Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
zwM7Oe2e1l

Overview

General Information

Sample Name:zwM7Oe2e1l (renamed file extension from none to exe)
Analysis ID:679156
MD5:f1ab9ed37b68ace769dccaa693f162e0
SHA1:4fc5eea47502e6ebf089910be10790614c4d4b54
SHA256:b65bc098b475996eaabbb02bb5fee19a18c6ff2eee0062353aff696356e73b7a
Tags:exeWoodyRAT
Infos:

Detection

Score:72
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Snort IDS alert for network traffic
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
PE file contains strange resources
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Sample execution stops while process was sleeping (likely an evasion)
Contains long sleeps (>= 3 min)

Classification

Process Tree

  • System is w10x64
  • zwM7Oe2e1l.exe (PID: 1316 cmdline: "C:\Users\user\Desktop\zwM7Oe2e1l.exe" MD5: F1AB9ED37B68ACE769DCCAA693F162E0)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

Timestamp:192.168.2.68.8.8.859293532037937 08/05/22-11:02:51.521843
SID:2037937
Source Port:59293
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.68.8.8.855201532037937 08/05/22-11:02:51.225834
SID:2037937
Source Port:55201
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.68.8.8.856550532037937 08/05/22-11:02:54.471667
SID:2037937
Source Port:56550
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.68.8.8.856591532037937 08/05/22-11:02:52.438751
SID:2037937
Source Port:56591
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.68.8.8.855788532037938 08/05/22-11:04:47.473277
SID:2037938
Source Port:55788
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.68.8.8.861116532037937 08/05/22-11:02:53.326830
SID:2037937
Source Port:61116
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.68.8.8.858723532037937 08/05/22-11:02:51.809410
SID:2037937
Source Port:58723
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.68.8.8.863104532037938 08/05/22-11:04:09.074489
SID:2037938
Source Port:63104
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.68.8.8.858689532037938 08/05/22-11:03:44.188103
SID:2037938
Source Port:58689
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.68.8.8.861607532037937 08/05/22-11:02:54.097826
SID:2037937
Source Port:61607
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.68.8.8.854015532037938 08/05/22-11:03:31.447464
SID:2037938
Source Port:54015
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.68.8.8.865367532037938 08/05/22-11:04:21.925023
SID:2037938
Source Port:65367
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.68.8.8.860350532037937 08/05/22-11:02:52.686111
SID:2037937
Source Port:60350
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.68.8.8.851748532037937 08/05/22-11:02:52.976163
SID:2037937
Source Port:51748
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.68.8.8.859871532037938 08/05/22-11:03:07.881163
SID:2037938
Source Port:59871
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.68.8.8.851971532037937 08/05/22-11:02:52.201354
SID:2037937
Source Port:51971
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.68.8.8.851194532037938 08/05/22-11:03:18.845501
SID:2037938
Source Port:51194
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.68.8.8.857669532037938 08/05/22-11:04:34.382443
SID:2037938
Source Port:57669
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.68.8.8.850958532037937 08/05/22-11:02:53.714812
SID:2037937
Source Port:50958
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.68.8.8.852858532037938 08/05/22-11:02:54.797599
SID:2037938
Source Port:52858
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected
Timestamp:192.168.2.68.8.8.853049532037938 08/05/22-11:03:56.868334
SID:2037938
Source Port:53049
Destination Port:53
Protocol:UDP
Classtype:A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: zwM7Oe2e1l.exeAvira: detected
Multi AV Scanner detection for submitted file
Source: zwM7Oe2e1l.exeVirustotal: Detection: 59%Perma Link
Source: zwM7Oe2e1l.exeMetadefender: Detection: 14%Perma Link
Source: zwM7Oe2e1l.exeReversingLabs: Detection: 61%
Source: zwM7Oe2e1l.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\hep2\build\c#\dll\WoodyPowerSession.pdb source: zwM7Oe2e1l.exe
Source: Binary string: C:\hep2\build\cpp\x64\bin\WoodyNode.pdb@ source: zwM7Oe2e1l.exe
Source: Binary string: C:\hep2\build\c#\dll\WoodySharpExecutor.pdb source: zwM7Oe2e1l.exe
Source: Binary string: C:\hep2\build\cpp\x64\bin\WoodyNode.pdb source: zwM7Oe2e1l.exe

Networking

barindex
Snort IDS alert for network traffic
Source: TrafficSnort IDS: 2037937 ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup 192.168.2.6:55201 -> 8.8.8.8:53
Source: TrafficSnort IDS: 2037937 ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup 192.168.2.6:59293 -> 8.8.8.8:53
Source: TrafficSnort IDS: 2037937 ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup 192.168.2.6:58723 -> 8.8.8.8:53
Source: TrafficSnort IDS: 2037937 ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup 192.168.2.6:51971 -> 8.8.8.8:53
Source: TrafficSnort IDS: 2037937 ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup 192.168.2.6:56591 -> 8.8.8.8:53
Source: TrafficSnort IDS: 2037937 ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup 192.168.2.6:60350 -> 8.8.8.8:53
Source: TrafficSnort IDS: 2037937 ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup 192.168.2.6:51748 -> 8.8.8.8:53
Source: TrafficSnort IDS: 2037937 ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup 192.168.2.6:61116 -> 8.8.8.8:53
Source: TrafficSnort IDS: 2037937 ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup 192.168.2.6:50958 -> 8.8.8.8:53
Source: TrafficSnort IDS: 2037937 ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup 192.168.2.6:61607 -> 8.8.8.8:53
Source: TrafficSnort IDS: 2037937 ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup 192.168.2.6:56550 -> 8.8.8.8:53
Source: TrafficSnort IDS: 2037938 ET TROJAN Woody RAT CnC Domain (fns77 .ru) in DNS Lookup 192.168.2.6:52858 -> 8.8.8.8:53
Source: TrafficSnort IDS: 2037938 ET TROJAN Woody RAT CnC Domain (fns77 .ru) in DNS Lookup 192.168.2.6:59871 -> 8.8.8.8:53
Source: TrafficSnort IDS: 2037938 ET TROJAN Woody RAT CnC Domain (fns77 .ru) in DNS Lookup 192.168.2.6:51194 -> 8.8.8.8:53
Source: TrafficSnort IDS: 2037938 ET TROJAN Woody RAT CnC Domain (fns77 .ru) in DNS Lookup 192.168.2.6:54015 -> 8.8.8.8:53
Source: TrafficSnort IDS: 2037938 ET TROJAN Woody RAT CnC Domain (fns77 .ru) in DNS Lookup 192.168.2.6:58689 -> 8.8.8.8:53
Source: TrafficSnort IDS: 2037938 ET TROJAN Woody RAT CnC Domain (fns77 .ru) in DNS Lookup 192.168.2.6:53049 -> 8.8.8.8:53
Source: TrafficSnort IDS: 2037938 ET TROJAN Woody RAT CnC Domain (fns77 .ru) in DNS Lookup 192.168.2.6:63104 -> 8.8.8.8:53
Source: TrafficSnort IDS: 2037938 ET TROJAN Woody RAT CnC Domain (fns77 .ru) in DNS Lookup 192.168.2.6:65367 -> 8.8.8.8:53
Source: TrafficSnort IDS: 2037938 ET TROJAN Woody RAT CnC Domain (fns77 .ru) in DNS Lookup 192.168.2.6:57669 -> 8.8.8.8:53
Source: TrafficSnort IDS: 2037938 ET TROJAN Woody RAT CnC Domain (fns77 .ru) in DNS Lookup 192.168.2.6:55788 -> 8.8.8.8:53
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
Source: unknownNetwork traffic detected: HTTP traffic on port 49817 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49785
Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49785 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49819
Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49817
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49815
Source: unknownNetwork traffic detected: HTTP traffic on port 49791 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49814
Source: unknownNetwork traffic detected: HTTP traffic on port 49881 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49857
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49812
Source: unknownNetwork traffic detected: HTTP traffic on port 49885 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
Source: unknownNetwork traffic detected: HTTP traffic on port 49812 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49876 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49809
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
Source: unknownNetwork traffic detected: HTTP traffic on port 49882 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49886 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49843
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49887
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49886
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49885
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
Source: unknownNetwork traffic detected: HTTP traffic on port 49819 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49883
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49882
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49881
Source: unknownNetwork traffic detected: HTTP traffic on port 49815 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49857 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49797 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49809 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49883 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49887 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49832
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49876
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49797
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
Source: unknownNetwork traffic detected: HTTP traffic on port 49843 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49814 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49791
Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49832 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
Source: unknownNetwork traffic detected: HTTP traffic on port 49867 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49867
Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
Source: zwM7Oe2e1l.exe, 00000002.00000003.504283286.000001F180265000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.504433768.000001F180285000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584696071.000001F180285000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000002.627384501.000001F180264000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.530200851.000001F180264000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.557947549.000001F180277000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.476972337.000001F180283000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.530234039.000001F180277000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.476900660.000001F180264000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.449641977.000001F180283000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584591844.000001F180264000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000002.627482009.000001F18027B000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.557786417.000001F180264000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.449602137.000001F180260000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.399547079.000001F180280000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.422978366.000001F180281000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.504420886.000001F18027C000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584630455.000001F180277000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fns77.ru/
Source: zwM7Oe2e1l.exe, 00000002.00000003.584696071.000001F180285000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584630455.000001F180277000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fns77.ru/d
Source: zwM7Oe2e1l.exe, 00000002.00000003.504433768.000001F180285000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.476972337.000001F180283000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.530234039.000001F180277000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.504420886.000001F18027C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fns77.ru/e
Source: zwM7Oe2e1l.exe, 00000002.00000003.557772748.000001F180261000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.530234039.000001F180277000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.504276141.000001F180261000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.476801924.000001F180237000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.530110478.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.476883519.000001F180261000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.449653886.000001F18027F000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584585700.000001F180261000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000002.627247814.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.530193276.000001F180260000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.449602137.000001F180260000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.449519735.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.399547079.000001F180280000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.422978366.000001F180281000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.504027968.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584550699.000001F180237000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.476964147.000001F18027B000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.449633913.000001F18027B000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000002.627020793.000001F1801EB000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.504420886.000001F18027C000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584630455.000001F180277000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fns77.ru/knock
Source: zwM7Oe2e1l.exe, 00000002.00000003.584585700.000001F180261000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fns77.ru/knock)0O
Source: zwM7Oe2e1l.exe, 00000002.00000003.449653886.000001F18027F000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.449633913.000001F18027B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fns77.ru/knock?.
Source: zwM7Oe2e1l.exe, 00000002.00000002.627362850.000001F180260000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fns77.ru/knockC3
Source: zwM7Oe2e1l.exe, 00000002.00000002.627247814.000001F180235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fns77.ru/knockKkz
Source: zwM7Oe2e1l.exe, 00000002.00000003.422978366.000001F180281000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fns77.ru/knockq
Source: zwM7Oe2e1l.exe, 00000002.00000003.504420886.000001F18027C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fns77.ru/knockr
Source: zwM7Oe2e1l.exe, 00000002.00000003.557540751.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584696071.000001F180285000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.557947549.000001F180277000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.476801924.000001F180237000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.530110478.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000002.627247814.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.449519735.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.504027968.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584550699.000001F180237000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584630455.000001F180277000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fns77.ru/m
Source: zwM7Oe2e1l.exe, 00000002.00000003.449602137.000001F180260000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.476939167.000001F180268000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.504317321.000001F180268000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584598044.000001F180268000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.530208861.000001F180268000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://fns77.ru:443/knockxGO6
Source: zwM7Oe2e1l.exe, 00000002.00000003.364691804.000001F180245000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000002.627020793.000001F1801EB000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.369036380.000001F180264000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.370920493.000001F180275000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://microsoft-ru-data.ru/
Source: zwM7Oe2e1l.exe, 00000002.00000003.367111100.000001F180247000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://microsoft-ru-data.ru/6
Source: zwM7Oe2e1l.exe, 00000002.00000003.367111100.000001F180247000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.369408265.000001F180247000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.366618138.000001F180247000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.370201861.000001F180247000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.371162191.000001F180247000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://microsoft-ru-data.ru/Y
Source: zwM7Oe2e1l.exe, 00000002.00000003.369408265.000001F180247000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://microsoft-ru-data.ru/ck
Source: zwM7Oe2e1l.exe, 00000002.00000003.365233268.000001F180247000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://microsoft-ru-data.ru/ckW
Source: zwM7Oe2e1l.exe, 00000002.00000003.366094915.000001F180247000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://microsoft-ru-data.ru/ckZ
Source: zwM7Oe2e1l.exe, 00000002.00000003.367781850.000001F180247000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.371141170.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.365233268.000001F180247000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.366085455.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.363930144.000001F180242000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.370610227.000001F180278000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.365226384.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.370146613.000001F180278000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.367767742.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.366094915.000001F180247000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.370181710.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.369088197.000001F180278000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.368622773.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.367097339.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.370920493.000001F180275000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://microsoft-ru-data.ru/knock
Source: zwM7Oe2e1l.exe, 00000002.00000003.365226384.000001F180235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://microsoft-ru-data.ru/knock#f1
Source: zwM7Oe2e1l.exe, 00000002.00000003.371379761.000001F180275000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.370920493.000001F180275000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://microsoft-ru-data.ru/knock%)
Source: zwM7Oe2e1l.exe, 00000002.00000003.364275197.000001F180242000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://microsoft-ru-data.ru/knockW
Source: zwM7Oe2e1l.exe, 00000002.00000003.364275197.000001F180242000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://microsoft-ru-data.ru/knockZ
Source: zwM7Oe2e1l.exe, 00000002.00000003.368713421.000001F180247000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://microsoft-ru-data.ru/knockc
Source: zwM7Oe2e1l.exe, 00000002.00000003.369394137.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.367767742.000001F180235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://microsoft-ru-data.ru/knockd
Source: zwM7Oe2e1l.exe, 00000002.00000003.366085455.000001F180235000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://microsoft-ru-data.ru/knocke
Source: zwM7Oe2e1l.exe, 00000002.00000003.369320038.000001F180278000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.369901342.000001F180278000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.370610227.000001F180278000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.370146613.000001F180278000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.370920493.000001F180275000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://microsoft-ru-data.ru/knocks)
Source: zwM7Oe2e1l.exe, 00000002.00000002.627020793.000001F1801EB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://microsoft-ru-data.ru/l
Source: zwM7Oe2e1l.exe, 00000002.00000003.369408265.000001F180247000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.368713421.000001F180247000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://microsoft-ru-data.ru/r
Source: zwM7Oe2e1l.exe, 00000002.00000003.363930144.000001F180242000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.364275197.000001F180242000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.364691804.000001F180245000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://microsoft-ru-data.ru/x
Source: zwM7Oe2e1l.exe, 00000002.00000003.366020901.000001F180265000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.366905937.000001F180268000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.366530703.000001F180265000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://microsoft-ru-data.ru:443/knock
Source: zwM7Oe2e1l.exe, 00000002.00000003.449602137.000001F180260000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.476939167.000001F180268000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.504317321.000001F180268000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584598044.000001F180268000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.530208861.000001F180268000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mis77.ru/
Source: unknownDNS traffic detected: queries for: microsoft-ru-data.ru
Source: zwM7Oe2e1l.exe, 00000002.00000000.362317260.00007FF7C400B000.00000008.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenameWoodySharpExecutor.dllF vs zwM7Oe2e1l.exe
Source: zwM7Oe2e1l.exe, 00000002.00000000.362317260.00007FF7C400B000.00000008.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenameWoodyPowerSession.dllD vs zwM7Oe2e1l.exe
Source: zwM7Oe2e1l.exe, 00000002.00000002.627759857.00007FF7C400F000.00000004.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenameWoodyPowerSession.dllD vs zwM7Oe2e1l.exe
Source: zwM7Oe2e1l.exeBinary or memory string: OriginalFilenameWoodySharpExecutor.dllF vs zwM7Oe2e1l.exe
Source: zwM7Oe2e1l.exeBinary or memory string: OriginalFilenameWoodyPowerSession.dllD vs zwM7Oe2e1l.exe
Source: zwM7Oe2e1l.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: zwM7Oe2e1l.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: zwM7Oe2e1l.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: zwM7Oe2e1l.exeVirustotal: Detection: 59%
Source: zwM7Oe2e1l.exeMetadefender: Detection: 14%
Source: zwM7Oe2e1l.exeReversingLabs: Detection: 61%
Source: zwM7Oe2e1l.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\zwM7Oe2e1l.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: zwM7Oe2e1l.exeStatic file information: TRID: Win64 Executable GUI Net Framework (217006/5) 47.53%
Source: classification engineClassification label: mal72.winEXE@1/0@21/2
Source: C:\Users\user\Desktop\zwM7Oe2e1l.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\zwM7Oe2e1l.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: zwM7Oe2e1l.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: zwM7Oe2e1l.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: zwM7Oe2e1l.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: zwM7Oe2e1l.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: zwM7Oe2e1l.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: zwM7Oe2e1l.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: zwM7Oe2e1l.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: zwM7Oe2e1l.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: zwM7Oe2e1l.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\hep2\build\c#\dll\WoodyPowerSession.pdb source: zwM7Oe2e1l.exe
Source: Binary string: C:\hep2\build\cpp\x64\bin\WoodyNode.pdb@ source: zwM7Oe2e1l.exe
Source: Binary string: C:\hep2\build\c#\dll\WoodySharpExecutor.pdb source: zwM7Oe2e1l.exe
Source: Binary string: C:\hep2\build\cpp\x64\bin\WoodyNode.pdb source: zwM7Oe2e1l.exe
Source: zwM7Oe2e1l.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: zwM7Oe2e1l.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: zwM7Oe2e1l.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: zwM7Oe2e1l.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: zwM7Oe2e1l.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: zwM7Oe2e1l.exeStatic PE information: section name: _RDATA

Hooking and other Techniques for Hiding and Protection

barindex
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Source: initial sampleIcon embedded in binary file: icon matches a legit application icon: icon1069.png
Source: C:\Users\user\Desktop\zwM7Oe2e1l.exeProcess information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\zwM7Oe2e1l.exe TID: 1072Thread sleep time: -1200000s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\zwM7Oe2e1l.exe TID: 5764Thread sleep time: -390000s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\zwM7Oe2e1l.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\zwM7Oe2e1l.exeThread delayed: delay time: 1200000Jump to behavior
Source: C:\Users\user\Desktop\zwM7Oe2e1l.exeThread delayed: delay time: 1200000Jump to behavior
Source: zwM7Oe2e1l.exe, 00000002.00000003.422943147.000001F180299000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000002.627564287.000001F180298000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584421261.000001F18029A000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.476693285.000001F180299000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.557214968.000001F18029A000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.396709540.000001F180292000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWm
Source: zwM7Oe2e1l.exe, 00000002.00000002.627384501.000001F180264000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.530200851.000001F180264000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.476900660.000001F180264000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584591844.000001F180264000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.557786417.000001F180264000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.449602137.000001F180260000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000002.627020793.000001F1801EB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: C:\Users\user\Desktop\zwM7Oe2e1l.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\zwM7Oe2e1l.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management InstrumentationPath InterceptionPath Interception1
Masquerading		OS Credential Dumping1
Security Software Discovery		Remote ServicesData from Local SystemExfiltration Over Other Network Medium2
Encrypted Channel		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts21
Virtualization/Sandbox Evasion		LSASS Memory21
Virtualization/Sandbox Evasion		Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
Non-Application Layer Protocol		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account Manager12
System Information Discovery		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration2
Application Layer Protocol		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDS1
Remote System Discovery		Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
zwM7Oe2e1l.exe59%VirustotalBrowse
zwM7Oe2e1l.exe14%MetadefenderBrowse
zwM7Oe2e1l.exe62%ReversingLabsWin64.Trojan.Dothetuk
zwM7Oe2e1l.exe100%AviraTR/Nanocode.qtdxl

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://microsoft-ru-data.ru/knockc0%Avira URL Cloudsafe
https://microsoft-ru-data.ru/Y0%Avira URL Cloudsafe
https://microsoft-ru-data.ru/knockd0%Avira URL Cloudsafe
https://microsoft-ru-data.ru/knocke0%Avira URL Cloudsafe
https://fns77.ru/knockC30%Avira URL Cloudsafe
https://fns77.ru:443/knockxGO60%Avira URL Cloudsafe
https://microsoft-ru-data.ru/knock%)0%Avira URL Cloudsafe
https://fns77.ru/knock0%Avira URL Cloudsafe
https://fns77.ru/knock?.0%Avira URL Cloudsafe
https://microsoft-ru-data.ru/ck0%Avira URL Cloudsafe
https://microsoft-ru-data.ru/0%Avira URL Cloudsafe
https://microsoft-ru-data.ru/knockW0%Avira URL Cloudsafe
https://fns77.ru/knockKkz0%Avira URL Cloudsafe
https://fns77.ru/knock)0O0%Avira URL Cloudsafe
https://microsoft-ru-data.ru/knockZ0%Avira URL Cloudsafe
https://microsoft-ru-data.ru/knocks)0%Avira URL Cloudsafe
https://microsoft-ru-data.ru/knock0%Avira URL Cloudsafe
https://mis77.ru/0%Avira URL Cloudsafe
https://microsoft-ru-data.ru/60%Avira URL Cloudsafe
https://microsoft-ru-data.ru/x0%Avira URL Cloudsafe
https://microsoft-ru-data.ru:443/knock0%Avira URL Cloudsafe
https://fns77.ru/knockr0%Avira URL Cloudsafe
https://fns77.ru/knockq0%Avira URL Cloudsafe
https://microsoft-ru-data.ru/ckW0%Avira URL Cloudsafe
https://fns77.ru/m0%Avira URL Cloudsafe
https://microsoft-ru-data.ru/ckZ0%Avira URL Cloudsafe
https://microsoft-ru-data.ru/knock#f10%Avira URL Cloudsafe
https://fns77.ru/e0%Avira URL Cloudsafe
https://fns77.ru/d0%Avira URL Cloudsafe
https://fns77.ru/0%Avira URL Cloudsafe
https://microsoft-ru-data.ru/l0%Avira URL Cloudsafe
https://microsoft-ru-data.ru/r0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
fns77.ru
194.87.218.140
truefalse
    		unknown
    microsoft-ru-data.ru
    		unknown
    		unknownfalse
      		unknown

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      https://microsoft-ru-data.ru/knockczwM7Oe2e1l.exe, 00000002.00000003.368713421.000001F180247000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://microsoft-ru-data.ru/YzwM7Oe2e1l.exe, 00000002.00000003.367111100.000001F180247000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.369408265.000001F180247000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.366618138.000001F180247000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.370201861.000001F180247000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.371162191.000001F180247000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://microsoft-ru-data.ru/knockdzwM7Oe2e1l.exe, 00000002.00000003.369394137.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.367767742.000001F180235000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://microsoft-ru-data.ru/knockezwM7Oe2e1l.exe, 00000002.00000003.366085455.000001F180235000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://fns77.ru/knockC3zwM7Oe2e1l.exe, 00000002.00000002.627362850.000001F180260000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://fns77.ru:443/knockxGO6zwM7Oe2e1l.exe, 00000002.00000003.449602137.000001F180260000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.476939167.000001F180268000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.504317321.000001F180268000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584598044.000001F180268000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.530208861.000001F180268000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://microsoft-ru-data.ru/knock%)zwM7Oe2e1l.exe, 00000002.00000003.371379761.000001F180275000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.370920493.000001F180275000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://fns77.ru/knockzwM7Oe2e1l.exe, 00000002.00000003.557772748.000001F180261000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.530234039.000001F180277000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.504276141.000001F180261000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.476801924.000001F180237000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.530110478.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.476883519.000001F180261000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.449653886.000001F18027F000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584585700.000001F180261000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000002.627247814.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.530193276.000001F180260000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.449602137.000001F180260000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.449519735.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.399547079.000001F180280000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.422978366.000001F180281000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.504027968.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584550699.000001F180237000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.476964147.000001F18027B000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.449633913.000001F18027B000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000002.627020793.000001F1801EB000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.504420886.000001F18027C000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584630455.000001F180277000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://fns77.ru/knock?.zwM7Oe2e1l.exe, 00000002.00000003.449653886.000001F18027F000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.449633913.000001F18027B000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://microsoft-ru-data.ru/ckzwM7Oe2e1l.exe, 00000002.00000003.369408265.000001F180247000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://microsoft-ru-data.ru/zwM7Oe2e1l.exe, 00000002.00000003.364691804.000001F180245000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000002.627020793.000001F1801EB000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.369036380.000001F180264000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.370920493.000001F180275000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://microsoft-ru-data.ru/knockWzwM7Oe2e1l.exe, 00000002.00000003.364275197.000001F180242000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://fns77.ru/knockKkzzwM7Oe2e1l.exe, 00000002.00000002.627247814.000001F180235000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://fns77.ru/knock)0OzwM7Oe2e1l.exe, 00000002.00000003.584585700.000001F180261000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://microsoft-ru-data.ru/knockZzwM7Oe2e1l.exe, 00000002.00000003.364275197.000001F180242000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://microsoft-ru-data.ru/knocks)zwM7Oe2e1l.exe, 00000002.00000003.369320038.000001F180278000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.369901342.000001F180278000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.370610227.000001F180278000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.370146613.000001F180278000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.370920493.000001F180275000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://microsoft-ru-data.ru/knockzwM7Oe2e1l.exe, 00000002.00000003.367781850.000001F180247000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.371141170.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.365233268.000001F180247000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.366085455.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.363930144.000001F180242000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.370610227.000001F180278000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.365226384.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.370146613.000001F180278000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.367767742.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.366094915.000001F180247000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.370181710.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.369088197.000001F180278000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.368622773.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.367097339.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.370920493.000001F180275000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://mis77.ru/zwM7Oe2e1l.exe, 00000002.00000003.449602137.000001F180260000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.476939167.000001F180268000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.504317321.000001F180268000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584598044.000001F180268000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.530208861.000001F180268000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://microsoft-ru-data.ru/6zwM7Oe2e1l.exe, 00000002.00000003.367111100.000001F180247000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://microsoft-ru-data.ru/xzwM7Oe2e1l.exe, 00000002.00000003.363930144.000001F180242000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.364275197.000001F180242000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.364691804.000001F180245000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://microsoft-ru-data.ru:443/knockzwM7Oe2e1l.exe, 00000002.00000003.366020901.000001F180265000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.366905937.000001F180268000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.366530703.000001F180265000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://fns77.ru/knockrzwM7Oe2e1l.exe, 00000002.00000003.504420886.000001F18027C000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://fns77.ru/knockqzwM7Oe2e1l.exe, 00000002.00000003.422978366.000001F180281000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://microsoft-ru-data.ru/ckWzwM7Oe2e1l.exe, 00000002.00000003.365233268.000001F180247000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://fns77.ru/mzwM7Oe2e1l.exe, 00000002.00000003.557540751.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584696071.000001F180285000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.557947549.000001F180277000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.476801924.000001F180237000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.530110478.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000002.627247814.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.449519735.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.504027968.000001F180235000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584550699.000001F180237000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584630455.000001F180277000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://microsoft-ru-data.ru/ckZzwM7Oe2e1l.exe, 00000002.00000003.366094915.000001F180247000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://microsoft-ru-data.ru/knock#f1zwM7Oe2e1l.exe, 00000002.00000003.365226384.000001F180235000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://fns77.ru/ezwM7Oe2e1l.exe, 00000002.00000003.504433768.000001F180285000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.476972337.000001F180283000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.530234039.000001F180277000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.504420886.000001F18027C000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://fns77.ru/dzwM7Oe2e1l.exe, 00000002.00000003.584696071.000001F180285000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584630455.000001F180277000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://fns77.ru/zwM7Oe2e1l.exe, 00000002.00000003.504283286.000001F180265000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.504433768.000001F180285000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584696071.000001F180285000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000002.627384501.000001F180264000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.530200851.000001F180264000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.557947549.000001F180277000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.476972337.000001F180283000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.530234039.000001F180277000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.476900660.000001F180264000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.449641977.000001F180283000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584591844.000001F180264000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000002.627482009.000001F18027B000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.557786417.000001F180264000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.449602137.000001F180260000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.399547079.000001F180280000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.422978366.000001F180281000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.504420886.000001F18027C000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.584630455.000001F180277000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://microsoft-ru-data.ru/lzwM7Oe2e1l.exe, 00000002.00000002.627020793.000001F1801EB000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown
      https://microsoft-ru-data.ru/rzwM7Oe2e1l.exe, 00000002.00000003.369408265.000001F180247000.00000004.00000020.00020000.00000000.sdmp, zwM7Oe2e1l.exe, 00000002.00000003.368713421.000001F180247000.00000004.00000020.00020000.00000000.sdmpfalse
      • Avira URL Cloud: safe
      		unknown

      World Map of Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public IPs

      IPDomainCountryFlagASNASN NameMalicious
      194.87.218.140
      		fns77.ruRussian Federation
      		197695AS-REGRUfalse

      Private

      IP
      192.168.2.1

      General Information

      Joe Sandbox Version:35.0.0 Citrine
      Analysis ID:679156
      Start date and time: 05/08/202211:01:412022-08-05 11:01:41 +02:00
      Joe Sandbox Product:CloudBasic
      Overall analysis duration:0h 5m 53s
      Hypervisor based Inspection enabled:false
      Report type:full
      Sample file name:zwM7Oe2e1l (renamed file extension from none to exe)
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
      Number of analysed new started processes analysed:19
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • HDC enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Detection:MAL
      Classification:mal72.winEXE@1/0@21/2
      EGA Information:Failed
      HDC Information:Failed
      HCA Information:
      • Successful, ratio: 100%
      • Number of executed functions: 0
      • Number of non-executed functions: 0
      Cookbook Comments:
      • Adjust boot time
      • Enable AMSI

      Warnings

      • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
      • Excluded IPs from analysis (whitelisted): 23.211.6.115
      • Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, login.live.com, store-images.s-microsoft.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net
      • Not all processes where analyzed, report is missing behavior information
      • Report size getting too big, too many NtDeviceIoControlFile calls found.

      Simulations

      Behavior and APIs

      TimeTypeDescription
      11:02:50API Interceptor37x Sleep call for process: zwM7Oe2e1l.exe modified

      Joe Sandbox View / Context

      IPs

      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
      194.87.218.140updater.exeGet hashmaliciousBrowse

        Domains

        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
        fns77.ruupdater.exeGet hashmaliciousBrowse
        • 194.87.218.140

        ASNs

        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
        AS-REGRU43GXN1Cg7H.exeGet hashmaliciousBrowse
        • 194.87.216.23
        9A2A541C7AE263013CF22EFDBAE7B8F11DA36A07C41CB.exeGet hashmaliciousBrowse
        • 194.87.216.18
        laburo.docGet hashmaliciousBrowse
        • 31.31.198.186
        Invoice SIL-EDI-0-2022-392.exeGet hashmaliciousBrowse
        • 194.58.112.174
        list049.exeGet hashmaliciousBrowse
        • 194.58.112.174
        product_list_95849.exeGet hashmaliciousBrowse
        • 194.58.112.174
        Payment Copy.jsGet hashmaliciousBrowse
        • 31.31.198.250
        http://megafonru.ruGet hashmaliciousBrowse
        • 194.67.71.27
        325mMYE05v.exeGet hashmaliciousBrowse
        • 37.140.192.211
        325mMYE05v.exeGet hashmaliciousBrowse
        • 37.140.192.211
        WYq5dZkgCM.exeGet hashmaliciousBrowse
        • 194.87.186.140
        RFQ 3436-01902.exeGet hashmaliciousBrowse
        • 195.133.19.4
        Agency Appointment DA2100133.exeGet hashmaliciousBrowse
        • 195.133.19.4
        http://norge.ru/news/2017/11/09/27146.htmlGet hashmaliciousBrowse
        • 89.108.97.2
        http://norge.ru/news/2017/11/09/27146.htmlGet hashmaliciousBrowse
        • 89.108.97.2
        CORREO-06062022.xlsGet hashmaliciousBrowse
        • 31.31.198.218
        soA6RkzSx4.dllGet hashmaliciousBrowse
        • 194.87.194.184
        https://bynnn99frmio.zachgodin.com/?=lmdimeler@vectorsecurity.comGet hashmaliciousBrowse
        • 195.133.18.113
        TWN0714301QSMoBpOLwxl.exeGet hashmaliciousBrowse
        • 195.133.19.4
        238458E1951647FE6B80AF63514E789F3C7A4CCF72CF7.exeGet hashmaliciousBrowse
        • 195.133.18.236

        JA3 Fingerprints

        ⊘No context

        Dropped Files

        ⊘No context

        Created / dropped Files

        ⊘No created / dropped files found

        Static File Info

        General

        File type:PE32+ executable (GUI) x86-64, for MS Windows
        Entropy (8bit):5.88597431896217
        TrID:
        • Win64 Executable GUI Net Framework (217006/5) 47.53%
        • Win64 Executable GUI (202006/5) 44.25%
        • Win64 Executable (generic) Net Framework (21505/4) 4.71%
        • Win64 Executable (generic) (12005/4) 2.63%
        • Generic Win/DOS Executable (2004/3) 0.44%
        File name:zwM7Oe2e1l.exe
        File size:702976
        MD5:f1ab9ed37b68ace769dccaa693f162e0
        SHA1:4fc5eea47502e6ebf089910be10790614c4d4b54
        SHA256:b65bc098b475996eaabbb02bb5fee19a18c6ff2eee0062353aff696356e73b7a
        SHA512:30e0f6b070bb91443d908fb7a088629da7559f9d6a30873274b06825e861bdf122d669b16dbb707f7d0d4e7c8a7189ffef856b4a5bd6af7458b39e4e1588577e
        SSDEEP:6144:b8BIo2CR/5dEDzWfv+edsMv5kTprDd/d9mohH0gCMLM4nDp3EK4:bmInAhdEKvPXvYrR/moLS
        TLSH:5EE4F8076178EAA5F46DB1F8E5569902FA7D3C05036375EB33B2B27A1E331915F3A220
        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g<S.#]=.#]=.#]=.=...!]=.76>.)]=.769.7]=.768..]=.A%9.1]=.A%>.)]=.A%8.v]=.76<.>]=.#]<..]=..$4.?]=..$.."]=..$?."]=.Rich#]=........

        File Icon

        Icon Hash:74fcd0d2d6d6d0dc

        Static PE Info

        General

        Entrypoint:0x140036830
        Entrypoint Section:.text
        Digitally signed:false
        Imagebase:0x140000000
        Subsystem:windows gui
        Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
        DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
        Time Stamp:0x6298BBD9 [Thu Jun 2 13:32:09 2022 UTC]
        TLS Callbacks:
        CLR (.Net) Version:
        OS Version Major:6
        OS Version Minor:0
        File Version Major:6
        File Version Minor:0
        Subsystem Version Major:6
        Subsystem Version Minor:0
        Import Hash:4b5d320a7d2f87857833ae400245b4ca

        Entrypoint Preview

        Instruction
        dec eax
        sub esp, 28h
        call 00007F0C9CD4FDC4h
        dec eax
        add esp, 28h
        jmp 00007F0C9CD4F6C7h
        int3
        int3
        inc eax
        push ebx
        dec eax
        sub esp, 20h
        dec eax
        mov ebx, ecx
        jmp 00007F0C9CD4F861h
        dec eax
        mov ecx, ebx
        call 00007F0C9CD58FAAh
        test eax, eax
        je 00007F0C9CD4F865h
        dec eax
        mov ecx, ebx
        call 00007F0C9CD59002h
        dec eax
        test eax, eax
        je 00007F0C9CD4F839h
        dec eax
        add esp, 20h
        pop ebx
        ret
        dec eax
        cmp ebx, FFFFFFFFh
        je 00007F0C9CD4F858h
        call 00007F0C9CD50148h
        int3
        call 00007F0C9CD1A276h
        int3
        jmp 00007F0C9CD5015Ch
        int3
        int3
        int3
        inc eax
        push ebx
        dec eax
        sub esp, 20h
        dec eax
        lea eax, dword ptr [00029023h]
        dec eax
        mov ebx, ecx
        dec eax
        mov dword ptr [ecx], eax
        test dl, 00000001h
        je 00007F0C9CD4F85Ch
        mov edx, 00000018h
        call 00007F0C9CD4F82Bh
        dec eax
        mov eax, ebx
        dec eax
        add esp, 20h
        pop ebx
        ret
        int3
        dec eax
        sub esp, 28h
        call 00007F0C9CD502D8h
        test eax, eax
        je 00007F0C9CD4F873h
        dec eax
        mov eax, dword ptr [00000030h]
        dec eax
        mov ecx, dword ptr [eax+08h]
        jmp 00007F0C9CD4F857h
        dec eax
        cmp ecx, eax
        je 00007F0C9CD4F866h
        xor eax, eax
        dec eax
        cmpxchg dword ptr [00049438h], ecx
        jne 00007F0C9CD4F840h
        xor al, al
        dec eax
        add esp, 28h
        ret
        mov al, 01h
        jmp 00007F0C9CD4F849h
        int3
        int3
        int3
        inc eax
        push ebx
        dec eax
        sub esp, 20h
        movzx eax, byte ptr [eax]

        Rich Headers

        Programming Language:
        • [IMP] VS2008 build 21022

        Data Directories

        NameVirtual AddressVirtual Size Is in Section
        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IMPORT0x78acc0x140.rdata
        IMAGE_DIRECTORY_ENTRY_RESOURCE0x870000x28a49.rsrc
        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x820000x3de0.pdata
        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
        IMAGE_DIRECTORY_ENTRY_BASERELOC0xb00000xa44.reloc
        IMAGE_DIRECTORY_ENTRY_DEBUG0x6f2c00x70.rdata
        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x6f1800x140.rdata
        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_IAT0x5f0000x778.rdata
        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

        Sections

        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
        .text0x10000x5d9980x5da00False0.48414813501335113data6.384865843819584IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
        .rdata0x5f0000x1b47e0x1b600False0.473128924086758data5.389641760353324IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .data0x7b0000x69780x4e00False0.30063100961538464DOS executable (block device driver\337-\231+])4.3547329989776475IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
        .pdata0x820000x3de00x3e00False0.4913684475806452data5.689805709952984IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        _RDATA0x860000x15c0x200False0.40234375data3.295320723060995IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .rsrc0x870000x28a490x28c00False0.07310439033742332data2.947706444275165IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
        .reloc0xb00000xa440xc00False0.458984375data5.091425814699151IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

        Resources

        NameRVASizeTypeLanguageCountry
        RT_ICON0x875240x2e8dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 4279238655, next used block 240
        RT_ICON0x8780c0x128GLS_BINARY_LSB_FIRST
        RT_ICON0x879340x2ca8dBase IV DBT of \300.DBF, block length 9216, next free block index 40, next free block 0, next used block 0
        RT_ICON0x8a5dc0x1bc8data
        RT_ICON0x8c1a40x1628dBase IV DBT of \200.DBF, blocks size 0, block length 4096, next free block index 40, next free block 353703189, next used block 353703189
        RT_ICON0x8d7cc0x1418data
        RT_ICON0x8ebe40xea8data
        RT_ICON0x8fa8c0xba8data
        RT_ICON0x906340x8a8dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0
        RT_ICON0x90edc0x6c8data
        RT_ICON0x915a40x608data
        RT_ICON0x91bac0x568GLS_BINARY_LSB_FIRST
        RT_ICON0x921140xb70PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
        RT_ICON0x92c840x94a8data
        RT_ICON0x9c12c0x5488data
        RT_ICON0xa15b40x4228dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 49407, next used block 4294909696
        RT_ICON0xa57dc0x3a48data
        RT_ICON0xa92240x25a8data
        RT_ICON0xab7cc0x1a68data
        RT_ICON0xad2340x10a8data
        RT_ICON0xae2dc0x988data
        RT_ICON0xaec640x6b8data
        RT_ICON0xaf31c0x468GLS_BINARY_LSB_FIRST
        RT_GROUP_ICON0xaf7840x148data
        RT_MANIFEST0xaf8cc0x17dXML 1.0 document textEnglishUnited States

        Imports

        DLLImport
        KERNEL32.dllInitializeCriticalSectionEx, DecodePointer, LCMapStringEx, VerifyVersionInfoW, WriteConsoleW, ReadConsoleW, SetFilePointerEx, GetConsoleMode, GetConsoleOutputCP, FlushFileBuffers, HeapSize, HeapReAlloc, LCMapStringW, CompareStringW, SetErrorMode, EnumSystemLocalesW, GetUserDefaultLCID, WaitForMultipleObjects, CreateThread, LocalAlloc, Sleep, LocalFree, CreateMutexW, WaitForSingleObject, ReleaseMutex, CreateEventW, SetEvent, CloseHandle, ResetEvent, HeapAlloc, GetProcessHeap, ReadFile, CreatePipe, GetCurrentDirectoryA, ExitThread, CreateProcessW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, GlobalFree, QueryDosDeviceW, GetVolumeInformationW, FindFirstVolumeW, HeapFree, GetComputerNameExW, FreeEnvironmentStringsW, CreateToolhelp32Snapshot, GetLastError, Process32NextW, Process32FirstW, GetNativeSystemInfo, FindVolumeClose, GetVolumePathNamesForVolumeNameW, FindNextVolumeW, GetEnvironmentStringsW, FindFirstFileW, GetFileSizeEx, FindNextFileW, CreateFileW, GetFileAttributesW, FileTimeToSystemTime, GetFileTime, VirtualFree, WriteFile, VirtualAlloc, SetFilePointer, DeleteFileW, GetFileSize, MoveFileW, GlobalSize, LoadLibraryA, GetProcAddress, GlobalLock, FreeLibrary, GlobalUnlock, GetModuleFileNameA, VirtualAllocEx, CreateProcessA, GetComputerNameA, OpenProcess, WriteProcessMemory, CreateRemoteThread, RaiseException, SetLastError, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetStdHandle, GetModuleFileNameW, GetCommandLineA, GetCommandLineW, FindClose, FindFirstFileExW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetEnvironmentVariableW, SetStdHandle, GetFileType, GetStringTypeW, GetLocaleInfoW, IsValidLocale
        WS2_32.dllinet_ntop
        IPHLPAPI.DLLConvertLengthToIpv4Mask, GetAdaptersAddresses, GetAdaptersInfo
        WINHTTP.dllWinHttpSetOption, WinHttpGetIEProxyConfigForCurrentUser, WinHttpOpen, WinHttpAddRequestHeaders, WinHttpQueryHeaders, WinHttpWriteData, WinHttpQueryDataAvailable, WinHttpCloseHandle, WinHttpGetProxyForUrl, WinHttpConnect, WinHttpReadData, WinHttpReceiveResponse, WinHttpOpenRequest, WinHttpSendRequest
        NETAPI32.dllNetApiBufferFree, NetUserEnum
        bcrypt.dllBCryptCloseAlgorithmProvider, BCryptDestroyKey, BCryptDecrypt, BCryptSetProperty, BCryptGenerateSymmetricKey, BCryptOpenAlgorithmProvider, BCryptImportKeyPair, BCryptGetProperty, BCryptEncrypt
        gdiplus.dllGdipCloneImage, GdipGetImageEncoders, GdiplusStartup, GdipSaveImageToStream, GdipGetImageEncodersSize, GdipFree, GdiplusShutdown, GdipAlloc, GdipDisposeImage, GdipCreateBitmapFromHBITMAP
        ntdll.dllRtlUnwind, VerSetConditionMask, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, NtGetContextThread, NtSetContextThread, NtWriteVirtualMemory, NtResumeThread, RtlUnwindEx, RtlPcToFileHeader
        mscoree.dllCLRCreateInstance, CorBindToRuntime
        USER32.dllGetSystemMetrics, CloseWindowStation, GetDC, GetThreadDesktop, CloseDesktop, SetThreadDesktop, GetProcessWindowStation, GetDesktopWindow, OpenInputDesktop, SetProcessWindowStation, OpenWindowStationA, ReleaseDC
        GDI32.dllCreateCompatibleBitmap, SelectObject, DeleteObject, CreateCompatibleDC, DeleteDC, StretchBlt
        ADVAPI32.dllCryptAcquireContextW, CryptGenRandom, GetTokenInformation, RegQueryValueExW, GetUserNameW, ConvertSidToStringSidW, RegOpenKeyExW, RegEnumKeyExW, RegQueryInfoKeyW, RegCloseKey, LookupAccountSidW, GetSecurityInfo, OpenProcessToken, RevertToSelf, ConvertSecurityDescriptorToStringSecurityDescriptorW, ConvertStringSidToSidW
        SHELL32.dllCommandLineToArgvW
        ole32.dllCreateStreamOnHGlobal, GetHGlobalFromStream
        OLEAUT32.dllSafeArrayDestroyData, SysAllocString, SafeArrayPutElement, SysFreeString, SafeArrayCreate, SafeArrayCreateVector, SafeArrayAccessData, SafeArrayUnaccessData, SafeArrayDestroy

        Possible Origin

        Language of compilation systemCountry where language is spokenMap
        EnglishUnited States

        Network Behavior

        Snort IDS Alerts

        TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
        192.168.2.68.8.8.859293532037937 08/05/22-11:02:51.521843UDP2037937ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup5929353192.168.2.68.8.8.8
        192.168.2.68.8.8.855201532037937 08/05/22-11:02:51.225834UDP2037937ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup5520153192.168.2.68.8.8.8
        192.168.2.68.8.8.856550532037937 08/05/22-11:02:54.471667UDP2037937ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup5655053192.168.2.68.8.8.8
        192.168.2.68.8.8.856591532037937 08/05/22-11:02:52.438751UDP2037937ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup5659153192.168.2.68.8.8.8
        192.168.2.68.8.8.855788532037938 08/05/22-11:04:47.473277UDP2037938ET TROJAN Woody RAT CnC Domain (fns77 .ru) in DNS Lookup5578853192.168.2.68.8.8.8
        192.168.2.68.8.8.861116532037937 08/05/22-11:02:53.326830UDP2037937ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup6111653192.168.2.68.8.8.8
        192.168.2.68.8.8.858723532037937 08/05/22-11:02:51.809410UDP2037937ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup5872353192.168.2.68.8.8.8
        192.168.2.68.8.8.863104532037938 08/05/22-11:04:09.074489UDP2037938ET TROJAN Woody RAT CnC Domain (fns77 .ru) in DNS Lookup6310453192.168.2.68.8.8.8
        192.168.2.68.8.8.858689532037938 08/05/22-11:03:44.188103UDP2037938ET TROJAN Woody RAT CnC Domain (fns77 .ru) in DNS Lookup5868953192.168.2.68.8.8.8
        192.168.2.68.8.8.861607532037937 08/05/22-11:02:54.097826UDP2037937ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup6160753192.168.2.68.8.8.8
        192.168.2.68.8.8.854015532037938 08/05/22-11:03:31.447464UDP2037938ET TROJAN Woody RAT CnC Domain (fns77 .ru) in DNS Lookup5401553192.168.2.68.8.8.8
        192.168.2.68.8.8.865367532037938 08/05/22-11:04:21.925023UDP2037938ET TROJAN Woody RAT CnC Domain (fns77 .ru) in DNS Lookup6536753192.168.2.68.8.8.8
        192.168.2.68.8.8.860350532037937 08/05/22-11:02:52.686111UDP2037937ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup6035053192.168.2.68.8.8.8
        192.168.2.68.8.8.851748532037937 08/05/22-11:02:52.976163UDP2037937ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup5174853192.168.2.68.8.8.8
        192.168.2.68.8.8.859871532037938 08/05/22-11:03:07.881163UDP2037938ET TROJAN Woody RAT CnC Domain (fns77 .ru) in DNS Lookup5987153192.168.2.68.8.8.8
        192.168.2.68.8.8.851971532037937 08/05/22-11:02:52.201354UDP2037937ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup5197153192.168.2.68.8.8.8
        192.168.2.68.8.8.851194532037938 08/05/22-11:03:18.845501UDP2037938ET TROJAN Woody RAT CnC Domain (fns77 .ru) in DNS Lookup5119453192.168.2.68.8.8.8
        192.168.2.68.8.8.857669532037938 08/05/22-11:04:34.382443UDP2037938ET TROJAN Woody RAT CnC Domain (fns77 .ru) in DNS Lookup5766953192.168.2.68.8.8.8
        192.168.2.68.8.8.850958532037937 08/05/22-11:02:53.714812UDP2037937ET TROJAN Woody RAT CnC Domain (microsoft-ru-data .ru) in DNS Lookup5095853192.168.2.68.8.8.8
        192.168.2.68.8.8.852858532037938 08/05/22-11:02:54.797599UDP2037938ET TROJAN Woody RAT CnC Domain (fns77 .ru) in DNS Lookup5285853192.168.2.68.8.8.8
        192.168.2.68.8.8.853049532037938 08/05/22-11:03:56.868334UDP2037938ET TROJAN Woody RAT CnC Domain (fns77 .ru) in DNS Lookup5304953192.168.2.68.8.8.8

        Network Port Distribution

        TCP Packets

        TimestampSource PortDest PortSource IPDest IP
        Aug 5, 2022 11:02:54.932476997 CEST49763443192.168.2.6194.87.218.140
        Aug 5, 2022 11:02:54.932529926 CEST44349763194.87.218.140192.168.2.6
        Aug 5, 2022 11:02:54.932723045 CEST49763443192.168.2.6194.87.218.140
        Aug 5, 2022 11:02:54.938019037 CEST49763443192.168.2.6194.87.218.140
        Aug 5, 2022 11:02:54.938045979 CEST44349763194.87.218.140192.168.2.6
        Aug 5, 2022 11:02:56.702358007 CEST44349763194.87.218.140192.168.2.6
        Aug 5, 2022 11:02:56.703921080 CEST49764443192.168.2.6194.87.218.140
        Aug 5, 2022 11:02:56.703977108 CEST44349764194.87.218.140192.168.2.6
        Aug 5, 2022 11:02:56.704104900 CEST49764443192.168.2.6194.87.218.140
        Aug 5, 2022 11:02:56.704849958 CEST49764443192.168.2.6194.87.218.140
        Aug 5, 2022 11:02:56.704869986 CEST44349764194.87.218.140192.168.2.6
        Aug 5, 2022 11:02:59.874269009 CEST44349764194.87.218.140192.168.2.6
        Aug 5, 2022 11:02:59.889511108 CEST49765443192.168.2.6194.87.218.140
        Aug 5, 2022 11:02:59.889550924 CEST44349765194.87.218.140192.168.2.6
        Aug 5, 2022 11:02:59.889677048 CEST49765443192.168.2.6194.87.218.140
        Aug 5, 2022 11:02:59.890806913 CEST49765443192.168.2.6194.87.218.140
        Aug 5, 2022 11:02:59.890829086 CEST44349765194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:03.038507938 CEST44349765194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:03.058084965 CEST49766443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:03.058160067 CEST44349766194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:03.058295012 CEST49766443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:03.058861971 CEST49766443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:03.058887005 CEST44349766194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:06.206222057 CEST44349766194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:07.906095028 CEST49768443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:07.906147003 CEST44349768194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:07.906265020 CEST49768443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:07.908401012 CEST49768443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:07.908430099 CEST44349768194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:09.278125048 CEST44349768194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:09.279557943 CEST49769443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:09.279584885 CEST44349769194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:09.279737949 CEST49769443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:09.280375004 CEST49769443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:09.280385017 CEST44349769194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:12.414793015 CEST44349769194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:12.431951046 CEST49770443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:12.432001114 CEST44349770194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:12.432136059 CEST49770443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:12.432653904 CEST49770443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:12.432673931 CEST44349770194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:15.486304998 CEST44349770194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:15.492050886 CEST49771443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:15.492100000 CEST44349771194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:15.492202044 CEST49771443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:15.492857933 CEST49771443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:15.492883921 CEST44349771194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:18.626404047 CEST44349771194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:18.924467087 CEST49772443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:18.924510956 CEST44349772194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:18.924639940 CEST49772443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:18.925410032 CEST49772443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:18.925437927 CEST44349772194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:21.694861889 CEST44349772194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:21.696540117 CEST49773443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:21.696593046 CEST44349773194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:21.696805000 CEST49773443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:21.697556019 CEST49773443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:21.697581053 CEST44349773194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:24.862427950 CEST44349773194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:24.879900932 CEST49774443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:24.879965067 CEST44349774194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:24.880069017 CEST49774443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:24.880968094 CEST49774443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:24.880989075 CEST44349774194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:28.030345917 CEST44349774194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:28.032383919 CEST49785443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:28.032428980 CEST44349785194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:28.032536030 CEST49785443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:28.033236980 CEST49785443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:28.033261061 CEST44349785194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:31.102269888 CEST44349785194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:31.623568058 CEST49788443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:31.623613119 CEST44349788194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:31.623712063 CEST49788443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:31.624454021 CEST49788443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:31.624475956 CEST44349788194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:34.238286972 CEST44349788194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:34.240503073 CEST49791443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:34.240567923 CEST44349791194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:34.240694046 CEST49791443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:34.241524935 CEST49791443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:34.241550922 CEST44349791194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:37.406433105 CEST44349791194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:37.408396959 CEST49796443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:37.408461094 CEST44349796194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:37.408571005 CEST49796443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:37.410048962 CEST49796443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:37.410079956 CEST44349796194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:40.578552961 CEST44349796194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:40.579910994 CEST49797443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:40.579965115 CEST44349797194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:40.580050945 CEST49797443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:40.580753088 CEST49797443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:40.580779076 CEST44349797194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:43.755327940 CEST44349797194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:44.207053900 CEST49799443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:44.207096100 CEST44349799194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:44.207191944 CEST49799443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:44.207844973 CEST49799443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:44.207856894 CEST44349799194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:46.816057920 CEST44349799194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:46.818622112 CEST49801443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:46.818687916 CEST44349801194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:46.818767071 CEST49801443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:46.819339991 CEST49801443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:46.819372892 CEST44349801194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:49.950562954 CEST44349801194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:49.955228090 CEST49807443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:49.955286026 CEST44349807194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:49.955414057 CEST49807443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:49.956731081 CEST49807443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:49.956772089 CEST44349807194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:53.027072906 CEST44349807194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:53.030917883 CEST49809443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:53.030966997 CEST44349809194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:53.031052113 CEST49809443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:53.034261942 CEST49809443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:53.034286022 CEST44349809194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:56.158272982 CEST44349809194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:56.991477013 CEST49810443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:56.991529942 CEST44349810194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:56.991652012 CEST49810443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:56.992511034 CEST49810443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:56.992539883 CEST44349810194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:59.234388113 CEST44349810194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:59.235883951 CEST49812443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:59.235929966 CEST44349812194.87.218.140192.168.2.6
        Aug 5, 2022 11:03:59.236027002 CEST49812443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:59.236669064 CEST49812443192.168.2.6194.87.218.140
        Aug 5, 2022 11:03:59.236696005 CEST44349812194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:02.398313999 CEST44349812194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:02.402153969 CEST49814443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:02.402241945 CEST44349814194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:02.402348042 CEST49814443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:02.403140068 CEST49814443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:02.403160095 CEST44349814194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:05.566581011 CEST44349814194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:05.567682028 CEST49815443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:05.567733049 CEST44349815194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:05.567867041 CEST49815443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:05.568902016 CEST49815443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:05.568928003 CEST44349815194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:08.734211922 CEST44349815194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:09.185636997 CEST49817443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:09.185683966 CEST44349817194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:09.185760975 CEST49817443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:09.186444044 CEST49817443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:09.186461926 CEST44349817194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:11.902477980 CEST44349817194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:11.903633118 CEST49819443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:11.903682947 CEST44349819194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:11.903754950 CEST49819443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:11.904336929 CEST49819443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:11.904361010 CEST44349819194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:15.070261955 CEST44349819194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:15.077869892 CEST49820443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:15.077929020 CEST44349820194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:15.078031063 CEST49820443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:15.078761101 CEST49820443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:15.078783989 CEST44349820194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:18.238382101 CEST44349820194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:18.283792973 CEST49825443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:18.283854008 CEST44349825194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:18.283942938 CEST49825443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:18.334884882 CEST49825443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:18.334954977 CEST44349825194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:21.406284094 CEST44349825194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:21.950527906 CEST49832443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:21.950567961 CEST44349832194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:21.959513903 CEST49832443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:21.961781979 CEST49832443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:21.961807013 CEST44349832194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:24.542327881 CEST44349832194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:24.547610044 CEST49843443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:24.547657013 CEST44349843194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:24.548091888 CEST49843443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:24.548834085 CEST49843443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:24.548856974 CEST44349843194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:27.710249901 CEST44349843194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:27.762255907 CEST49857443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:27.762324095 CEST44349857194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:27.762449980 CEST49857443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:27.767251015 CEST49857443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:27.767281055 CEST44349857194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:30.942583084 CEST44349857194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:30.944616079 CEST49867443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:30.944684982 CEST44349867194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:30.944788933 CEST49867443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:30.945405006 CEST49867443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:30.945426941 CEST44349867194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:34.110446930 CEST44349867194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:34.406443119 CEST49876443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:34.406491995 CEST44349876194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:34.406559944 CEST49876443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:34.407229900 CEST49876443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:34.407248974 CEST44349876194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:37.278580904 CEST44349876194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:37.279819012 CEST49881443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:37.279865980 CEST44349881194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:37.279983997 CEST49881443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:37.280466080 CEST49881443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:37.280486107 CEST44349881194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:40.446192980 CEST44349881194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:40.448676109 CEST49882443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:40.448718071 CEST44349882194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:40.448806047 CEST49882443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:40.449878931 CEST49882443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:40.449892998 CEST44349882194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:43.614578009 CEST44349882194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:43.616501093 CEST49883443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:43.616548061 CEST44349883194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:43.616683006 CEST49883443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:43.617208004 CEST49883443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:43.617227077 CEST44349883194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:46.782454967 CEST44349883194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:47.499797106 CEST49885443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:47.499834061 CEST44349885194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:47.499933004 CEST49885443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:47.502367020 CEST49885443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:47.502383947 CEST44349885194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:49.950455904 CEST44349885194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:49.951689005 CEST49886443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:49.951730013 CEST44349886194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:49.951836109 CEST49886443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:49.952431917 CEST49886443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:49.952446938 CEST44349886194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:53.118412018 CEST44349886194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:53.123657942 CEST49887443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:53.123709917 CEST44349887194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:53.123797894 CEST49887443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:53.125271082 CEST49887443192.168.2.6194.87.218.140
        Aug 5, 2022 11:04:53.125309944 CEST44349887194.87.218.140192.168.2.6
        Aug 5, 2022 11:04:54.964365005 CEST49887443192.168.2.6194.87.218.140

        UDP Packets

        TimestampSource PortDest PortSource IPDest IP
        Aug 5, 2022 11:02:51.225833893 CEST5520153192.168.2.68.8.8.8
        Aug 5, 2022 11:02:51.242561102 CEST53552018.8.8.8192.168.2.6
        Aug 5, 2022 11:02:51.521842957 CEST5929353192.168.2.68.8.8.8
        Aug 5, 2022 11:02:51.541172028 CEST53592938.8.8.8192.168.2.6
        Aug 5, 2022 11:02:51.809410095 CEST5872353192.168.2.68.8.8.8
        Aug 5, 2022 11:02:51.828824997 CEST53587238.8.8.8192.168.2.6
        Aug 5, 2022 11:02:52.201354027 CEST5197153192.168.2.68.8.8.8
        Aug 5, 2022 11:02:52.220902920 CEST53519718.8.8.8192.168.2.6
        Aug 5, 2022 11:02:52.438750982 CEST5659153192.168.2.68.8.8.8
        Aug 5, 2022 11:02:52.457427025 CEST53565918.8.8.8192.168.2.6
        Aug 5, 2022 11:02:52.686110973 CEST6035053192.168.2.68.8.8.8
        Aug 5, 2022 11:02:52.705450058 CEST53603508.8.8.8192.168.2.6
        Aug 5, 2022 11:02:52.976162910 CEST5174853192.168.2.68.8.8.8
        Aug 5, 2022 11:02:52.995296001 CEST53517488.8.8.8192.168.2.6
        Aug 5, 2022 11:02:53.326829910 CEST6111653192.168.2.68.8.8.8
        Aug 5, 2022 11:02:53.343807936 CEST53611168.8.8.8192.168.2.6
        Aug 5, 2022 11:02:53.714812040 CEST5095853192.168.2.68.8.8.8
        Aug 5, 2022 11:02:53.735369921 CEST53509588.8.8.8192.168.2.6
        Aug 5, 2022 11:02:54.097826004 CEST6160753192.168.2.68.8.8.8
        Aug 5, 2022 11:02:54.117041111 CEST53616078.8.8.8192.168.2.6
        Aug 5, 2022 11:02:54.471667051 CEST5655053192.168.2.68.8.8.8
        Aug 5, 2022 11:02:54.490464926 CEST53565508.8.8.8192.168.2.6
        Aug 5, 2022 11:02:54.797599077 CEST5285853192.168.2.68.8.8.8
        Aug 5, 2022 11:02:54.908832073 CEST53528588.8.8.8192.168.2.6
        Aug 5, 2022 11:03:07.881162882 CEST5987153192.168.2.68.8.8.8
        Aug 5, 2022 11:03:07.902704954 CEST53598718.8.8.8192.168.2.6
        Aug 5, 2022 11:03:18.845500946 CEST5119453192.168.2.68.8.8.8
        Aug 5, 2022 11:03:18.922394037 CEST53511948.8.8.8192.168.2.6
        Aug 5, 2022 11:03:31.447463989 CEST5401553192.168.2.68.8.8.8
        Aug 5, 2022 11:03:31.524036884 CEST53540158.8.8.8192.168.2.6
        Aug 5, 2022 11:03:44.188102961 CEST5868953192.168.2.68.8.8.8
        Aug 5, 2022 11:03:44.205487967 CEST53586898.8.8.8192.168.2.6
        Aug 5, 2022 11:03:56.868334055 CEST5304953192.168.2.68.8.8.8
        Aug 5, 2022 11:03:56.983062983 CEST53530498.8.8.8192.168.2.6
        Aug 5, 2022 11:04:09.074489117 CEST6310453192.168.2.68.8.8.8
        Aug 5, 2022 11:04:09.183706999 CEST53631048.8.8.8192.168.2.6
        Aug 5, 2022 11:04:21.925023079 CEST6536753192.168.2.68.8.8.8
        Aug 5, 2022 11:04:21.943284988 CEST53653678.8.8.8192.168.2.6
        Aug 5, 2022 11:04:34.382442951 CEST5766953192.168.2.68.8.8.8
        Aug 5, 2022 11:04:34.402014971 CEST53576698.8.8.8192.168.2.6
        Aug 5, 2022 11:04:47.473277092 CEST5578853192.168.2.68.8.8.8
        Aug 5, 2022 11:04:47.492806911 CEST53557888.8.8.8192.168.2.6

        DNS Queries

        TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
        Aug 5, 2022 11:02:51.225833893 CEST192.168.2.68.8.8.80x5295Standard query (0)microsoft-ru-data.ruA (IP address)IN (0x0001)
        Aug 5, 2022 11:02:51.521842957 CEST192.168.2.68.8.8.80xa085Standard query (0)microsoft-ru-data.ruA (IP address)IN (0x0001)
        Aug 5, 2022 11:02:51.809410095 CEST192.168.2.68.8.8.80x4f9bStandard query (0)microsoft-ru-data.ruA (IP address)IN (0x0001)
        Aug 5, 2022 11:02:52.201354027 CEST192.168.2.68.8.8.80xb567Standard query (0)microsoft-ru-data.ruA (IP address)IN (0x0001)
        Aug 5, 2022 11:02:52.438750982 CEST192.168.2.68.8.8.80x22cdStandard query (0)microsoft-ru-data.ruA (IP address)IN (0x0001)
        Aug 5, 2022 11:02:52.686110973 CEST192.168.2.68.8.8.80xe5feStandard query (0)microsoft-ru-data.ruA (IP address)IN (0x0001)
        Aug 5, 2022 11:02:52.976162910 CEST192.168.2.68.8.8.80x558aStandard query (0)microsoft-ru-data.ruA (IP address)IN (0x0001)
        Aug 5, 2022 11:02:53.326829910 CEST192.168.2.68.8.8.80xb947Standard query (0)microsoft-ru-data.ruA (IP address)IN (0x0001)
        Aug 5, 2022 11:02:53.714812040 CEST192.168.2.68.8.8.80x2a54Standard query (0)microsoft-ru-data.ruA (IP address)IN (0x0001)
        Aug 5, 2022 11:02:54.097826004 CEST192.168.2.68.8.8.80xf592Standard query (0)microsoft-ru-data.ruA (IP address)IN (0x0001)
        Aug 5, 2022 11:02:54.471667051 CEST192.168.2.68.8.8.80x8e86Standard query (0)microsoft-ru-data.ruA (IP address)IN (0x0001)
        Aug 5, 2022 11:02:54.797599077 CEST192.168.2.68.8.8.80x4036Standard query (0)fns77.ruA (IP address)IN (0x0001)
        Aug 5, 2022 11:03:07.881162882 CEST192.168.2.68.8.8.80xc1eeStandard query (0)fns77.ruA (IP address)IN (0x0001)
        Aug 5, 2022 11:03:18.845500946 CEST192.168.2.68.8.8.80xa886Standard query (0)fns77.ruA (IP address)IN (0x0001)
        Aug 5, 2022 11:03:31.447463989 CEST192.168.2.68.8.8.80xbfaStandard query (0)fns77.ruA (IP address)IN (0x0001)
        Aug 5, 2022 11:03:44.188102961 CEST192.168.2.68.8.8.80xfae4Standard query (0)fns77.ruA (IP address)IN (0x0001)
        Aug 5, 2022 11:03:56.868334055 CEST192.168.2.68.8.8.80x3df8Standard query (0)fns77.ruA (IP address)IN (0x0001)
        Aug 5, 2022 11:04:09.074489117 CEST192.168.2.68.8.8.80xd6dfStandard query (0)fns77.ruA (IP address)IN (0x0001)
        Aug 5, 2022 11:04:21.925023079 CEST192.168.2.68.8.8.80x730dStandard query (0)fns77.ruA (IP address)IN (0x0001)
        Aug 5, 2022 11:04:34.382442951 CEST192.168.2.68.8.8.80xe5e4Standard query (0)fns77.ruA (IP address)IN (0x0001)
        Aug 5, 2022 11:04:47.473277092 CEST192.168.2.68.8.8.80x46a8Standard query (0)fns77.ruA (IP address)IN (0x0001)

        DNS Answers

        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
        Aug 5, 2022 11:02:54.908832073 CEST8.8.8.8192.168.2.60x4036No error (0)fns77.ru194.87.218.140A (IP address)IN (0x0001)
        Aug 5, 2022 11:03:07.902704954 CEST8.8.8.8192.168.2.60xc1eeNo error (0)fns77.ru194.87.218.140A (IP address)IN (0x0001)
        Aug 5, 2022 11:03:18.922394037 CEST8.8.8.8192.168.2.60xa886No error (0)fns77.ru194.87.218.140A (IP address)IN (0x0001)
        Aug 5, 2022 11:03:31.524036884 CEST8.8.8.8192.168.2.60xbfaNo error (0)fns77.ru194.87.218.140A (IP address)IN (0x0001)
        Aug 5, 2022 11:03:44.205487967 CEST8.8.8.8192.168.2.60xfae4No error (0)fns77.ru194.87.218.140A (IP address)IN (0x0001)
        Aug 5, 2022 11:03:56.983062983 CEST8.8.8.8192.168.2.60x3df8No error (0)fns77.ru194.87.218.140A (IP address)IN (0x0001)
        Aug 5, 2022 11:04:09.183706999 CEST8.8.8.8192.168.2.60xd6dfNo error (0)fns77.ru194.87.218.140A (IP address)IN (0x0001)
        Aug 5, 2022 11:04:21.943284988 CEST8.8.8.8192.168.2.60x730dNo error (0)fns77.ru194.87.218.140A (IP address)IN (0x0001)
        Aug 5, 2022 11:04:34.402014971 CEST8.8.8.8192.168.2.60xe5e4No error (0)fns77.ru194.87.218.140A (IP address)IN (0x0001)
        Aug 5, 2022 11:04:47.492806911 CEST8.8.8.8192.168.2.60x46a8No error (0)fns77.ru194.87.218.140A (IP address)IN (0x0001)

        Statistics

        CPU Usage

        Click to jump to process

        Memory Usage

        Click to jump to process

        High Level Behavior Distribution

        Click to dive into process behavior distribution

        System Behavior

        General

        Target ID:2
        Start time:11:02:49
        Start date:05/08/2022
        Path:C:\Users\user\Desktop\zwM7Oe2e1l.exe
        Wow64 process (32bit):false
        Commandline:"C:\Users\user\Desktop\zwM7Oe2e1l.exe"
        Imagebase:0x7ff7c3f90000
        File size:702976 bytes
        MD5 hash:F1AB9ED37B68ACE769DCCAA693F162E0
        Has elevated privileges:true
        Has administrator privileges:true
        Programmed in:C, C++ or other language
        Reputation:low

        Disassembly

        ⊘No disassembly