9.........PE..L....gb.........."!................OD.......................................p......fk....@..........................................@...............8..(....P......L...T...............................@............................................text............................... ..`.rdata.............................@..@.data........ ......................@....rsrc........@......................@..@.reloc.......P......."..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.469461825898498
Encrypted:	false
SSDEEP:	6144:4zZfpi6ceLPx9skLmb0fYZWSP3aJG8nAgeiJRMMhA2zX4WABluuN+jDH5S:uZHtYZWOKnMM6bFpQj4
MD5:	CA44EBCBFD7169517D5E91E2E29BAA62
SHA1:	0D34C46072F2B6001B3C457AA08426D49FF08E24
SHA-256:	26C1B9ED01107723C9AA798CC518A165989252517ABEE56E9C7428E101A628C0
SHA-512:	816E8B8F20794CFD29E8C543FAFE60E8982671A5E4084CF2EA2D249B5770F9552739158340D845077FCC461A2E21F22D964A1FB425F0D325D8CAFDA220B158A2
Malicious:	false
Preview:	regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.f.S.5..............................................................................................................................................................................................................................................................................................................................................g9.g........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.9758659344398435
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	cobaltstrike.dll
File size:	22'275'072 bytes
MD5:	943afff642b01160380eaae87a33da07
SHA1:	67f575725d10dae057a35aa15691278a2245e158
SHA256:	6e5887670a74b010bff1c5bc11e936b392a12ed48a6afd796bd712c2594d423b
SHA512:	aca40924bc686dbad3d7a517db2672d79ea6b8cbe596c3b68456f392da0ef2d79a9741943cd8560174d56786e08549389474e1084440208fb19c9114498020c8
SSDEEP:	393216:2lu7Txs0NDmNh9D4HaSYz2Kj0Cz1gEVmWdQOjM/y3tFfs5IRRViGmMQZ+Bw5X:17Th9mT97S7CzNwWCJK05IRTX+F
TLSH:	A8272357E3A745B8E92FC03885A253736D30FC186164A91BAEA4F73D5F31E608B7A710
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Mf..........."...'.x....S..4.. .........................................T......sT...`... ............................

File Icon


Icon Hash:	0f00cc0ce41c020f

Static PE Info

General

Entrypoint:	0x2c1a61320
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x2c1a60000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x664DDFBF [Wed May 22 12:06:23 2024 UTC]
TLS Callbacks:	0xc1a8dcb0, 0x2, 0xc1a8dc80, 0x2
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	66f165513bf4c762ca78ccbfc28d421c

Entrypoint Preview

Instruction
dec eax
mov eax, dword ptr [000BF399h]
mov dword ptr [eax], 00000000h
jmp 00007F6AAD128903h
nop word ptr [eax+eax+00000000h]
nop dword ptr [eax]
dec eax
mov edx, ecx
dec eax
lea ecx, dword ptr [000DACB6h]
jmp 00007F6AAD161ED6h
nop
dec eax
lea ecx, dword ptr [00000009h]
jmp 00007F6AAD128A49h
nop dword ptr [eax+00h]
ret
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
push edi
push esi
push ebx
dec eax
sub esp, 00000088h
movzx edi, word ptr [000B9C7Eh]
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov eax, dword ptr [eax+60h]
dec eax
mov eax, dword ptr [eax+18h]
dec eax
mov ebx, ecx
dec eax
mov esi, edx
inc ebp
mov eax, eax
mov dword ptr [esp+5Ch], 00000000h
dec eax
mov eax, dword ptr [eax+20h]
dec eax
mov ebp, dword ptr [eax]
dec esp
mov ebx, dword ptr [ebp-10h]
dec esp
lea edx, dword ptr [ebp-10h]
dec esp
cmp ebp, ebx
je 00007F6AAD128AAEh
nop dword ptr [eax+eax+00000000h]
dec ecx
mov eax, dword ptr [edx+60h]
dec eax
lea ecx, dword ptr [eax+02h]
movzx eax, word ptr [eax]
test ax, ax
je 00007F6AAD128A8Bh
mov edx, 00000E0Eh
nop dword ptr [eax]
inc ecx
mov ecx, edx
dec eax
add ecx, 02h
inc ecx
shl ecx, 06h
inc esp
add edx, ecx
add edx, eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xe0000	0x22ad	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe3000	0xf40	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe6000	0x145f7a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xc8000	0x8958	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1546000	0x1274	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xbf1e0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xe33cc	0x368	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb7720	0xb7800	58b35ef998cfa90c0fc766fba23e10c7	False	0.3363845367847411	data	6.166712974184871	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb9000	0x1f60	0x2000	edcc12984c895929f14198bd93258019	False	0.0328369140625	data	0.39802277592091506	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xbb000	0xcd10	0xce00	86fc2251be884b66ac3b3ac9ab852123	False	0.23627123786407767	dBase III DBT, version number 0, next free block index 9215, 1st item "\272x%.\034\246\264\306\350\335t\037K\275\213\212p>\265fH\003\366\016a5W\271\206\301\035\236\341\370\230\021i\331\216\224\233\036\207\351\316U(\337\214\241\211"	4.791271478015345	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0xc8000	0x8958	0x8a00	22661c30895210e432d20abf8e0d7937	False	0.5189934329710145	data	5.921771719594413	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.xdata	0xd1000	0xabdc	0xac00	ac243aef7bb33763b81c90762a3649c7	False	0.18863553779069767	data	4.888397067705152	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0xdc000	0x3220	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xe0000	0x22ad	0x2400	486a32d81290177a2d98353142b6337a	False	0.2888454861111111	data	5.138852363642815	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0xe3000	0xf40	0x1000	3dd14e1cd944d97179c8ebd57340db3e	False	0.31884765625	data	4.347738486161096	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0xe4000	0x58	0x200	68205043bda4f8d3836b7d93f0c36457	False	0.05859375	data	0.2586118414565796	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xe5000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xe6000	0x145f7a8	0x145f800	690b43e2f3fcab8ec3c85371e261936d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x1546000	0x1274	0x1400	946e8ce15271dcd569f538b1e6fe8ef7	False	0.3908203125	data	5.321623513003073	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xe6160	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2835 x 2835 px/m	English	United States	0.1894934333958724
RT_RCDATA	0xe7208	0x1413530	PE32 executable (GUI) Intel 80386, for MS Windows	English	United States	0.9022197723388672
RT_RCDATA	0x14fa738	0x17	ASCII text, with no line terminators	English	United States	1.3478260869565217
RT_RCDATA	0x14fa750	0x4b040	data	English	United States	1.0003287075609248
RT_GROUP_ICON	0x1545790	0x14	data	English	United States	1.1

Imports

DLL	Import
KERNEL32.dll	CloseHandle, CreateFileA, DeleteCriticalSection, EnterCriticalSection, FindResourceA, FreeResource, GetCommandLineA, GetLastError, GetModuleHandleW, GetProcAddress, GetProcessHeap, GetSystemTimeAsFileTime, GetThreadId, HeapAlloc, HeapFree, InitializeConditionVariable, InitializeCriticalSection, IsDBCSLeadByteEx, K32EnumProcessModules, K32GetModuleFileNameExA, LeaveCriticalSection, LoadLibraryW, LoadResource, LockResource, MultiByteToWideChar, RaiseException, RtlCaptureContext, RtlLookupFunctionEntry, RtlUnwindEx, RtlVirtualUnwind, SetLastError, SizeofResource, Sleep, SleepConditionVariableCS, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, TryEnterCriticalSection, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WakeAllConditionVariable, WakeConditionVariable, WideCharToMultiByte, WriteFile
msvcrt.dll	___lc_codepage_func, ___mb_cur_max_func, __iob_func, _amsg_exit, _errno, _initterm, _lock, _read, _strnicmp, _unlock, _wcsicmp, abort, calloc, fputc, fputs, fputwc, free, fwprintf, fwrite, getenv, iswctype, localeconv, malloc, mbstowcs, memchr, memcmp, memcpy, memmove, memset, rand, realloc, setlocale, strchr, strcmp, strcoll, strcpy, strerror, strftime, strlen, strncat, strncmp, strncpy, strtoul, strxfrm, towlower, towupper, vfprintf, wcscat, wcscoll, wcsftime, wcslen, wcsxfrm
ntdll.dll	RtlAllocateHeap, RtlCreateProcessParametersEx, RtlDestroyProcessParameters, RtlFreeHeap, RtlInitUnicodeString
SHELL32.dll	CommandLineToArgvW

Exports

Name	Ordinal	Address
CloseThreadWaitChainSession	94	0x2c1b405ee
GetThreadWaitChain	95	0x2c1b4062b
OpenThreadWaitChainSession	96	0x2c1b40656
RegisterWaitChainCOMCallback	97	0x2c1b40691
WerAddExcludedApplication	98	0x2c1b406d0
WerFreeString	99	0x2c1b40709
WerRemoveExcludedApplication	100	0x2c1b4072a
WerReportAddDump	101	0x2c1b40769
WerReportAddFile	102	0x2c1b40790
WerReportCloseHandle	103	0x2c1b407b7
WerReportCreate	104	0x2c1b407e6
WerReportSetParameter	105	0x2c1b4080b
WerReportSetUIOption	106	0x2c1b4083c
WerReportSubmit	107	0x2c1b4086b
WerStoreClose	108	0x2c1b40890
WerStoreGetFirstReportKey	109	0x2c1b408b1
WerStoreGetNextReportKey	110	0x2c1b408ea
WerStoreGetReportCount	111	0x2c1b40921
WerStoreGetSizeOnDisk	112	0x2c1b40954
WerStoreOpen	113	0x2c1b40985
WerStorePurge	114	0x2c1b409a4
WerStoreQueryReportMetadataV1	115	0x2c1b409c5
WerStoreQueryReportMetadataV2	116	0x2c1b40a06
WerStoreQueryReportMetadataV3	117	0x2c1b40a47
WerStoreUploadReport	118	0x2c1b40a88
WerSysprepCleanup	1	0x2c1b40ab7
WerSysprepGeneralize	2	0x2c1b40ae0
WerUnattendedSetup	3	0x2c1b40b0f
WerpAddAppCompatData	4	0x2c1b40b3a
WerpAddFile	119	0x2c1b40b69
WerpAddFileBuffer	120	0x2c1b40b86
WerpAddFileCallback	121	0x2c1b40baf
WerpAddIfRegisteredForAppLocalDump	5	0x2c1b40bdc
WerpAddMemoryBlock	6	0x2c1b40c27
WerpAddRegisteredDataToReport	7	0x2c1b40c52
WerpAddRegisteredDumpsToReport	8	0x2c1b40c93
WerpAddRegisteredMetadataToReport	9	0x2c1b40cd6
WerpAddTerminationReason	122	0x2c1b40d1f
WerpArchiveReport	10	0x2c1b40d56
WerpAuxmdDumpProcessImages	123	0x2c1b40d7f
WerpAuxmdDumpRegisteredBlocks	124	0x2c1b40dba
WerpAuxmdFree	125	0x2c1b40dfb
WerpAuxmdFreeCopyBuffer	126	0x2c1b40e1c
WerpAuxmdHashVaRanges	127	0x2c1b40e51
WerpAuxmdInitialize	128	0x2c1b40e82
WerpAuxmdMapFile	129	0x2c1b40eaf
WerpCancelUpload	11	0x2c1b40ed6
WerpCleanWer	12	0x2c1b40efd
WerpCloseStore	13	0x2c1b40f1c
WerpCreateIntegratorReportId	130	0x2c1b40f3f
WerpCreateMachineStore	14	0x2c1b40f7e
WerpDeleteReport	15	0x2c1b40fb1
WerpDestroyWerString	16	0x2c1b40fd8
WerpEnumerateStoreNext	17	0x2c1b41007
WerpEnumerateStoreStart	18	0x2c1b4103a
WerpExtractReportFiles	131	0x2c1b4106f
WerpFlushImageCache	19	0x2c1b410a2
WerpForceDeferredCollection	20	0x2c1b410cf
WerpFreeString	132	0x2c1b4110c
WerpFreeUnmappedVaRanges	21	0x2c1b4112f
WerpGetBucketId	22	0x2c1b41166
WerpGetDynamicParameter	23	0x2c1b4118b
WerpGetEventType	24	0x2c1b411c0
WerpGetExtendedDiagData	25	0x2c1b411e7
WerpGetFileByIndex	26	0x2c1b4121c
WerpGetFilePathByIndex	27	0x2c1b41247
WerpGetIntegratorReportId	133	0x2c1b4127a
WerpGetLegacyBucketId	28	0x2c1b412b3
WerpGetLoadedModuleByIndex	29	0x2c1b412e4
WerpGetNumFiles	30	0x2c1b4131f
WerpGetNumLoadedModules	31	0x2c1b41344
WerpGetNumSigParams	32	0x2c1b41379
WerpGetPathOfWERTempDirectory	33	0x2c1b413a6
WerpGetReportConsent	134	0x2c1b413e7
WerpGetReportCount	34	0x2c1b41416
WerpGetReportFinalConsent	35	0x2c1b41441
WerpGetReportFlags	36	0x2c1b4147a
WerpGetReportId	37	0x2c1b414a5
WerpGetReportInformation	38	0x2c1b414ca
WerpGetReportSettings	39	0x2c1b41501
WerpGetReportTime	40	0x2c1b41532
WerpGetReportType	41	0x2c1b4155b
WerpGetResponseId	42	0x2c1b41584
WerpGetSigParamByIndex	43	0x2c1b415ad
WerpGetStoreLocation	135	0x2c1b415e0
WerpGetStorePath	44	0x2c1b4160f
WerpGetStoreType	45	0x2c1b41636
WerpGetTextFromReport	46	0x2c1b4165d
WerpGetUIParamByIndex	47	0x2c1b4168e
WerpGetUploadTime	48	0x2c1b416bf
WerpGetWerStringData	49	0x2c1b416e8
WerpGetWow64Process	50	0x2c1b41717
WerpHashApplicationParameters	51	0x2c1b41744
WerpInitializeImageCache	52	0x2c1b41785
WerpIsDisabled	136	0x2c1b417bc
WerpIsOnBattery	53	0x2c1b417df
WerpIsTransportAvailable	54	0x2c1b41804
WerpLoadReport	137	0x2c1b4183b
WerpLoadReportFromBuffer	55	0x2c1b4185e
WerpOpenMachineArchive	56	0x2c1b41895
WerpOpenMachineQueue	57	0x2c1b418c8
WerpPromptUser	58	0x2c1b418f7
WerpPruneStore	59	0x2c1b4191a
WerpReportCancel	60	0x2c1b4193d
WerpReportSetMaxProcessHoldMilliseconds	61	0x2c1b41964
WerpReportSprintfParameter	62	0x2c1b419b9
WerpReserveMachineQueueReportDir	63	0x2c1b419f4
WerpResetTransientImageCacheStatistics	64	0x2c1b41a3b
WerpRestartApplication	65	0x2c1b41a8e
WerpSetAuxiliaryArchivePath	138	0x2c1b41ac1
WerpSetCallBack	139	0x2c1b41afe
WerpSetDefaultUserConsent	140	0x2c1b41b23
WerpSetDynamicParameter	66	0x2c1b41b5c
WerpSetEventName	67	0x2c1b41b91
WerpSetExitListeners	141	0x2c1b41bb8
WerpSetIntegratorReportId	142	0x2c1b41be7
WerpSetIptEnabled	143	0x2c1b41c20
WerpSetProcessTimelines	68	0x2c1b41c49
WerpSetQuickDumpType	69	0x2c1b41c7e
WerpSetReportApplicationIdentity	70	0x2c1b41cad
WerpSetReportFlags	71	0x2c1b41cf4
WerpSetReportInformation	72	0x2c1b41d1f
WerpSetReportIsFatal	73	0x2c1b41d56
WerpSetReportNamespaceParameter	74	0x2c1b41d85
WerpSetReportOption	144	0x2c1b41dca
WerpSetReportTime	75	0x2c1b41df7
WerpSetReportUploadContextToken	76	0x2c1b41e20
WerpSetTelemetryAppParams	77	0x2c1b41e65
WerpSetTelemetryKernelParams	78	0x2c1b41e9e
WerpSetTelemetryServiceParams	79	0x2c1b41edd
WerpSetTtdStatus	145	0x2c1b41f1e
WerpShowUpsellUI	80	0x2c1b41f45
WerpStitchedMinidumpVmPostReadCallback	81	0x2c1b41f6c
WerpStitchedMinidumpVmPreReadCallback	82	0x2c1b41fbf
WerpStitchedMinidumpVmQueryCallback	83	0x2c1b42010
WerpSubmitReportFromStore	84	0x2c1b4205d
WerpTraceAuxMemDumpStatistics	85	0x2c1b42096
WerpTraceDuration	86	0x2c1b420d7
WerpTraceImageCacheStatistics	87	0x2c1b42100
WerpTraceSnapshotStatistics	88	0x2c1b42141
WerpTraceStitchedDumpWriterStatistics	89	0x2c1b4217e
WerpTraceUnmappedVaRangesStatistics	90	0x2c1b421cf
WerpUnmapProcessViews	91	0x2c1b4221c
WerpValidateReportKey	92	0x2c1b4224d
WerpWalkGatherBlocks	93	0x2c1b4227e

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-13T14:23:50.611079+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.6	49790	TCP
2024-11-13T14:24:38.680407+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.6	49959	TCP
2024-11-13T14:24:45.043364+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49950	91.92.250.70	10443	TCP
2024-11-13T14:25:06.750419+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49988	91.92.250.70	10443	TCP
2024-11-13T14:25:27.013214+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	49998	91.92.250.70	10443	TCP
2024-11-13T14:25:49.671140+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50002	91.92.250.70	10443	TCP
2024-11-13T14:26:11.276689+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50005	91.92.250.70	10443	TCP
2024-11-13T14:26:31.304319+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50008	91.92.250.70	10443	TCP
2024-11-13T14:26:43.935481+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50010	91.92.250.70	10443	TCP
2024-11-13T14:26:52.846728+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50012	91.92.250.70	10443	TCP
2024-11-13T14:27:04.902481+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50016	91.92.250.70	10443	TCP
2024-11-13T14:27:12.814187+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50018	91.92.250.70	10443	TCP
2024-11-13T14:27:24.862958+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50022	91.92.250.70	10443	TCP
2024-11-13T14:27:33.605371+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.6	50025	91.92.250.70	10443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 14:24:36.562644958 CET	49950	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:24:36.568250895 CET	10443	49950	91.92.250.70	192.168.2.6
Nov 13, 2024 14:24:36.568340063 CET	49950	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:24:37.225522995 CET	49950	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:24:37.230488062 CET	10443	49950	91.92.250.70	192.168.2.6
Nov 13, 2024 14:24:45.043286085 CET	10443	49950	91.92.250.70	192.168.2.6
Nov 13, 2024 14:24:45.043364048 CET	49950	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:24:46.105468035 CET	49950	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:24:46.106098890 CET	49980	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:24:46.150160074 CET	10443	49950	91.92.250.70	192.168.2.6
Nov 13, 2024 14:24:46.150171995 CET	10443	49980	91.92.250.70	192.168.2.6
Nov 13, 2024 14:24:46.150252104 CET	49980	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:24:47.337716103 CET	49980	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:24:47.342717886 CET	10443	49980	91.92.250.70	192.168.2.6
Nov 13, 2024 14:24:54.632044077 CET	10443	49980	91.92.250.70	192.168.2.6
Nov 13, 2024 14:24:54.632183075 CET	49980	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:24:55.824023962 CET	49980	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:24:55.824635029 CET	49986	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:24:55.828857899 CET	10443	49980	91.92.250.70	192.168.2.6
Nov 13, 2024 14:24:55.831243038 CET	10443	49986	91.92.250.70	192.168.2.6
Nov 13, 2024 14:24:55.831334114 CET	49986	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:24:55.831460953 CET	49986	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:24:55.836607933 CET	10443	49986	91.92.250.70	192.168.2.6
Nov 13, 2024 14:24:55.836662054 CET	49986	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:24:57.575228930 CET	49988	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:24:58.271687031 CET	10443	49988	91.92.250.70	192.168.2.6
Nov 13, 2024 14:24:58.271832943 CET	49988	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:24:58.964837074 CET	49988	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:24:58.969685078 CET	10443	49988	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:06.750319004 CET	10443	49988	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:06.750418901 CET	49988	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:07.418133974 CET	49988	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:07.423154116 CET	10443	49988	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:07.432687044 CET	49995	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:07.437834024 CET	10443	49995	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:07.437933922 CET	49995	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:07.438297033 CET	49995	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:07.443160057 CET	10443	49995	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:16.256778955 CET	10443	49995	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:16.256887913 CET	49995	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:16.257673979 CET	10443	49995	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:16.257716894 CET	49995	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:16.949034929 CET	49995	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:16.955178976 CET	10443	49995	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:16.960292101 CET	49997	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:16.965471983 CET	10443	49997	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:16.965543985 CET	49997	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:16.965655088 CET	49997	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:16.970809937 CET	10443	49997	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:16.970859051 CET	49997	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:18.527609110 CET	49998	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:18.532684088 CET	10443	49998	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:18.532807112 CET	49998	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:19.230573893 CET	49998	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:19.235527992 CET	10443	49998	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:27.013122082 CET	10443	49998	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:27.013214111 CET	49998	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:27.730281115 CET	49998	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:27.735073090 CET	10443	49998	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:27.747612000 CET	49999	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:27.752614021 CET	10443	49999	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:27.752710104 CET	49999	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:27.753040075 CET	49999	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:27.758230925 CET	10443	49999	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:36.228668928 CET	10443	49999	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:36.228755951 CET	49999	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:36.917844057 CET	49999	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:36.922760963 CET	10443	49999	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:36.932204008 CET	50001	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:36.937011003 CET	10443	50001	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:36.937083960 CET	50001	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:36.937216043 CET	50001	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:36.942578077 CET	10443	50001	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:36.942641020 CET	50001	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:41.184421062 CET	50002	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:41.189687014 CET	10443	50002	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:41.189770937 CET	50002	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:42.363456964 CET	50002	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:42.368601084 CET	10443	50002	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:49.671047926 CET	10443	50002	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:49.671139956 CET	50002	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:50.421952009 CET	50002	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:50.430548906 CET	10443	50002	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:50.432288885 CET	50003	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:50.440715075 CET	10443	50003	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:50.440825939 CET	50003	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:50.441184998 CET	50003	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:50.449978113 CET	10443	50003	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:58.928970098 CET	10443	50003	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:58.929085016 CET	50003	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:59.660351992 CET	50003	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:59.670162916 CET	50004	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:25:59.795257092 CET	10443	50003	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:59.795300961 CET	10443	50004	91.92.250.70	192.168.2.6
Nov 13, 2024 14:25:59.795494080 CET	50004	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:00.511895895 CET	50004	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:00.517072916 CET	10443	50004	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:00.517153025 CET	50004	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:02.059407949 CET	50005	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:02.795201063 CET	10443	50005	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:02.795433998 CET	50005	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:03.480967999 CET	50005	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:03.486124039 CET	10443	50005	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:11.276515961 CET	10443	50005	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:11.276689053 CET	50005	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:11.990457058 CET	50005	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:11.995534897 CET	10443	50005	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:12.000498056 CET	50006	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:12.005459070 CET	10443	50006	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:12.005564928 CET	50006	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:12.005877018 CET	50006	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:12.010648966 CET	10443	50006	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:20.485073090 CET	10443	50006	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:20.485186100 CET	50006	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:21.215240955 CET	50006	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:21.220837116 CET	10443	50006	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:21.224400043 CET	50007	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:21.229474068 CET	10443	50007	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:21.229559898 CET	50007	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:21.229651928 CET	50007	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:21.235287905 CET	10443	50007	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:21.235301971 CET	10443	50007	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:21.235369921 CET	50007	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:22.810261011 CET	50008	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:22.815203905 CET	10443	50008	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:22.815335035 CET	50008	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:23.543329000 CET	50008	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:23.548152924 CET	10443	50008	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:31.304224014 CET	10443	50008	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:31.304318905 CET	50008	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:32.058705091 CET	50008	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:32.063574076 CET	10443	50008	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:32.070117950 CET	50009	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:32.074939966 CET	10443	50009	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:32.075030088 CET	50009	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:32.075355053 CET	50009	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:32.080135107 CET	10443	50009	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:35.226886988 CET	50010	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:35.231928110 CET	10443	50010	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:35.232057095 CET	50010	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:35.240648031 CET	50010	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:35.245615959 CET	10443	50010	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:40.553767920 CET	10443	50009	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:40.553878069 CET	50009	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:41.263978958 CET	50009	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:41.269741058 CET	10443	50009	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:41.278772116 CET	50011	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:41.283701897 CET	10443	50011	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:41.283802986 CET	50011	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:41.283967972 CET	50011	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:41.289287090 CET	10443	50011	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:41.289355993 CET	50011	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:43.935401917 CET	10443	50010	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:43.935481071 CET	50010	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:43.939219952 CET	10443	50010	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:43.939273119 CET	50010	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:44.359257936 CET	50012	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:44.364204884 CET	10443	50012	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:44.364285946 CET	50012	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:44.637017012 CET	50010	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:44.637788057 CET	50013	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:45.044996023 CET	50010	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:45.054639101 CET	50012	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:45.402440071 CET	50012	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:45.568721056 CET	10443	50010	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:45.568742990 CET	10443	50013	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:45.568778038 CET	10443	50010	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:45.568794012 CET	10443	50012	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:45.568824053 CET	10443	50012	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:45.568864107 CET	50013	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:45.570815086 CET	50010	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:46.768565893 CET	50013	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:46.773493052 CET	10443	50013	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:52.846529007 CET	10443	50012	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:52.846728086 CET	50012	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:53.593234062 CET	50012	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:53.598545074 CET	10443	50012	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:53.604476929 CET	50014	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:53.609313965 CET	10443	50014	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:53.609392881 CET	50014	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:53.609956026 CET	50014	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:53.614809990 CET	10443	50014	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:54.062205076 CET	10443	50013	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:54.062344074 CET	50013	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:54.793241024 CET	50013	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:54.798830986 CET	10443	50013	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:54.812277079 CET	50015	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:54.817640066 CET	10443	50015	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:54.817739010 CET	50015	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:54.817845106 CET	50015	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:54.823288918 CET	10443	50015	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:54.823354006 CET	50015	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:56.418678999 CET	50016	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:56.423568964 CET	10443	50016	91.92.250.70	192.168.2.6
Nov 13, 2024 14:26:56.423661947 CET	50016	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:57.168462038 CET	50016	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:26:57.173713923 CET	10443	50016	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:02.089346886 CET	10443	50014	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:02.091310024 CET	50014	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:02.794843912 CET	50014	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:02.800066948 CET	10443	50014	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:02.819360971 CET	50017	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:02.824516058 CET	10443	50017	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:02.824599981 CET	50017	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:02.824704885 CET	50017	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:02.830172062 CET	10443	50017	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:02.830288887 CET	50017	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:04.324897051 CET	50018	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:04.329992056 CET	10443	50018	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:04.330144882 CET	50018	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:04.902338982 CET	10443	50016	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:04.902481079 CET	50016	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:05.059248924 CET	50018	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:05.064363003 CET	10443	50018	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:05.624677896 CET	50016	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:05.630116940 CET	10443	50016	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:05.637748957 CET	50019	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:05.642762899 CET	10443	50019	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:05.642873049 CET	50019	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:05.643173933 CET	50019	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:05.648000002 CET	10443	50019	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:12.814039946 CET	10443	50018	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:12.814187050 CET	50018	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:13.590260983 CET	50018	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:13.596158028 CET	10443	50018	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:13.603393078 CET	50020	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:13.608316898 CET	10443	50020	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:13.608402014 CET	50020	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:13.608685017 CET	50020	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:13.613580942 CET	10443	50020	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:14.125586033 CET	10443	50019	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:14.125876904 CET	50019	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:14.825928926 CET	50019	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:14.830972910 CET	10443	50019	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:14.839587927 CET	50021	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:14.844508886 CET	10443	50021	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:14.844594955 CET	50021	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:14.844746113 CET	50021	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:14.849833012 CET	10443	50021	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:14.849888086 CET	50021	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:16.371767998 CET	50022	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:16.377372026 CET	10443	50022	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:16.377449989 CET	50022	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:17.121663094 CET	50022	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:17.126589060 CET	10443	50022	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:22.090384007 CET	10443	50020	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:22.090502024 CET	50020	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:22.838679075 CET	50020	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:22.843605042 CET	10443	50020	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:22.849653006 CET	50023	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:22.854563951 CET	10443	50023	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:22.854667902 CET	50023	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:22.858916044 CET	50023	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:22.863892078 CET	10443	50023	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:22.863948107 CET	50023	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:24.862818956 CET	10443	50022	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:24.862957954 CET	50022	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:25.107857943 CET	50025	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:25.112688065 CET	10443	50025	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:25.112768888 CET	50025	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:25.588129997 CET	50022	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:25.593450069 CET	10443	50022	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:25.608299971 CET	50026	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:25.613656998 CET	10443	50026	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:25.613746881 CET	50026	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:25.614120960 CET	50026	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:25.618956089 CET	10443	50026	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:25.871696949 CET	50025	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:25.876956940 CET	10443	50025	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:33.605178118 CET	10443	50025	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:33.605370998 CET	50025	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:34.097433090 CET	10443	50026	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:34.097605944 CET	50026	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:38.485662937 CET	50025	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:38.490468979 CET	10443	50025	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:38.857717991 CET	50026	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:38.858439922 CET	50028	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:38.862705946 CET	10443	50026	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:38.863343000 CET	10443	50028	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:38.863435984 CET	50028	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:38.863557100 CET	50028	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:38.868654966 CET	10443	50028	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:38.868721962 CET	50028	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:47.599520922 CET	50027	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:47.701051950 CET	10443	50027	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:47.701188087 CET	50027	10443	192.168.2.6	91.92.250.70
Nov 13, 2024 14:27:56.182828903 CET	10443	50027	91.92.250.70	192.168.2.6
Nov 13, 2024 14:27:56.182976961 CET	50027	10443	192.168.2.6	91.92.250.70

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 14:24:37.143131971 CET	59103	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 13, 2024 14:24:37.143131971 CET	192.168.2.6	1.1.1.1	0x996e	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 13, 2024 14:24:37.150125980 CET	1.1.1.1	192.168.2.6	0x996e	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false

Target ID:	1
Start time:	08:23:19
Start date:	13/11/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\cobaltstrike.dll"
Imagebase:	0x7ff700360000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	08:23:19
Start date:	13/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	08:23:20
Start date:	13/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",#1
Imagebase:	0x7ff7e1ca0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	08:23:20
Start date:	13/11/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\cobaltstrike.dll,CloseThreadWaitChainSession
Imagebase:	0x7ff759960000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	08:23:20
Start date:	13/11/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",#1
Imagebase:	0x7ff759960000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	08:23:21
Start date:	13/11/2024
Path:	C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
Imagebase:	0x400000
File size:	21'050'672 bytes
MD5 hash:	5537C708EDB9A2C21F88E34E8A0F1744
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	08:23:23
Start date:	13/11/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\cobaltstrike.dll,GetThreadWaitChain
Imagebase:	0x7ff759960000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	08:23:24
Start date:	13/11/2024
Path:	C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
Imagebase:	0x400000
File size:	21'050'672 bytes
MD5 hash:	5537C708EDB9A2C21F88E34E8A0F1744
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	08:23:25
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp" /SL5="$20408,20439558,139776,C:\Users\Public\Downloads\Advanced_IP_Scanner.exe"
Imagebase:	0x400000
File size:	1'190'912 bytes
MD5 hash:	B87639F9A6CF5BA8C9E1F297C5745A67
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	08:23:25
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-QL302.tmp\Advanced_IP_Scanner.tmp" /SL5="$30412,20439558,139776,C:\Users\Public\Downloads\Advanced_IP_Scanner.exe"
Imagebase:	0x400000
File size:	1'190'912 bytes
MD5 hash:	B87639F9A6CF5BA8C9E1F297C5745A67
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	08:23:26
Start date:	13/11/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\cobaltstrike.dll,OpenThreadWaitChainSession
Imagebase:	0x7ff759960000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	08:23:28
Start date:	13/11/2024
Path:	C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
Imagebase:	0x400000
File size:	21'050'672 bytes
MD5 hash:	5537C708EDB9A2C21F88E34E8A0F1744
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	08:23:29
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp" /SL5="$10454,20439558,139776,C:\Users\Public\Downloads\Advanced_IP_Scanner.exe"
Imagebase:	0x400000
File size:	1'190'912 bytes
MD5 hash:	B87639F9A6CF5BA8C9E1F297C5745A67
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	08:23:31
Start date:	13/11/2024
Path:	C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
Imagebase:	0x400000
File size:	21'050'672 bytes
MD5 hash:	5537C708EDB9A2C21F88E34E8A0F1744
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	08:23:32
Start date:	13/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp" /SL5="$60218,20439558,139776,C:\Users\Public\Downloads\Advanced_IP_Scanner.exe"
Imagebase:	0x400000
File size:	1'190'912 bytes
MD5 hash:	B87639F9A6CF5BA8C9E1F297C5745A67
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	08:23:53
Start date:	13/11/2024
Path:	C:\Windows\System32\sihost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\sihost.exe
Imagebase:	0x7ff6440e0000
File size:	111'616 bytes
MD5 hash:	A21E7719D73D0322E2E7D61802CB8F80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000012.00000002.2908078030.00007FFD44420000.00000020.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000012.00000002.2908078030.00007FFD44420000.00000020.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000012.00000002.2908078030.00007FFD44420000.00000020.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:23:56
Start date:	13/11/2024
Path:	C:\Windows\System32\sihost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\sihost.exe
Imagebase:	0x7ff6440e0000
File size:	111'616 bytes
MD5 hash:	A21E7719D73D0322E2E7D61802CB8F80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	08:24:00
Start date:	13/11/2024
Path:	C:\Windows\System32\sihost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\sihost.exe
Imagebase:	0x7ff799c70000
File size:	111'616 bytes
MD5 hash:	A21E7719D73D0322E2E7D61802CB8F80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000014.00000003.2947314162.00007FFD44420000.00000020.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000014.00000003.2947314162.00007FFD44420000.00000020.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000014.00000003.2947314162.00007FFD44420000.00000020.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	08:24:07
Start date:	13/11/2024
Path:	C:\Windows\System32\sihost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\sihost.exe
Imagebase:	0x7ff6440e0000
File size:	111'616 bytes
MD5 hash:	A21E7719D73D0322E2E7D61802CB8F80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	08:24:08
Start date:	13/11/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe /LOADSAVEDWINDOWS
Imagebase:	0x7ff609140000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	08:24:08
Start date:	13/11/2024
Path:	C:\Windows\System32\sihost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\sihost.exe
Imagebase:	0x7ff6440e0000
File size:	111'616 bytes
MD5 hash:	A21E7719D73D0322E2E7D61802CB8F80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	08:24:09
Start date:	13/11/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe /LOADSAVEDWINDOWS
Imagebase:	0x7ff609140000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	08:24:09
Start date:	13/11/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe /LOADSAVEDWINDOWS
Imagebase:	0x7ff609140000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:24:09
Start date:	13/11/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe /LOADSAVEDWINDOWS
Imagebase:	0x7ff609140000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	08:24:09
Start date:	13/11/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe /NoUACCheck
Imagebase:	0x7ff609140000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	08:24:11
Start date:	13/11/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 1340 -s 544
Imagebase:	0x7ff7df320000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	08:24:20
Start date:	13/11/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
Imagebase:	0x7ff759960000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	08:24:40
Start date:	13/11/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",CloseThreadWaitChainSession
Imagebase:	0x7ff759960000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	08:24:40
Start date:	13/11/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",GetThreadWaitChain
Imagebase:	0x7ff759960000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	08:24:40
Start date:	13/11/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",OpenThreadWaitChainSession
Imagebase:	0x7ff759960000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	08:24:40
Start date:	13/11/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",WerpWalkGatherBlocks
Imagebase:	0x7ff759960000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	08:24:40
Start date:	13/11/2024
Path:	C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Downloads\Advanced_IP_Scanner.exe
Imagebase:	0x400000
File size:	21'050'672 bytes
MD5 hash:	5537C708EDB9A2C21F88E34E8A0F1744
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	08:24:40
Start date:	13/11/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\cobaltstrike.dll",WerpValidateReportKey
Imagebase:	0x7ff759960000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CobaltStrike_2, Description: Yara detected CobaltStrike, Source: 00000029.00000002.4999809185.000001BA34866000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CobaltStrike_3, Description: Yara detected CobaltStrike, Source: 00000029.00000002.4999809185.000001BA34866000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_CobaltStrike_f0b627fc, Description: Rule for beacon reflective loader, Source: 00000029.00000002.4999809185.000001BA34866000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report cobaltstrike.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: CobaltStrike

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_sihost.exe_4f573731dbe296f8a4bb927c82d7ce365249268_b82a91b5_74dbb513-3e1b-4626-8bb4-28c5093fd0a2\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE815.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9BC.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREA1B.tmp.xml

C:\Users\Public\Downloads\Advanced_IP_Scanner.exe

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001d.db

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\Windows[2].json

C:\Users\user\AppData\Local\Temp\is-1QM08.tmp\Advanced_IP_Scanner.tmp

C:\Users\user\AppData\Local\Temp\is-2FLEP.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-2FLEP.tmp\_isetup\_shfoldr.dll

C:\Users\user\AppData\Local\Temp\is-2FLEP.tmp\aips_is_install_dll.dll

C:\Users\user\AppData\Local\Temp\is-BT8N1.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-BT8N1.tmp\_isetup\_shfoldr.dll

C:\Users\user\AppData\Local\Temp\is-BT8N1.tmp\aips_is_install_dll.dll

C:\Users\user\AppData\Local\Temp\is-F1EO2.tmp\Advanced_IP_Scanner.tmp

C:\Users\user\AppData\Local\Temp\is-FDD04.tmp\Advanced_IP_Scanner.tmp

C:\Users\user\AppData\Local\Temp\is-LM2G1.tmp\Advanced_IP_Scanner.tmp

Windows Analysis Report
cobaltstrike.dll