Analysis Report

Overview

General Information

Joe Sandbox Version:	18.0.0
Analysis ID:	241038
Start time:	13:17:36
Joe Sandbox Product:	Cloud
Start date:	21.03.2017
Overall analysis duration:	0h 3m 24s
Report type:	full
Sample file name:	1 (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 (Office 2010 v14.0.4, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled
Detection:	MAL
Classification:	mal96.evad.troj.winEXE@17/11@0/100
HCA Information:	Successful, ratio: 99% Number of executed functions: 99 Number of non-executed functions: 120
EGA Information:	Successful, ratio: 100%
Cookbook Comments:	Stop behavior analysis, all processes terminated
Warnings:	Show All Exclude process from analysis (whitelisted): conhost.exe

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	96	0 - 100	Report FP / FN

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Sample sleeps for a long time, analyze it with the 'Bypass long sleeps' cookbook

Signature Overview

Click to jump to signature section

Change of System Appearance:

Contains functionalty to change the wallpaper

Show sources

Source: C:\1.exe	Code function: 1_2_0040CBEB GetDC,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetDeviceCaps,MulDiv,CreateFontW,SelectObject,SetBkColor,SetTextColor,GetStockObject,FillRect,SetPixel,DrawTextA,DrawTextA,GetObjectW,GetDIBits,CreateFileW,WriteFile,WriteFile,WriteFile,CloseHandle,SystemParametersInfoW,SelectObject,DeleteObject,SelectObject,DeleteObject,DeleteDC,ReleaseDC,		1_2_0040CBEB
Source: C:\1.exe	Code function: 1_1_0040CBEB GetDC,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetDeviceCaps,MulDiv,CreateFontW,SelectObject,SetBkColor,SetTextColor,GetStockObject,FillRect,SetPixel,DrawTextA,DrawTextA,GetObjectW,GetDIBits,CreateFileW,WriteFile,WriteFile,WriteFile,CloseHandle,SystemParametersInfoW,SelectObject,DeleteObject,SelectObject,DeleteObject,DeleteDC,ReleaseDC,		1_1_0040CBEB

Cryptography:

Uses Microsoft's Enhanced Cryptographic Provider

Show sources

Source: C:\1.exe	Code function: 0_2_00555610 EntryPoint,RegQueryValueW,Clusia,CreateSolidBrush,Clusia,TrustAirintake,recvfrom,Clusia,CryptCreateHash,Clusia,GetFileVersionInfoW,TrustAirintake,VerLanguageNameA,Clusia,UpdateResourceW,TrustAirintake,WriteProfileStringW,Clusia,GlobalAddAtomA,Clusia,Clusia,	0_2_00555610
Source: C:\1.exe	Code function: 1_2_00410E73 CryptAcquireContextW,	1_2_00410E73
Source: C:\1.exe	Code function: 1_2_00402876 CryptDestroyKey,	1_2_00402876
Source: C:\1.exe	Code function: 1_2_00410F08 memcpy,CryptEncrypt,CryptDestroyKey,	1_2_00410F08
Source: C:\1.exe	Code function: 1_2_00410C6C CryptAcquireContextW,	1_2_00410C6C
Source: C:\1.exe	Code function: 1_2_00406E4C CryptAcquireContextW,CryptGenRandom,	1_2_00406E4C
Source: C:\1.exe	Code function: 1_2_00401950 SetFilePointerEx,ReadFile,CryptEncrypt,SetFilePointerEx,WriteFile,Sleep,CryptDestroyKey,	1_2_00401950
Source: C:\1.exe	Code function: 1_2_00411105 memcpy,CryptEncrypt,memcpy,CryptEncrypt,	1_2_00411105
Source: C:\1.exe	Code function: 1_2_00402796 CryptDestroyKey,	1_2_00402796
Source: C:\1.exe	Code function: 1_2_004114D5 CryptImportKey,	1_2_004114D5
Source: C:\1.exe	Code function: 1_2_004110A2 CryptAcquireContextW,	1_2_004110A2
Source: C:\1.exe	Code function: 1_2_00410C90 CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,	1_2_00410C90
Source: C:\1.exe	Code function: 1_2_004110CD CryptGetKeyParam,	1_2_004110CD
Source: C:\1.exe	Code function: 1_2_00410E97 memcpy,CryptImportKey,	1_2_00410E97
Source: C:\1.exe	Code function: 1_1_00410E73 CryptAcquireContextW,	1_1_00410E73
Source: C:\1.exe	Code function: 1_1_00402876 CryptDestroyKey,	1_1_00402876
Source: C:\1.exe	Code function: 1_1_00410F08 memcpy,CryptEncrypt,CryptDestroyKey,	1_1_00410F08
Source: C:\1.exe	Code function: 1_1_00410C6C CryptAcquireContextW,	1_1_00410C6C
Source: C:\1.exe	Code function: 1_1_00406E4C CryptAcquireContextW,CryptGenRandom,	1_1_00406E4C
Source: C:\1.exe	Code function: 1_1_00401950 SetFilePointerEx,ReadFile,CryptEncrypt,SetFilePointerEx,WriteFile,Sleep,CryptDestroyKey,	1_1_00401950
Source: C:\1.exe	Code function: 1_1_00411105 memcpy,CryptEncrypt,memcpy,CryptEncrypt,	1_1_00411105
Source: C:\1.exe	Code function: 1_1_00402796 CryptDestroyKey,	1_1_00402796
Source: C:\1.exe	Code function: 1_1_004114D5 CryptImportKey,	1_1_004114D5
Source: C:\1.exe	Code function: 1_1_004110A2 CryptAcquireContextW,	1_1_004110A2
Source: C:\1.exe	Code function: 1_1_00410C90 CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,	1_1_00410C90
Source: C:\1.exe	Code function: 1_1_004110CD CryptGetKeyParam,	1_1_004110CD
Source: C:\1.exe	Code function: 1_1_00410E97 memcpy,CryptImportKey,	1_1_00410E97

Spam, unwanted Advertisements and Ransom Demands:

Contains functionality to import cryptographic keys (often used in ransomware)

Show sources

Source: C:\1.exe	Code function: 1_2_004114D5 CryptImportKey,	1_2_004114D5
Source: C:\1.exe	Code function: 1_2_00410E97 memcpy,CryptImportKey,	1_2_00410E97
Source: C:\1.exe	Code function: 1_1_004114D5 CryptImportKey,	1_1_004114D5
Source: C:\1.exe	Code function: 1_1_00410E97 memcpy,CryptImportKey,	1_1_00410E97

Detected Cerber Ransomware

Show sources

Source: C:\1.exe	Cerber initialization step 1: CreateFileW, C:\1.exe
Source: C:\1.exe	Cerber initialization step 2: SetFilePointer, Offset: 273612 (FileSize - 5)
Source: C:\1.exe	Cerber initialization step 3: ReadFile, Last 5 bytes of the executable

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality for read data from the clipboard

Show sources

Source: C:\1.exe

Code function: 0_2_0040511A GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040511A

Contains functionality to record screenshots

Show sources

Source: C:\1.exe

Code function: 1_2_0040CBEB GetDC,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetDeviceCaps,MulDiv,CreateFontW,SelectObject,SetBkColor,SetTextColor,GetStockObject,FillRect,SetPixel,DrawTextA,DrawTextA,GetObjectW,GetDIBits,CreateFileW,WriteFile,WriteFile,WriteFile,CloseHandle,SystemParametersInfoW,SelectObject,DeleteObject,SelectObject,DeleteObject,DeleteDC,ReleaseDC,

1_2_0040CBEB

Networking:

Contains functionality to download additional files from the internet

Show sources

Source: C:\1.exe

Code function: 0_2_00555610 EntryPoint,RegQueryValueW,Clusia,CreateSolidBrush,Clusia,TrustAirintake,recvfrom,Clusia,CryptCreateHash,Clusia,GetFileVersionInfoW,TrustAirintake,VerLanguageNameA,Clusia,UpdateResourceW,TrustAirintake,WriteProfileStringW,Clusia,GlobalAddAtomA,Clusia,Clusia,

0_2_00555610

Found strings which match to known social media urls

Show sources

Source: 1.exe	String found in binary or memory: <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> equals www.youtube.com (Youtube)
Source: 1.exe	String found in binary or memory: do portalu <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> i wpisz w wyszukiwarce equals www.youtube.com (Youtube)
Source: 1.exe	String found in binary or memory: <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> equals www.youtube.com (Youtube)
Source: 1.exe	String found in binary or memory: <p>If you have any pr<span class="h">dRYrTmt</span>oblems during installation or use of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> and type request in the searc<span class="h">iTjt</span>h bar "Install Tor Browser Windows" and you will find a lot of training videos about Tor Browser installation and use.</p> equals www.youtube.com (Youtube)
Source: 1.exe	String found in binary or memory: <p>Indien uw problemen heeft tijdens de installatie of het gebruik van Tor Browser, ga dan naar <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> en typ in de zoekbalk equals www.youtube.com (Youtube)
Source: 1.exe	String found in binary or memory: <p>Se si riscontrano problemi durante l'installazione o l'utilizzo di Tor Browser, visitare <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> e immettere "install tor browser windows" nella barra di ricerca per trovare numerosi video esplicativi sull'installazione e utilizzo di Tor Browser.</p> equals www.youtube.com (Youtube)
Source: 1.exe	String found in binary or memory: hrend der Installation von Tor Browser Probleme haben, besuchen Sie bitte <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> und geben als Suchanforderung "tor browser Windows installieren" ein und Sie erhalten in den Suchergebnossen viele Anleitungsvideos equals www.youtube.com (Youtube)
Source: 1.exe	String found in binary or memory: n, o durante el uso del Navegador Tor, visite <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> y escriba la solicitud en la barra de b equals www.youtube.com (Youtube)
Source: 1.exe	String found in binary or memory: o do Tor Browser, visite <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> e insira o pedido na barra de pesquisa equals www.youtube.com (Youtube)
Source: 1.exe	String found in binary or memory: rken herhangi bir sorununuz olursa <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> adresine gidin ve arama equals www.youtube.com (Youtube)
Source: 1.exe	String found in binary or memory: utilisation de Tor Browser, veuillez visiter <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> et saisir la demande dans la barre de recherche equals www.youtube.com (Youtube)

Urls found in memory or binary data

Show sources

Source: 1.exe	String found in binary or memory: http://
Source: 1.exe	String found in binary or memory: http://api.blo
Source: 1.exe	String found in binary or memory: http://btc.blo
Source: 1.exe	String found in binary or memory: http://nsis.sf.net/nsis_error
Source: 1.exe	String found in binary or memory: http://nsis.sf.net/nsis_errorerror
Source: 1.exe	String found in binary or memory: http://p27dokhpz2n7nvgr.12t3rn.top/0aef-cea2-407c-0091-c90c
Source: 1.exe	String found in binary or memory: http://p27dokhpz2n7nvgr.16bwhs.top/0aef-cea2-407c-0091-c90c
Source: 1.exe	String found in binary or memory: http://p27dokhpz2n7nvgr.1ajohk.top/0aef-cea2-407c-0091-c90c
Source: 1.exe	String found in binary or memory: http://p27dokhpz2n7nvgr.1cewld.top/0aef-cea2-407c-0091-c90c
Source: 1.exe	String found in binary or memory: http://p27dokhpz2n7nvgr.1js3tl.top/0aef-cea2-407c-0091-c90c
Source: 1.exe	String found in binary or memory: http://p27dokhpz2n7nvgr.onion/0aef-cea2-407c-0091-c90c
Source: 1.exe	String found in binary or memory: https://bit
Source: 1.exe	String found in binary or memory: https://cha
Source: 1.exe	String found in binary or memory: https://ww
Source: 1.exe	String found in binary or memory: https://www.baidu.com
Source: 1.exe	String found in binary or memory: https://www.baidu.com/s?wd=%e6%80%8e%e4%b9%88%e5%ae%89%e8%a3%85%20tor%20%e6%b5%8f%e8%a7%88%e5%99%a8
Source: 1.exe	String found in binary or memory: https://www.torproject.org/
Source: 1.exe	String found in binary or memory: https://www.torproject.org/download/download-easy.html.en
Source: 1.exe	String found in binary or memory: https://www.torproject.org/download/d7
Source: 1.exe	String found in binary or memory: https://www.torproject.org/download/download-easy.html.en
Source: 1.exe	String found in binary or memory: https://www.torproject.org/dzr
Source: 1.exe	String found in binary or memory: https://www.yout?y
Source: 1.exe	String found in binary or memory: https://www.youtube.com
Source: 1.exe	String found in binary or memory: https://www.youtube.com/results?search_query=install

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.0:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.1:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.2:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.3:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.4:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.5:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.6:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.7:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.8:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.9:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.10:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.11:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.12:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.13:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.14:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.15:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.16:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.17:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.18:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.19:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.20:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.21:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.22:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.23:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.24:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.25:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.26:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.27:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.28:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.29:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.30:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.64.31:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.0:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.1:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.2:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.3:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.4:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.5:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.6:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.7:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.8:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.9:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.10:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.11:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.12:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.13:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.14:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.15:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.16:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.17:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.18:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.19:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.20:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.21:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.22:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.23:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.24:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.25:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.26:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.27:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.28:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.29:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.30:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.122.31:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.0:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.1:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.2:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.3:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.4:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.5:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.6:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.7:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.8:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.9:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.10:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.11:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.12:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.13:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.14:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.15:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.16:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.17:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.18:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.19:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.20:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.21:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.22:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.23:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.24:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.25:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.26:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.27:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.28:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.29:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.30:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.31:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.32:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.33:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.34:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.35:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.36:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.37:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.38:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.39:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.40:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.41:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.42:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.43:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.44:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.45:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.46:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.47:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.48:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.49:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.50:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.51:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.52:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.53:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.54:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.55:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.56:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.57:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.58:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.59:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.60:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.61:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.62:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.63:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.64:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.65:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.66:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.67:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.68:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.69:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.70:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.71:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.72:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.73:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.74:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.75:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.76:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.77:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.78:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.79:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.80:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.81:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.82:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.83:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.84:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.85:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.86:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.87:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.88:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.89:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.90:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.91:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.92:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.93:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.94:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.95:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.96:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.97:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.98:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.99:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.100:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.101:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.102:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.103:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.104:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.105:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.106:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.107:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.108:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.109:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.110:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.111:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.112:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.113:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.114:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.115:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.116:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.117:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.118:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.119:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.120:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.121:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.122:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.123:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.124:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.125:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.126:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.127:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.128:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.129:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.130:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.131:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.132:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.133:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.134:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.135:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.136:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.137:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.138:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.139:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.140:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.141:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.142:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.143:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.144:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.145:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.146:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.147:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.148:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.149:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.150:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.151:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.152:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.153:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.154:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.155:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.156:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.157:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.158:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.159:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.160:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.161:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.162:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.163:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.164:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.165:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.166:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.167:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.168:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.169:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.170:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.171:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.172:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.173:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.174:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.175:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.176:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.177:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.178:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.179:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.180:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.181:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.182:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.183:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.184:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.185:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.186:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.187:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.188:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.189:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.190:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.191:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.192:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.193:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.194:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.195:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.196:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.197:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.198:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.199:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.200:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.201:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.202:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.203:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.204:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.205:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.206:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.207:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.208:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.209:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.210:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.211:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.212:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.213:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.214:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.215:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.216:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.217:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.218:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.219:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.220:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.221:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.222:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.223:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.224:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.225:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.226:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.227:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.228:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.229:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.230:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.231:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.232:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.233:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.234:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.235:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.236:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.237:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.238:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.239:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.240:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.241:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.242:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.243:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.244:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.245:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.246:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.247:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.248:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.249:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.250:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.251:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.252:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.253:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.254:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.248.255:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.0:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.1:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.2:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.3:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.4:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.5:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.6:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.7:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.8:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.9:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.10:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.11:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.12:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.13:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.14:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.15:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.16:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.17:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.18:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.19:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.20:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.21:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.22:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.23:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.24:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.25:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.26:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.27:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.28:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.29:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.30:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.31:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.32:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.33:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.34:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.35:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.36:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.37:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.38:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.39:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.40:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.41:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.42:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.43:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.44:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.45:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.46:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.47:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.48:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.49:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.50:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.51:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.52:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.53:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.54:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.55:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.56:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.57:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.58:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.59:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.60:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.61:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.62:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.63:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.64:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.65:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.66:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.67:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.68:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.69:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.70:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.71:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.72:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.73:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.74:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.75:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.76:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.77:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.78:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.79:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.80:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.81:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.82:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.83:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.84:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.85:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.86:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.87:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.88:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.89:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.90:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.91:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.92:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.93:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.94:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.95:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.96:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.97:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.98:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.99:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.100:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.101:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.102:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.103:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.104:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.105:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.106:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.107:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.108:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.109:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.110:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.111:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.112:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.113:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.114:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.115:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.116:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.117:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.118:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.119:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.120:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.121:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.122:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.123:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.124:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.125:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.126:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.127:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.128:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.129:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.130:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.131:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.132:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.133:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.134:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.135:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.136:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.137:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.138:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.139:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.140:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.141:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.142:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.143:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.144:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.145:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.146:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.147:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.148:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.149:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.150:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.151:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.152:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.153:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.154:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.155:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.156:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.157:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.158:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.159:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.160:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.161:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.162:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.163:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.164:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.165:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.166:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.167:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.168:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.169:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.170:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.171:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.172:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.173:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.174:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.175:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.176:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.177:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.178:6892
Source: global traffic	TCP traffic: 192.168.1.16:52381 -> 149.202.249.179:6892

Snort IDS alert for network traffic (e.g. based Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2023612 ET TROJAN Ransomware/Cerber Checkin M3 (1) 192.168.1.16:52381 -> 149.202.64.0:6892

Uses ping.exe to check the status of other devices and networks

Show sources

Source: unknown

Process created: C:\Windows\System32\PING.EXE ping -n 1 127.0.0.1

Stealing of Sensitive Information:

Searches for user specific document files

Show sources

Source: C:\1.exe	Key value created or modified: C:\Users\Public\Documents
Source: C:\1.exe	Key value created or modified: C:\Users\Public\Documents
Source: C:\1.exe	Key value created or modified: C:\Windows\ServiceProfiles\LocalService\Documents
Source: C:\1.exe	Key value created or modified: C:\Windows\ServiceProfiles\LocalService\Documents
Source: C:\1.exe	Key value created or modified: C:\Windows\ServiceProfiles\NetworkService\Documents
Source: C:\1.exe	Key value created or modified: C:\Windows\ServiceProfiles\NetworkService\Documents
Source: C:\1.exe	Key value created or modified: C:\Users\luketaylor\Documents
Source: C:\1.exe	Key value created or modified: C:\Users\luketaylor\Documents

Persistence and Installation Behavior:

Drops PE files

Show sources

Source: C:\1.exe	File created: C:\Users\LUKETA~1\AppData\Local\Temp\nsnF255.tmp\System.dll
Source: C:\1.exe	File created: C:\Users\LUKETA~1\AppData\Local\Temp\fossulas.dll

Data Obfuscation:

Contains functionality to dynamically determine API calls

Show sources

Source: C:\1.exe

Code function: 0_2_0040601C GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_0040601C

Entry point lies outside standard sections

Show sources

Source: initial sample

Static PE information: section where entry point is pointing to: .cairn

PE file contains an invalid checksum

Show sources

Source: System.dll.2996.dr	Static PE information: real checksum: 0x0 should be: 0xc6d0
Source: 1.exe	Static PE information: real checksum: 0x0 should be: 0x51531
Source: fossulas.dll.2996.dr	Static PE information: real checksum: 0x0 should be: 0x15e62

PE file contains sections with non-standard names

Show sources

Source: fossulas.dll.2996.dr

Static PE information: section name: .cairn

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\1.exe	Code function: 1_2_004122F5 pushad ; ret		1_2_0041232B
Source: C:\1.exe	Code function: 1_1_004122F5 pushad ; ret		1_1_0041232B

Spreading:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\1.exe	Code function: 0_2_004055B1 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004055B1
Source: C:\1.exe	Code function: 0_2_00405FF5 FindFirstFileA,FindClose,	0_2_00405FF5
Source: C:\1.exe	Code function: 0_2_00402645 FindFirstFileA,	0_2_00402645
Source: C:\1.exe	Code function: 0_1_004055B1 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_1_004055B1
Source: C:\1.exe	Code function: 0_1_00405FF5 FindFirstFileA,FindClose,	0_1_00405FF5
Source: C:\1.exe	Code function: 0_1_00402645 FindFirstFileA,	0_1_00402645
Source: C:\1.exe	Code function: 1_2_0040F750 CoInitialize,GetSystemDirectoryW,SHGetFileInfoW,lstrlenW,SHGetFileInfoW,lstrlenW,SHGetFolderPathW,FindFirstFileW,lstrlenW,CharLowerBuffW,FindNextFileW,FindClose,	1_2_0040F750
Source: C:\1.exe	Code function: 1_2_004102FE wsprintfW,GetFileAttributesW,GetFileSecurityW,GetSecurityDescriptorOwner,EqualSid,GetFileAttributesW,SetFileAttributesW,lstrcatW,GetFileAttributesW,SetFileAttributesW,FindFirstFileW,WaitForSingleObject,lstrlenW,lstrlenW,CharLowerBuffW,Sleep,FindNextFileW,FindClose,	1_2_004102FE
Source: C:\1.exe	Code function: 1_2_00401425 lstrlenW,FindFirstFileW,FindNextFileW,	1_2_00401425
Source: C:\1.exe	Code function: 1_1_0040F750 CoInitialize,GetSystemDirectoryW,SHGetFileInfoW,lstrlenW,SHGetFileInfoW,lstrlenW,SHGetFolderPathW,FindFirstFileW,lstrlenW,CharLowerBuffW,FindNextFileW,FindClose,	1_1_0040F750
Source: C:\1.exe	Code function: 1_1_004102FE wsprintfW,GetFileAttributesW,GetFileSecurityW,GetSecurityDescriptorOwner,EqualSid,GetFileAttributesW,SetFileAttributesW,lstrcatW,GetFileAttributesW,SetFileAttributesW,FindFirstFileW,WaitForSingleObject,lstrlenW,lstrlenW,CharLowerBuffW,Sleep,FindNextFileW,FindClose,	1_1_004102FE
Source: C:\1.exe	Code function: 1_1_00401425 lstrlenW,FindFirstFileW,FindNextFileW,	1_1_00401425

System Summary:

Contains modern PE file flags such as dynamic base (ASLR) or NX

Show sources

Source: 1.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Classification label

Show sources

Source: classification engine

Classification label: mal96.evad.troj.winEXE@17/11@0/100

Contains functionality to check free disk space

Show sources

Source: C:\1.exe

Code function: 0_2_0040442A GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_0040442A

Contains functionality to enum processes or threads

Show sources

Source: C:\1.exe

Code function: 1_2_00409FB6 GetCurrentProcessId,GetCurrentThreadId,CreateToolhelp32Snapshot,Thread32First,OpenThread,SuspendThread,Thread32Next,CloseHandle,

1_2_00409FB6

Contains functionality to instantiate COM classes

Show sources

Source: C:\1.exe

Code function: 0_2_00402036 CoCreateInstance,MultiByteToWideChar,

0_2_00402036

Creates temporary files

Show sources

Source: C:\1.exe

File created: C:\Users\LUKETA~1\AppData\Local\Temp\nsnF253.tmp

PE file has an executable .text section and no other executable section

Show sources

Source: 1.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Queries process information (via WMI, Win32_Process)

Show sources

Source: C:\Windows\System32\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "1.exe")

Reads ini files

Show sources

Source: C:\1.exe

File read: C:\Users\luketaylor\Desktop\desktop.ini

Reads software policies

Show sources

Source: C:\1.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Spawns processes

Show sources

Source: unknown	Process created: C:\1.exe 'C:\1.exe'
Source: unknown	Process created: C:\1.exe 'C:\1.exe'
Source: unknown	Process created: C:\Windows\System32\netsh.exe C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
Source: unknown	Process created: C:\Windows\System32\netsh.exe C:\Windows\system32\netsh.exe advfirewall reset
Source: unknown	Process created: C:\Windows\System32\netsh.exe C:\Windows\system32\netsh.exe advfirewall firewall add rule name='P6epdlwIIS' dir=out action=block program='C:\Program Files\Windows Defender\MpCmdRun.exe'
Source: unknown	Process created: C:\Windows\System32\netsh.exe C:\Windows\system32\netsh.exe advfirewall firewall add rule name='67qEKuZ06T' dir=out action=block program='C:\Program Files\Windows Defender\MSASCui.exe'
Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
Source: unknown	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im '1.exe'
Source: unknown	Process created: C:\Windows\System32\PING.EXE ping -n 1 127.0.0.1
Source: C:\1.exe	Process created: C:\1.exe 'C:\1.exe'
Source: C:\1.exe	Process created: C:\Windows\System32\netsh.exe C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
Source: C:\1.exe	Process created: C:\Windows\System32\netsh.exe C:\Windows\system32\netsh.exe advfirewall reset
Source: C:\1.exe	Process created: C:\Windows\System32\netsh.exe C:\Windows\system32\netsh.exe advfirewall firewall add rule name='P6epdlwIIS' dir=out action=block program='C:\Program Files\Windows Defender\MpCmdRun.exe'
Source: C:\1.exe	Process created: C:\Windows\System32\netsh.exe C:\Windows\system32\netsh.exe advfirewall firewall add rule name='67qEKuZ06T' dir=out action=block program='C:\Program Files\Windows Defender\MSASCui.exe'
Source: C:\1.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im '1.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 1 127.0.0.1

Uses an in-process (OLE) Automation server

Show sources

Source: C:\1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Writes ini files

Show sources

Source: C:\1.exe

File written: C:\Windows\win.ini

Contains functionality to call native functions

Show sources

Source: C:\1.exe	Code function: 1_2_004118A5 NtQueryVirtualMemory,		1_2_004118A5
Source: C:\1.exe	Code function: 1_1_004118A5 NtQueryVirtualMemory,		1_1_004118A5

Contains functionality to shutdown / reboot the system

Show sources

Source: C:\1.exe	Code function: 0_2_00403217 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		0_2_00403217
Source: C:\1.exe	Code function: 0_1_00403217 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		0_1_00403217

Creates mutexes

Show sources

Source: C:\1.exe	Mutant created: \Sessions\1\BaseNamedObjects\shell.{967822DD-7042-E624-BEA7-C7EF520E90F5}
Source: C:\Windows\System32\netsh.exe	Mutant created: \Sessions\1\BaseNamedObjects\RasPbFile

Found potential string decryption / allocating functions

Show sources

Source: C:\1.exe	Code function: String function: 00411620 appears 32 times
Source: C:\1.exe	Code function: String function: 004029FD appears 35 times

Sample file is different than original file name gathered from version info

Show sources

Source: 1.exe	Binary or memory string: OriginalFilename vs 1.exe
Source: 1.exe	Binary or memory string: OriginalFilenameInterop.ShareAPILib.dll vs 1.exe
Source: 1.exe	Binary or memory string: OriginalFilenameKernelbasej% vs 1.exe
Source: 1.exe	Binary or memory string: OriginalFilenameSETUPAPI.DLL.MUIj% vs 1.exe
Source: 1.exe	Binary or memory string: OriginalFilenamekernel32j% vs 1.exe
Source: 1.exe	Binary or memory string: OriginalFilenameSHELL32.DLL.MUIj% vs 1.exe
Source: 1.exe	Binary or memory string: OriginalFilenameSETUPAPI.DLL.MUIj% vs 1.exe

Sample reads its own file content

Show sources

Source: C:\1.exe

File read: C:\1.exe

HIPS / PFW / Operating System Protection Evasion:

Contains functionality to add an ACL to a security descriptor

Show sources

Source: C:\1.exe

Code function: 1_2_0040C40A InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreatePipe,CreatePipe,GetSystemDirectoryA,wsprintfA,memset,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,

1_2_0040C40A

Contains functionality to simulate keystroke presses

Show sources

Source: C:\1.exe

Code function: 1_2_0040DE83 Sleep,GetModuleHandleA,RegisterClassExW,GetSystemMetrics,GetSystemMetrics,CreateThread,Sleep,TerminateThread,Sleep,keybd_event,keybd_event,

1_2_0040DE83

Uses taskkill to terminate processes

Show sources

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\taskkill.exe taskkill /f /im '1.exe'

Contains functionality to inject code into remote processes

Show sources

Source: C:\1.exe

Code function: 0_2_00551490 TrustAirintake,Clusia,wsprintfA,TrustAirintake,TrustAirintake,TrustAirintake,TrustAirintake,FatalAppExitW,TrustAirintake,MoveFileExW,Clusia,TrustAirintake,Clusia,Clusia,Clusia,Clusia,Clusia,Clusia,Clusia,TrustAirintake,TrustAirintake,Clusia,Clusia,TrustAirintake,CreateFileA,GlobalAlloc,ReadFile,TrustAirintake,Clusia,Clusia,Clusia,Clusia,TrustAirintake,TrustAirintake,TrustAirintake,TrustAirintake,TrustAirintake,TrustAirintake,Clusia,TrustAirintake,Clusia,GlobalAlloc,TrustAirintake,Clusia,Clusia,Clusia,Clusia,Clusia,TrustAirintake,Clusia,VirtualAlloc,TrustAirintake,Clusia,TrustAirintake,ReadProcessMemory,TrustAirintake,Clusia,Clusia,VirtualAllocEx,Clusia,WriteProcessMemory,Clusia,WriteProcessMemory,TrustAirintake,WriteProcessMemory,TrustAirintake,Clusia,SetThreadContext,ResumeThread,TrustAirintake,ExitProcess,TrustAirintake,

0_2_00551490

Injects a PE file into a foreign processes

Show sources

Source: C:\1.exe

Memory written: C:\1.exe base: 400000 value starts with: 4D5A

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\1.exe

Thread register set: target process: 3016

Anti Debugging:

Contains functionality to register its own exception handler

Show sources

Source: C:\1.exe	Code function: 0_2_00556012 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00556012
Source: C:\1.exe	Code function: 0_2_0055DCE3 SetUnhandledExceptionFilter,	0_2_0055DCE3
Source: C:\1.exe	Code function: 0_2_00557D7D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00557D7D
Source: C:\1.exe	Code function: 0_2_0055D9EF SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,	0_2_0055D9EF

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\1.exe

System information queried: KernelDebuggerInformation

Contains functionality for execution timing, often used to detect debuggers

Show sources

Source: C:\1.exe

Code function: 1_2_0040A3D6 rdtsc

1_2_0040A3D6

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Show sources

Source: C:\1.exe

Code function: 0_2_00556012 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00556012

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Show sources

Source: C:\1.exe

Code function: 1_2_00409FB6 GetCurrentProcessId,GetCurrentThreadId,CreateToolhelp32Snapshot,Thread32First,OpenThread,SuspendThread,Thread32Next,CloseHandle,

1_2_00409FB6

Contains functionality to dynamically determine API calls

Show sources

Source: C:\1.exe

Code function: 0_2_0040601C GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_0040601C

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Show sources

Source: C:\1.exe

Code function: 1_2_004077E9 GetProcessHeaps,

1_2_004077E9

Enables debug privileges

Show sources

Source: C:\Windows\System32\taskkill.exe

Process token adjusted: Debug

Malware Analysis System Evasion:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\1.exe	Code function: 0_2_004055B1 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_004055B1
Source: C:\1.exe	Code function: 0_2_00405FF5 FindFirstFileA,FindClose,	0_2_00405FF5
Source: C:\1.exe	Code function: 0_2_00402645 FindFirstFileA,	0_2_00402645
Source: C:\1.exe	Code function: 0_1_004055B1 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_1_004055B1
Source: C:\1.exe	Code function: 0_1_00405FF5 FindFirstFileA,FindClose,	0_1_00405FF5
Source: C:\1.exe	Code function: 0_1_00402645 FindFirstFileA,	0_1_00402645
Source: C:\1.exe	Code function: 1_2_0040F750 CoInitialize,GetSystemDirectoryW,SHGetFileInfoW,lstrlenW,SHGetFileInfoW,lstrlenW,SHGetFolderPathW,FindFirstFileW,lstrlenW,CharLowerBuffW,FindNextFileW,FindClose,	1_2_0040F750
Source: C:\1.exe	Code function: 1_2_004102FE wsprintfW,GetFileAttributesW,GetFileSecurityW,GetSecurityDescriptorOwner,EqualSid,GetFileAttributesW,SetFileAttributesW,lstrcatW,GetFileAttributesW,SetFileAttributesW,FindFirstFileW,WaitForSingleObject,lstrlenW,lstrlenW,CharLowerBuffW,Sleep,FindNextFileW,FindClose,	1_2_004102FE
Source: C:\1.exe	Code function: 1_2_00401425 lstrlenW,FindFirstFileW,FindNextFileW,	1_2_00401425
Source: C:\1.exe	Code function: 1_1_0040F750 CoInitialize,GetSystemDirectoryW,SHGetFileInfoW,lstrlenW,SHGetFileInfoW,lstrlenW,SHGetFolderPathW,FindFirstFileW,lstrlenW,CharLowerBuffW,FindNextFileW,FindClose,	1_1_0040F750
Source: C:\1.exe	Code function: 1_1_004102FE wsprintfW,GetFileAttributesW,GetFileSecurityW,GetSecurityDescriptorOwner,EqualSid,GetFileAttributesW,SetFileAttributesW,lstrcatW,GetFileAttributesW,SetFileAttributesW,FindFirstFileW,WaitForSingleObject,lstrlenW,lstrlenW,CharLowerBuffW,Sleep,FindNextFileW,FindClose,	1_1_004102FE
Source: C:\1.exe	Code function: 1_1_00401425 lstrlenW,FindFirstFileW,FindNextFileW,	1_1_00401425

Contains functionality to query system information

Show sources

Source: C:\1.exe

Code function: 1_2_00409D96 GetSystemInfo,

1_2_00409D96

Checks the free space of harddrives

Show sources

Source: C:\1.exe

File Volume queried: C:\ FullSizeInformation

Contains functionality for execution timing, often used to detect debuggers

Show sources

Source: C:\1.exe

Code function: 1_2_0040A3D6 rdtsc

1_2_0040A3D6

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Show sources

Source: C:\1.exe

Code function: 1_2_00409FB6 GetCurrentProcessId,GetCurrentThreadId,CreateToolhelp32Snapshot,Thread32First,OpenThread,SuspendThread,Thread32Next,CloseHandle,

1_2_00409FB6

Contains long sleeps (>= 3 min)

Show sources

Source: C:\1.exe

Thread delayed: delay time: -1000

Found evasive API chain (may stop execution after checking a module file name)

Show sources

Source: C:\1.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-10761
Source: C:\1.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_0-10262

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\1.exe TID: 3020	Thread sleep time: -8000s >= -60s
Source: C:\1.exe TID: 3128	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\netsh.exe TID: 3060	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\netsh.exe TID: 3104	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\netsh.exe TID: 3164	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\netsh.exe TID: 3208	Thread sleep time: -60000s >= -60s
Source: C:\Windows\System32\taskkill.exe TID: 3296	Thread sleep time: -60000s >= -60s

Found API chain indicative of sandbox detection

Show sources

Source: C:\1.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_1-10895

Uses ping.exe to sleep

Show sources

Source: unknown	Process created: C:\Windows\System32\PING.EXE ping -n 1 127.0.0.1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\PING.EXE ping -n 1 127.0.0.1

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\1.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOALIGNMENTFAULTEXCEPT and NOGPFAULTERRORBOX and NOOPENFILEERRORBOX

Deletes itself after installation

Show sources

Source: C:\Windows\System32\cmd.exe

File deleted: c:\1.exe

Lowering of HIPS / PFW / Operating System Security Settings:

AV process strings found (often used to terminate AV products)

Show sources

Source: 1.exe

Binary or memory string: MSASCui.exe

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Show sources

Source: C:\1.exe	WMI Queries: IWbemServices::ExecQuery - select * from FirewallProduct
Source: C:\1.exe	WMI Queries: IWbemServices::ExecQuery - select * from FirewallProduct
Source: C:\1.exe	WMI Queries: IWbemServices::ExecQuery - select * from AntiSpywareProduct
Source: C:\1.exe	WMI Queries: IWbemServices::ExecQuery - select * from AntiSpywareProduct
Source: C:\1.exe	WMI Queries: IWbemServices::ExecQuery - select * from AntiVirusProduct
Source: C:\1.exe	WMI Queries: IWbemServices::ExecQuery - select * from AntiVirusProduct

Modifies the windows firewall

Show sources

Source: unknown

Process created: C:\Windows\System32\netsh.exe C:\Windows\system32\netsh.exe advfirewall set allprofiles state on

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: unknown

Process created: C:\Windows\System32\netsh.exe C:\Windows\system32\netsh.exe advfirewall set allprofiles state on

Language, Device and Operating System Detection:

Contains functionality to query windows version

Show sources

Source: C:\1.exe

Code function: 0_2_00405D13 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405D13

Queries the cryptographic machine GUID

Show sources

Source: C:\1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Contains functionality locales information (e.g. system language)

Show sources

Source: C:\1.exe

Code function: GetLocaleInfoA,

0_2_0055C208

Behavior Graph

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language

Yara Overview

No Yara matches

Screenshot

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Error!

Analysis Report

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Signature Overview

Change of System Appearance:

Cryptography:

Spam, unwanted Advertisements and Ransom Demands:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Networking:

Stealing of Sensitive Information:

Persistence and Installation Behavior:

Data Obfuscation:

Spreading:

System Summary:

HIPS / PFW / Operating System Protection Evasion:

Anti Debugging:

Malware Analysis System Evasion:

Hooking and other Techniques for Hiding and Protection:

Lowering of HIPS / PFW / Operating System Security Settings:

Language, Device and Operating System Detection:

Behavior Graph

Yara Overview

Screenshot