Category | Package | Started | Completed | Duration | Options | Log |
---|---|---|---|---|---|---|
URL | ie | 2019-02-11 15:07:17 | 2019-02-11 15:11:34 | 257 seconds | Show Options | Show Log |
route = internet
procdump = 1
2019-02-11 15:07:29,078 [root] INFO: Date set to: 02-11-19, time set to: 15:07:29, timeout set to: 200 2019-02-11 15:07:29,233 [root] DEBUG: Starting analyzer from: C:\kczqzx 2019-02-11 15:07:29,233 [root] DEBUG: Storing results at: C:\ybEffGKp 2019-02-11 15:07:29,233 [root] DEBUG: Pipe server name: \\.\PIPE\NsBiPp 2019-02-11 15:07:29,233 [root] DEBUG: No analysis package specified, trying to detect it automagically. 2019-02-11 15:07:29,233 [root] INFO: Automatically selected analysis package "ie" 2019-02-11 15:07:32,977 [root] DEBUG: Started auxiliary module Browser 2019-02-11 15:07:33,023 [root] DEBUG: Started auxiliary module Curtain 2019-02-11 15:07:33,023 [modules.auxiliary.digisig] DEBUG: Skipping authenticode validation, analysis is not a file. 2019-02-11 15:07:33,023 [root] DEBUG: Started auxiliary module DigiSig 2019-02-11 15:07:33,039 [root] DEBUG: Started auxiliary module Disguise 2019-02-11 15:07:33,039 [root] DEBUG: Started auxiliary module Human 2019-02-11 15:07:33,039 [root] DEBUG: Started auxiliary module Screenshots 2019-02-11 15:07:33,055 [root] DEBUG: Started auxiliary module Sysmon 2019-02-11 15:07:33,055 [root] DEBUG: Started auxiliary module Usage 2019-02-11 15:07:33,055 [root] INFO: Analyzer: Package modules.packages.ie does not specify a DLL option 2019-02-11 15:07:33,055 [root] INFO: Analyzer: Package modules.packages.ie does not specify a DLL_64 option 2019-02-11 15:07:34,178 [lib.api.process] INFO: Successfully executed process from path "C:\Program Files (x86)\Internet Explorer\iexplore.exe" with arguments ""https://bupamms.bethebrand.com/ms/BU2nkl/x"" with pid 2104 2019-02-11 15:07:35,068 [lib.api.process] DEBUG: Using QueueUserAPC injection. 2019-02-11 15:07:38,344 [lib.api.process] INFO: 32-bit DLL to inject is C:\kczqzx\dll\gYnLac.dll, loader C:\kczqzx\bin\ZOUmWiu.exe 2019-02-11 15:07:38,765 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2104 2019-02-11 15:07:40,809 [lib.api.process] INFO: Successfully resumed process with pid 2104 2019-02-11 15:07:40,809 [root] INFO: Added new process to list with pid: 2104 2019-02-11 15:07:41,463 [root] DEBUG: Terminate processes on terminate_event disabled. 2019-02-11 15:07:41,480 [root] DEBUG: Process dumps enabled. 2019-02-11 15:07:41,697 [root] DEBUG: CAPE initialised: 32-bit base package loaded in process 2104 at 0x74940000, image base 0xc70000, stack from 0x3d2000-0x3e0000 2019-02-11 15:07:41,697 [root] DEBUG: Commandline: C:\Users\user\AppData\Local\Temp\"C:\Program Files (x86)\Internet Explorer\iexplore.exe" "https:\bupamms.bethebrand.com\ms\BU2nkl\x". 2019-02-11 15:07:41,697 [root] INFO: Monitor successfully loaded in process with pid 2104. 2019-02-11 15:07:41,822 [root] DEBUG: DLL unloaded from 0x754F0000. 2019-02-11 15:07:42,009 [root] DEBUG: DLL loaded at 0x72F70000: C:\Windows\system32\IEFRAME (0xa80000 bytes). 2019-02-11 15:07:42,118 [root] DEBUG: DLL loaded at 0x74830000: C:\Windows\system32\OLEACC (0x3c000 bytes). 2019-02-11 15:07:42,213 [root] DEBUG: DLL loaded at 0x743A0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32 (0x19e000 bytes). 2019-02-11 15:07:42,338 [root] DEBUG: DLL loaded at 0x74930000: C:\Windows\system32\profapi (0xb000 bytes). 2019-02-11 15:07:42,352 [root] INFO: Disabling sleep skipping. 2019-02-11 15:07:42,400 [root] DEBUG: DLL loaded at 0x75D00000: C:\Windows\syswow64\ws2_32 (0x35000 bytes). 2019-02-11 15:07:42,400 [root] DEBUG: DLL loaded at 0x75130000: C:\Windows\syswow64\NSI (0x6000 bytes). 2019-02-11 15:07:42,447 [root] DEBUG: DLL loaded at 0x74B50000: C:\Windows\system32\dnsapi (0x44000 bytes). 2019-02-11 15:07:42,447 [root] DEBUG: DLL loaded at 0x74810000: C:\Windows\system32\iphlpapi (0x1c000 bytes). 2019-02-11 15:07:42,447 [root] DEBUG: DLL loaded at 0x74800000: C:\Windows\system32\WINNSI (0x7000 bytes). 2019-02-11 15:07:42,477 [root] DEBUG: DLL loaded at 0x74EB0000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes). 2019-02-11 15:07:42,634 [root] DEBUG: DLL loaded at 0x74340000: C:\Windows\System32\netprofm (0x5a000 bytes). 2019-02-11 15:07:42,696 [root] DEBUG: DLL loaded at 0x74BD0000: C:\Windows\System32\nlaapi (0x10000 bytes). 2019-02-11 15:07:42,727 [root] DEBUG: DLL loaded at 0x74C70000: C:\Windows\system32\CRYPTSP (0x16000 bytes). 2019-02-11 15:07:42,743 [root] DEBUG: DLL loaded at 0x74C30000: C:\Windows\system32\rsaenh (0x3b000 bytes). 2019-02-11 15:07:42,743 [root] DEBUG: DLL loaded at 0x747F0000: C:\Windows\system32\RpcRtRemote (0xe000 bytes). 2019-02-11 15:07:42,759 [root] DEBUG: DLL unloaded from 0x74340000. 2019-02-11 15:07:42,789 [root] DEBUG: DLL loaded at 0x750B0000: C:\Windows\syswow64\comdlg32 (0x7b000 bytes). 2019-02-11 15:07:43,148 [root] DEBUG: DLL loaded at 0x74360000: C:\Program Files (x86)\Internet Explorer\sqmapi (0x33000 bytes). 2019-02-11 15:07:43,242 [root] DEBUG: DLL unloaded from 0x76C00000. 2019-02-11 15:07:43,257 [root] DEBUG: DLL unloaded from 0x75D60000. 2019-02-11 15:07:43,319 [root] DEBUG: DLL unloaded from 0x74360000. 2019-02-11 15:07:43,319 [root] DEBUG: DLL loaded at 0x74870000: C:\Windows\system32\ntmarta (0x21000 bytes). 2019-02-11 15:07:43,382 [root] DEBUG: DLL loaded at 0x76EA0000: C:\Windows\syswow64\WLDAP32 (0x45000 bytes). 2019-02-11 15:07:43,476 [root] DEBUG: DLL unloaded from 0x772F0000. 2019-02-11 15:07:43,507 [root] DEBUG: DLL loaded at 0x747E0000: C:\Windows\system32\VERSION (0x9000 bytes). 2019-02-11 15:07:44,240 [root] DEBUG: DLL unloaded from 0x74F40000. 2019-02-11 15:07:44,240 [root] DEBUG: DLL loaded at 0x74AF0000: C:\Windows\system32\apphelp (0x4c000 bytes). 2019-02-11 15:07:44,256 [root] DEBUG: DLL unloaded from 0x00C70000. 2019-02-11 15:07:44,319 [root] INFO: Announced 32-bit process name: iexplore.exe pid: 2168 2019-02-11 15:07:44,319 [root] INFO: Added new process to list with pid: 2168 2019-02-11 15:07:44,319 [lib.api.process] DEBUG: Using QueueUserAPC injection. 2019-02-11 15:07:44,319 [lib.api.process] INFO: 32-bit DLL to inject is C:\kczqzx\dll\gYnLac.dll, loader C:\kczqzx\bin\ZOUmWiu.exe 2019-02-11 15:07:44,349 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2168 2019-02-11 15:07:44,349 [root] DEBUG: DLL loaded at 0x74340000: C:\Windows\system32\RASAPI32 (0x52000 bytes). 2019-02-11 15:07:44,349 [root] DEBUG: DLL loaded at 0x74320000: C:\Windows\system32\rasman (0x15000 bytes). 2019-02-11 15:07:44,349 [root] DEBUG: DLL unloaded from 0x74340000. 2019-02-11 15:07:44,365 [root] DEBUG: Terminate processes on terminate_event disabled. 2019-02-11 15:07:44,365 [root] DEBUG: Process dumps enabled. 2019-02-11 15:07:44,365 [root] DEBUG: DLL loaded at 0x747D0000: C:\Windows\system32\rtutils (0xd000 bytes). 2019-02-11 15:07:44,381 [root] DEBUG: DLL unloaded from 0x747D0000. 2019-02-11 15:07:44,381 [root] INFO: Disabling sleep skipping. 2019-02-11 15:07:44,381 [root] DEBUG: DLL unloaded from 0x74320000. 2019-02-11 15:07:44,411 [root] DEBUG: CAPE initialised: 32-bit base package loaded in process 2168 at 0x74940000, image base 0xc70000, stack from 0x2e2000-0x2f0000 2019-02-11 15:07:44,411 [root] DEBUG: DLL loaded at 0x74310000: C:\Windows\system32\sensapi (0x6000 bytes). 2019-02-11 15:07:44,411 [root] DEBUG: DLL unloaded from 0x75600000. 2019-02-11 15:07:44,427 [root] DEBUG: Commandline: C:\Users\user\Desktop\"C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2104 CREDAT:79873. 2019-02-11 15:07:44,427 [root] INFO: Monitor successfully loaded in process with pid 2168. 2019-02-11 15:07:44,444 [root] DEBUG: DLL unloaded from 0x754F0000. 2019-02-11 15:07:44,444 [root] DEBUG: DLL loaded at 0x72F70000: C:\Windows\system32\IEFRAME (0xa80000 bytes). 2019-02-11 15:07:44,444 [root] DEBUG: DLL loaded at 0x74BD0000: C:\Windows\system32\NLAapi (0x10000 bytes). 2019-02-11 15:07:44,459 [root] DEBUG: DLL loaded at 0x74830000: C:\Windows\system32\OLEACC (0x3c000 bytes). 2019-02-11 15:07:44,459 [root] DEBUG: DLL loaded at 0x743A0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32 (0x19e000 bytes). 2019-02-11 15:07:44,459 [root] DEBUG: DLL loaded at 0x750B0000: C:\Windows\syswow64\comdlg32 (0x7b000 bytes). 2019-02-11 15:07:44,474 [root] DEBUG: DLL loaded at 0x74BC0000: C:\Windows\system32\napinsp (0x10000 bytes). 2019-02-11 15:07:44,474 [root] DEBUG: DLL loaded at 0x74BA0000: C:\Windows\system32\pnrpnsp (0x12000 bytes). 2019-02-11 15:07:44,490 [root] DEBUG: DLL loaded at 0x74BF0000: C:\Windows\System32\mswsock (0x3c000 bytes). 2019-02-11 15:07:44,490 [root] DEBUG: DLL loaded at 0x74B40000: C:\Windows\System32\winrnr (0x8000 bytes). 2019-02-11 15:07:44,490 [root] DEBUG: DLL loaded at 0x74BE0000: C:\Windows\System32\wshtcpip (0x5000 bytes). 2019-02-11 15:07:44,490 [root] DEBUG: DLL loaded at 0x74300000: C:\Windows\System32\wship6 (0x6000 bytes). 2019-02-11 15:07:44,490 [root] DEBUG: DLL loaded at 0x742F0000: C:\Windows\system32\rasadhlp (0x6000 bytes). 2019-02-11 15:07:44,522 [root] DEBUG: DLL loaded at 0x742B0000: C:\Windows\System32\fwpuclnt (0x38000 bytes). 2019-02-11 15:07:44,568 [root] DEBUG: DLL loaded at 0x74210000: C:\Windows\System32\netprofm (0x5a000 bytes). 2019-02-11 15:07:44,599 [root] DEBUG: DLL loaded at 0x741F0000: C:\Windows\system32\DHCPCSVC (0x12000 bytes). 2019-02-11 15:07:44,599 [root] DEBUG: DLL loaded at 0x74270000: C:\Program Files (x86)\Internet Explorer\IEShims (0x35000 bytes). 2019-02-11 15:07:44,599 [root] DEBUG: DLL loaded at 0x741E0000: C:\Windows\system32\dhcpcsvc6 (0xd000 bytes). 2019-02-11 15:07:44,615 [root] DEBUG: DLL unloaded from 0x74810000. 2019-02-11 15:07:44,615 [root] DEBUG: DLL unloaded from 0x741F0000. 2019-02-11 15:07:44,677 [root] DEBUG: DLL loaded at 0x747F0000: C:\Windows\system32\RpcRtRemote (0xe000 bytes). 2019-02-11 15:07:44,677 [root] INFO: Announced 64-bit process name: explorer.exe pid: 1632 2019-02-11 15:07:44,677 [root] INFO: Added new process to list with pid: 1632 2019-02-11 15:07:44,677 [lib.api.process] DEBUG: Using CreateRemoteThread injection. 2019-02-11 15:07:44,677 [lib.api.process] INFO: 64-bit DLL to inject is C:\kczqzx\dll\EBUoQIr.dll, loader C:\kczqzx\bin\TzgEbvsb.exe 2019-02-11 15:07:44,709 [root] DEBUG: DLL loaded at 0x741A0000: C:\Program Files (x86)\Internet Explorer\sqmapi (0x33000 bytes). 2019-02-11 15:07:44,709 [root] DEBUG: DLL unloaded from 0x76C00000. 2019-02-11 15:07:44,709 [root] DEBUG: DLL unloaded from 0x75D60000. 2019-02-11 15:07:44,709 [root] DEBUG: DLL unloaded from 0x741A0000. 2019-02-11 15:07:44,740 [root] DEBUG: DLL loaded at 0x74EB0000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes). 2019-02-11 15:07:44,802 [root] DEBUG: Terminate processes on terminate_event disabled. 2019-02-11 15:07:44,802 [root] DEBUG: Process dumps enabled. 2019-02-11 15:07:44,802 [root] INFO: Disabling sleep skipping. 2019-02-11 15:07:44,848 [root] DEBUG: DLL loaded at 0x741B0000: C:\Windows\system32\IEUI (0x2d000 bytes). 2019-02-11 15:07:44,848 [root] DEBUG: DLL loaded at 0x75A70000: C:\Windows\syswow64\SETUPAPI (0x19d000 bytes). 2019-02-11 15:07:44,848 [root] DEBUG: DLL loaded at 0x75A10000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes). 2019-02-11 15:07:44,848 [root] DEBUG: DLL loaded at 0x75D40000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes). 2019-02-11 15:07:44,865 [root] DEBUG: DLL loaded at 0x73FD0000: C:\Windows\system32\propsys (0xf5000 bytes). 2019-02-11 15:07:44,880 [root] DEBUG: DLL unloaded from 0x75E70000. 2019-02-11 15:07:44,880 [root] DEBUG: DLL loaded at 0x73FC0000: C:\Windows\system32\MSIMG32 (0x5000 bytes). 2019-02-11 15:07:44,943 [root] DEBUG: DLL loaded at 0x74870000: C:\Windows\system32\ntmarta (0x21000 bytes). 2019-02-11 15:07:44,973 [root] WARNING: Unable to place hook on LockResource 2019-02-11 15:07:44,990 [root] DEBUG: DLL loaded at 0x76EA0000: C:\Windows\syswow64\WLDAP32 (0x45000 bytes). 2019-02-11 15:07:44,990 [root] WARNING: Unable to hook LockResource 2019-02-11 15:07:45,036 [root] DEBUG: DLL loaded at 0x73F90000: C:\Program Files (x86)\Internet Explorer\ieproxy (0x2b000 bytes). 2019-02-11 15:07:45,269 [root] DEBUG: DLL loaded at 0x73FD0000: C:\Windows\system32\propsys (0xf5000 bytes). 2019-02-11 15:07:45,269 [root] DEBUG: DLL loaded at 0x74930000: C:\Windows\system32\profapi (0xb000 bytes). 2019-02-11 15:07:45,332 [root] DEBUG: CAPE initialised: 64-bit base package loaded in process 1632 at 0x00000000740D0000, image base 0x00000000FF900000, stack from 0x0000000006C42000-0x0000000006C50000 2019-02-11 15:07:45,348 [root] DEBUG: Commandline: C:\Windows\explorer.exe. 2019-02-11 15:07:45,348 [root] DEBUG: DLL unloaded from 0x73FD0000. 2019-02-11 15:07:45,364 [root] INFO: Monitor successfully loaded in process with pid 1632. 2019-02-11 15:07:45,473 [root] DEBUG: DLL loaded at 0x73F80000: C:\Windows\system32\mssprxy (0xc000 bytes). 2019-02-11 15:07:45,551 [root] DEBUG: DLL loaded at 0x73F00000: C:\Windows\system32\UxTheme (0x80000 bytes). 2019-02-11 15:07:46,892 [root] DEBUG: DLL unloaded from 0x75600000. 2019-02-11 15:07:47,017 [root] DEBUG: DLL loaded at 0x75A70000: C:\Windows\syswow64\SETUPAPI (0x19d000 bytes). 2019-02-11 15:07:47,017 [root] DEBUG: DLL loaded at 0x75A10000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes). 2019-02-11 15:07:47,017 [root] DEBUG: DLL loaded at 0x75D40000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes). 2019-02-11 15:07:47,032 [root] DEBUG: DLL unloaded from 0x75E70000. 2019-02-11 15:07:47,282 [root] DEBUG: DLL loaded at 0x73ED0000: C:\Windows\system32\xmllite (0x2f000 bytes). 2019-02-11 15:07:47,453 [root] DEBUG: DLL loaded at 0x73D60000: C:\Windows\system32\explorerframe (0x16f000 bytes). 2019-02-11 15:07:47,486 [root] DEBUG: DLL loaded at 0x73D30000: C:\Windows\system32\DUser (0x2f000 bytes). 2019-02-11 15:07:47,500 [root] DEBUG: DLL loaded at 0x73C70000: C:\Windows\system32\DUI70 (0xb2000 bytes). 2019-02-11 15:07:47,812 [root] DEBUG: DLL loaded at 0x75D00000: C:\Windows\syswow64\ws2_32 (0x35000 bytes). 2019-02-11 15:07:47,812 [root] DEBUG: DLL loaded at 0x75130000: C:\Windows\syswow64\NSI (0x6000 bytes). 2019-02-11 15:07:47,812 [root] DEBUG: DLL loaded at 0x74B50000: C:\Windows\system32\dnsapi (0x44000 bytes). 2019-02-11 15:07:47,812 [root] DEBUG: DLL loaded at 0x74C70000: C:\Windows\system32\CRYPTSP (0x16000 bytes). 2019-02-11 15:07:47,812 [root] DEBUG: DLL loaded at 0x74810000: C:\Windows\system32\iphlpapi (0x1c000 bytes). 2019-02-11 15:07:47,812 [root] DEBUG: DLL loaded at 0x74800000: C:\Windows\system32\WINNSI (0x7000 bytes). 2019-02-11 15:07:47,828 [root] DEBUG: DLL loaded at 0x74C30000: C:\Windows\system32\rsaenh (0x3b000 bytes). 2019-02-11 15:07:47,828 [root] DEBUG: DLL loaded at 0x73F90000: C:\Program Files (x86)\Internet Explorer\ieproxy (0x2b000 bytes). 2019-02-11 15:07:47,875 [root] DEBUG: DLL loaded at 0x73BD0000: C:\Windows\system32\msfeeds (0x96000 bytes). 2019-02-11 15:07:47,937 [root] DEBUG: DLL loaded at 0x74AF0000: C:\Windows\system32\apphelp (0x4c000 bytes). 2019-02-11 15:07:47,984 [root] DEBUG: DLL loaded at 0x73BA0000: C:\Windows\system32\MLANG (0x2e000 bytes). 2019-02-11 15:07:48,000 [root] DEBUG: DLL loaded at 0x751A0000: C:\Windows\syswow64\Normaliz (0x3000 bytes). 2019-02-11 15:07:48,032 [root] DEBUG: DLL loaded at 0x73BA0000: C:\Windows\system32\MLANG (0x2e000 bytes). 2019-02-11 15:07:48,062 [root] DEBUG: DLL loaded at 0x73F00000: C:\Windows\system32\UxTheme (0x80000 bytes). 2019-02-11 15:07:48,094 [root] DEBUG: DLL loaded at 0x73B80000: C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim (0x11000 bytes). 2019-02-11 15:07:48,109 [root] DEBUG: DLL loaded at 0x73AE0000: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCR80 (0x9b000 bytes). 2019-02-11 15:07:48,125 [root] DEBUG: DLL loaded at 0x72EE0000: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCP80 (0x87000 bytes). 2019-02-11 15:07:48,155 [root] DEBUG: DLL loaded at 0x73AD0000: C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper (0x10000 bytes). 2019-02-11 15:07:48,233 [root] DEBUG: set_caller_info: Adding region at 0x000007FEFCB00000 to caller regions list (msvcrt::memcpy). 2019-02-11 15:07:48,296 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF71F0000 to caller regions list (ntdll::LdrGetDllHandle). 2019-02-11 15:07:48,296 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF71F0000 to caller regions list (ntdll::NtCreateEvent). 2019-02-11 15:07:48,530 [root] DEBUG: DLL loaded at 0x72DA0000: C:\PROGRA~2\MICROS~1\Office14\URLREDIR (0x91000 bytes). 2019-02-11 15:07:48,530 [root] DEBUG: DLL loaded at 0x747E0000: C:\Windows\system32\VERSION (0x9000 bytes). 2019-02-11 15:07:48,562 [root] DEBUG: DLL loaded at 0x72ED0000: C:\Windows\system32\Secur32 (0x8000 bytes). 2019-02-11 15:07:48,562 [root] DEBUG: DLL loaded at 0x74D80000: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_50916076bcb9a742\MSVCR90 (0xa3000 bytes). 2019-02-11 15:07:48,562 [root] DEBUG: DLL loaded at 0x72EB0000: C:\PROGRA~2\MICROS~1\Office14\MSOHEV (0x14000 bytes). 2019-02-11 15:07:48,655 [root] DEBUG: DLL loaded at 0x72EA0000: C:\Program Files (x86)\Java\jre7\bin\jp2ssv (0xf000 bytes). 2019-02-11 15:07:48,655 [root] DEBUG: DLL loaded at 0x72CE0000: C:\Program Files (x86)\Java\jre7\bin\MSVCR100 (0xbe000 bytes). 2019-02-11 15:07:48,701 [root] DEBUG: set_caller_info: Adding region at 0x04600000 to caller regions list (ntdll::LdrLoadDll). 2019-02-11 15:07:48,779 [root] DEBUG: set_caller_info: Adding region at 0x00840000 to caller regions list (advapi32::RegOpenKeyExA). 2019-02-11 15:07:48,796 [root] DEBUG: DLL unloaded from 0x74F40000. 2019-02-11 15:07:48,858 [root] DEBUG: DLL loaded at 0x72E40000: C:\Windows\system32\SXS (0x5f000 bytes). 2019-02-11 15:07:49,372 [root] DEBUG: DLL loaded at 0x74340000: C:\Windows\system32\RASAPI32 (0x52000 bytes). 2019-02-11 15:07:49,372 [root] DEBUG: DLL loaded at 0x74320000: C:\Windows\system32\rasman (0x15000 bytes). 2019-02-11 15:07:49,388 [root] DEBUG: DLL loaded at 0x747D0000: C:\Windows\system32\rtutils (0xd000 bytes). 2019-02-11 15:07:49,388 [root] DEBUG: DLL unloaded from 0x74340000. 2019-02-11 15:07:49,388 [root] DEBUG: DLL unloaded from 0x75600000. 2019-02-11 15:07:49,388 [root] DEBUG: DLL loaded at 0x74310000: C:\Windows\system32\sensapi (0x6000 bytes). 2019-02-11 15:07:49,388 [root] DEBUG: DLL unloaded from 0x74320000. 2019-02-11 15:07:49,388 [root] DEBUG: DLL loaded at 0x74BD0000: C:\Windows\system32\NLAapi (0x10000 bytes). 2019-02-11 15:07:49,404 [root] DEBUG: DLL loaded at 0x74210000: C:\Windows\System32\netprofm (0x5a000 bytes). 2019-02-11 15:07:49,404 [root] DEBUG: DLL loaded at 0x74BC0000: C:\Windows\system32\napinsp (0x10000 bytes). 2019-02-11 15:07:49,404 [root] DEBUG: DLL loaded at 0x74BA0000: C:\Windows\system32\pnrpnsp (0x12000 bytes). 2019-02-11 15:07:49,404 [root] DEBUG: DLL loaded at 0x74BF0000: C:\Windows\System32\mswsock (0x3c000 bytes). 2019-02-11 15:07:49,404 [root] DEBUG: DLL loaded at 0x74B40000: C:\Windows\System32\winrnr (0x8000 bytes). 2019-02-11 15:07:49,404 [root] DEBUG: DLL loaded at 0x74BE0000: C:\Windows\System32\wshtcpip (0x5000 bytes). 2019-02-11 15:07:49,404 [root] DEBUG: DLL loaded at 0x74300000: C:\Windows\System32\wship6 (0x6000 bytes). 2019-02-11 15:07:49,420 [root] DEBUG: DLL loaded at 0x742F0000: C:\Windows\system32\rasadhlp (0x6000 bytes). 2019-02-11 15:07:49,436 [root] DEBUG: DLL loaded at 0x742B0000: C:\Windows\System32\fwpuclnt (0x38000 bytes). 2019-02-11 15:07:50,450 [root] DEBUG: DLL unloaded from 0x75D60000. 2019-02-11 15:07:50,450 [root] DEBUG: DLL loaded at 0x751A0000: C:\Windows\syswow64\Normaliz (0x3000 bytes). 2019-02-11 15:07:50,528 [root] DEBUG: DLL loaded at 0x72CC0000: C:\Windows\system32\USERENV (0x17000 bytes). 2019-02-11 15:07:50,528 [root] DEBUG: DLL loaded at 0x75470000: C:\Windows\syswow64\wintrust (0x2d000 bytes). 2019-02-11 15:07:50,637 [root] DEBUG: DLL loaded at 0x72C80000: C:\Windows\system32\schannel (0x3a000 bytes). 2019-02-11 15:07:50,792 [root] DEBUG: DLL loaded at 0x72C60000: C:\Windows\system32\DWMAPI (0x13000 bytes). 2019-02-11 15:07:50,885 [root] DEBUG: DLL loaded at 0x72E40000: C:\Windows\system32\SXS (0x5f000 bytes). 2019-02-11 15:07:50,901 [root] DEBUG: DLL unloaded from 0x72F70000. 2019-02-11 15:07:51,230 [root] DEBUG: DLL unloaded from 0x75D60000. 2019-02-11 15:07:51,292 [root] DEBUG: DLL loaded at 0x72C50000: C:\Windows\system32\credssp (0x8000 bytes). 2019-02-11 15:07:51,308 [root] DEBUG: DLL unloaded from 0x74C70000. 2019-02-11 15:07:52,211 [root] WARNING: File at path "C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R8OP9ZJC\favicon[1].ico" does not exist, skip. 2019-02-11 15:07:52,461 [root] DEBUG: DLL loaded at 0x72C10000: C:\Windows\system32\ncrypt (0x38000 bytes). 2019-02-11 15:07:52,461 [root] DEBUG: DLL loaded at 0x72BF0000: C:\Windows\system32\bcrypt (0x17000 bytes). 2019-02-11 15:07:52,493 [root] DEBUG: DLL loaded at 0x72BB0000: C:\Windows\SysWOW64\bcryptprimitives (0x3d000 bytes). 2019-02-11 15:07:52,555 [root] DEBUG: DLL loaded at 0x72B90000: C:\Windows\system32\GPAPI (0x16000 bytes). 2019-02-11 15:07:52,586 [root] DEBUG: DLL loaded at 0x72B70000: C:\Windows\system32\cryptnet (0x1c000 bytes). 2019-02-11 15:07:52,868 [root] DEBUG: DLL loaded at 0x72B50000: C:\Windows\system32\Cabinet (0x15000 bytes). 2019-02-11 15:07:53,055 [root] DEBUG: DLL loaded at 0x72B40000: C:\Windows\system32\DEVRTL (0xe000 bytes). 2019-02-11 15:07:53,069 [root] DEBUG: DLL unloaded from 0x75A70000. 2019-02-11 15:07:53,180 [root] DEBUG: DLL loaded at 0x72AE0000: C:\Windows\system32\WINHTTP (0x58000 bytes). 2019-02-11 15:07:53,180 [root] DEBUG: DLL loaded at 0x72A90000: C:\Windows\system32\webio (0x4f000 bytes). 2019-02-11 15:07:53,180 [root] DEBUG: DLL unloaded from 0x75D60000. 2019-02-11 15:07:53,180 [root] DEBUG: DLL loaded at 0x741E0000: C:\Windows\system32\dhcpcsvc6 (0xd000 bytes). 2019-02-11 15:07:53,180 [root] DEBUG: DLL loaded at 0x741F0000: C:\Windows\system32\dhcpcsvc (0x12000 bytes). 2019-02-11 15:07:53,180 [root] DEBUG: DLL unloaded from 0x772F0000. 2019-02-11 15:07:53,194 [root] DEBUG: DLL unloaded from 0x72AE0000. 2019-02-11 15:07:53,226 [root] DEBUG: DLL unloaded from 0x772F0000. 2019-02-11 15:07:53,242 [root] DEBUG: DLL unloaded from 0x72AE0000. 2019-02-11 15:07:54,286 [root] DEBUG: DLL unloaded from 0x72B70000. 2019-02-11 15:07:54,286 [root] DEBUG: DLL unloaded from 0x75A70000. 2019-02-11 15:07:55,394 [root] DEBUG: DLL unloaded from 0x772F0000. 2019-02-11 15:07:55,394 [root] DEBUG: DLL unloaded from 0x72AE0000. 2019-02-11 15:07:55,394 [root] DEBUG: DLL unloaded from 0x772F0000. 2019-02-11 15:07:55,410 [root] DEBUG: DLL unloaded from 0x72AE0000. 2019-02-11 15:07:55,551 [root] DEBUG: DLL unloaded from 0x72B70000. 2019-02-11 15:07:55,628 [root] DEBUG: DLL unloaded from 0x772F0000. 2019-02-11 15:07:55,628 [root] DEBUG: DLL unloaded from 0x72AE0000. 2019-02-11 15:07:55,660 [root] DEBUG: DLL unloaded from 0x772F0000. 2019-02-11 15:07:55,660 [root] DEBUG: DLL unloaded from 0x72AE0000. 2019-02-11 15:07:56,704 [root] DEBUG: DLL unloaded from 0x72B70000. 2019-02-11 15:07:56,720 [root] DEBUG: DLL unloaded from 0x772F0000. 2019-02-11 15:07:56,736 [root] DEBUG: DLL unloaded from 0x72AE0000. 2019-02-11 15:07:56,736 [root] DEBUG: DLL unloaded from 0x772F0000. 2019-02-11 15:07:56,752 [root] DEBUG: DLL unloaded from 0x72AE0000. 2019-02-11 15:07:57,250 [root] DEBUG: DLL loaded at 0x72950000: C:\Windows\System32\msxml3 (0x133000 bytes). 2019-02-11 15:07:57,500 [root] DEBUG: DLL unloaded from 0x72B70000. 2019-02-11 15:07:58,421 [root] DEBUG: DLL unloaded from 0x74F40000. 2019-02-11 15:07:59,591 [root] DEBUG: DLL loaded at 0x72390000: C:\Windows\SysWOW64\mshtml (0x5b7000 bytes). 2019-02-11 15:07:59,684 [root] DEBUG: DLL loaded at 0x72360000: C:\Windows\SysWOW64\msls31 (0x2a000 bytes). 2019-02-11 15:08:00,746 [root] WARNING: File at path "C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R8OP9ZJC\x[1].txt" does not exist, skip. 2019-02-11 15:08:01,276 [root] DEBUG: DLL loaded at 0x72350000: C:\Windows\system32\msimtf (0xb000 bytes). 2019-02-11 15:08:01,540 [root] DEBUG: DLL unloaded from 0x72F70000. 2019-02-11 15:08:03,069 [root] DEBUG: DLL loaded at 0x72330000: C:\Windows\system32\T2EMBED (0x1e000 bytes). 2019-02-11 15:08:08,825 [root] DEBUG: DLL loaded at 0x72300000: C:\Windows\SysWOW64\iepeers (0x30000 bytes). 2019-02-11 15:08:08,888 [root] DEBUG: DLL loaded at 0x722A0000: C:\Windows\SysWOW64\WINSPOOL.DRV (0x51000 bytes). 2019-02-11 15:08:09,247 [root] DEBUG: DLL loaded at 0x721E0000: C:\Windows\SysWOW64\jscript (0xb2000 bytes). 2019-02-11 15:08:09,263 [root] DEBUG: set_caller_info: Adding region at 0x721E0000 to caller regions list (ntdll::LdrLoadDll). 2019-02-11 15:08:09,716 [root] DEBUG: DLL unloaded from 0x75700000. 2019-02-11 15:08:12,023 [root] DEBUG: DLL loaded at 0x73ED0000: C:\Windows\system32\XmlLite (0x2f000 bytes). 2019-02-11 15:08:12,368 [root] DEBUG: DLL loaded at 0x721A0000: C:\Windows\SysWOW64\Dxtrans (0x39000 bytes). 2019-02-11 15:08:12,430 [root] DEBUG: DLL loaded at 0x72180000: C:\Windows\SysWOW64\ATL (0x14000 bytes). 2019-02-11 15:08:12,430 [root] DEBUG: set_caller_info: Adding region at 0x721A0000 to caller regions list (ole32::CoCreateInstance). 2019-02-11 15:08:12,460 [root] DEBUG: DLL loaded at 0x72170000: C:\Windows\SysWOW64\ddrawex (0xa000 bytes). 2019-02-11 15:08:12,507 [root] DEBUG: DLL loaded at 0x72080000: C:\Windows\SysWOW64\DDRAW (0xe7000 bytes). 2019-02-11 15:08:12,539 [root] DEBUG: DLL loaded at 0x72070000: C:\Windows\SysWOW64\DCIMAN32 (0x6000 bytes). 2019-02-11 15:08:12,555 [root] DEBUG: set_caller_info: Adding region at 0x72170000 to caller regions list (ntdll::memcpy). 2019-02-11 15:08:12,585 [root] DEBUG: DLL unloaded from 0x72080000. 2019-02-11 15:08:12,585 [root] DEBUG: set_caller_info: Adding region at 0x72080000 to caller regions list (ntdll::memcpy). 2019-02-11 15:08:12,601 [root] DEBUG: DLL loaded at 0x72060000: C:\Windows\system32\ImgUtil (0xb000 bytes). 2019-02-11 15:08:12,617 [root] DEBUG: set_caller_info: Adding region at 0x72060000 to caller regions list (ole32::CoCreateInstance). 2019-02-11 15:08:12,664 [root] DEBUG: DLL loaded at 0x72050000: C:\Windows\SysWOW64\pngfilt (0xe000 bytes). 2019-02-11 15:08:13,335 [root] DEBUG: DLL loaded at 0x73FC0000: C:\Windows\system32\msimg32 (0x5000 bytes). 2019-02-11 15:08:13,335 [root] DEBUG: set_caller_info: Adding region at 0x73FC0000 to caller regions list (kernel32::GetSystemTimeAsFileTime). 2019-02-11 15:08:13,413 [root] DEBUG: DLL unloaded from 0x74F40000. 2019-02-11 15:08:13,522 [root] DEBUG: DLL unloaded from 0x75E70000. 2019-02-11 15:08:13,538 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF6120000 to caller regions list (shell32::SHGetFolderPathW). 2019-02-11 15:08:13,709 [root] DEBUG: DLL loaded at 0x71FF0000: C:\Windows\SysWOW64\Dxtmsft (0x57000 bytes). 2019-02-11 15:08:13,724 [root] DEBUG: set_caller_info: Adding region at 0x71FF0000 to caller regions list (ole32::CoCreateInstance). 2019-02-11 15:08:13,724 [root] DEBUG: DLL unloaded from 0x72080000. 2019-02-11 15:08:14,006 [root] DEBUG: DLL unloaded from 0x72F70000. 2019-02-11 15:08:15,221 [root] DEBUG: DLL unloaded from 0x751B0000. 2019-02-11 15:08:18,717 [root] INFO: Announced 32-bit process name: pid: 1 2019-02-11 15:08:18,717 [root] INFO: Added new process to list with pid: 1 2019-02-11 15:08:18,717 [lib.api.process] WARNING: The process with pid 1 is not alive, injection aborted 2019-02-11 15:08:18,717 [root] DEBUG: DLL unloaded from 0x72F70000. 2019-02-11 15:08:18,825 [root] DEBUG: DLL unloaded from 0x000007FEFB9C0000. 2019-02-11 15:08:19,621 [root] INFO: Process with pid 1 has terminated 2019-02-11 15:08:20,947 [root] DEBUG: DLL unloaded from 0x000007FEFE8C0000. 2019-02-11 15:08:26,782 [root] DEBUG: DLL unloaded from 0x72B70000. 2019-02-11 15:08:26,782 [root] DEBUG: DLL unloaded from 0x75790000. 2019-02-11 15:08:52,210 [root] DEBUG: DLL unloaded from 0x75600000. 2019-02-11 15:08:54,346 [root] DEBUG: DLL unloaded from 0x72AE0000. 2019-02-11 15:09:09,088 [root] DEBUG: DLL unloaded from 0x75600000. 2019-02-11 15:09:39,229 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF8390000 to caller regions list (ntdll::NtDuplicateObject). 2019-02-11 15:09:39,306 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF45C0000 to caller regions list (ntdll::NtDuplicateObject). 2019-02-11 15:10:12,799 [root] DEBUG: DLL unloaded from 0x751B0000. 2019-02-11 15:11:03,546 [root] INFO: Analysis timeout hit (200 seconds), terminating analysis. 2019-02-11 15:11:03,546 [root] INFO: Created shutdown mutex. 2019-02-11 15:11:04,561 [root] INFO: Setting terminate event for process 2104. 2019-02-11 15:11:04,575 [root] DEBUG: Terminate Event: Attempting to dump process 2104 2019-02-11 15:11:04,575 [root] DEBUG: DumpInterestingRegions: Dumping Imagebase at 0x00C70000. 2019-02-11 15:11:04,575 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00C70000. 2019-02-11 15:11:04,575 [root] DEBUG: DumpProcess: Module entry point VA is 0x00001C9A. 2019-02-11 15:11:05,075 [root] INFO: Setting terminate event for process 2168. 2019-02-11 15:11:05,075 [root] DEBUG: Terminate Event: Attempting to dump process 2168 2019-02-11 15:11:05,075 [root] DEBUG: DumpInterestingRegions: Dumping Imagebase at 0x00C70000. 2019-02-11 15:11:05,075 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00C70000. 2019-02-11 15:11:05,075 [root] DEBUG: DumpProcess: Module entry point VA is 0x00001C9A. 2019-02-11 15:11:05,121 [root] DEBUG: Error 32 (0x20) - savePeFileToDisk: There was a problem renaming the file: The process cannot access the file because it is being used by another process. 2019-02-11 15:11:05,138 [root] DEBUG: Error 2 (0x2) - savePeFileToDisk: There was a problem renaming the file: The system cannot find the file specified. 2019-02-11 15:11:05,200 [root] DEBUG: Error 2 (0x2) - savePeFileToDisk: There was a problem deleting the file: C:\Users\user\Desktop\CapeOutput.bin: The system cannot find the file specified. 2019-02-11 15:11:05,263 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Local\Temp\~DFD9FAE18B412FC9BB.TMP": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Local\\Temp\\~DFD9FAE18B412FC9BB.TMP' 2019-02-11 15:11:05,263 [root] WARNING: Unable to access file at path "C:\Users\user\AppData\Local\Temp\~DF3283C68276B970C1.TMP": [Errno 13] Permission denied: u'C:\\Users\\user\\AppData\\Local\\Temp\\~DF3283C68276B970C1.TMP' 2019-02-11 15:11:05,589 [root] INFO: Setting terminate event for process 1632. 2019-02-11 15:11:05,589 [root] DEBUG: Terminate Event: Attempting to dump process 1632 2019-02-11 15:11:05,589 [root] DEBUG: DumpInterestingRegions: Dumping Imagebase at 0x00000000FF900000. 2019-02-11 15:11:05,589 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00000000FF900000. 2019-02-11 15:11:05,589 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000002B790. 2019-02-11 15:11:06,105 [root] INFO: Shutting down package. 2019-02-11 15:11:06,105 [root] INFO: Stopping auxiliary modules. 2019-02-11 15:11:06,105 [root] INFO: Finishing auxiliary modules. 2019-02-11 15:11:06,105 [root] INFO: Shutting down pipe server and dumping dropped files. 2019-02-11 15:11:06,105 [root] INFO: Analysis completed.
Name | Label | Manager | Started On | Shutdown On |
---|---|---|---|---|
target-01 | target-01 | ESX | 2019-02-11 15:07:17 | 2019-02-11 15:11:30 |
URL |
---|
https://bupamms.bethebrand.com/ms/BU2nkl/x |
Direct | IP | Country Name |
---|---|---|
N | 83.222.238.198 [VT] | United Kingdom |
Y | 8.8.8.8 [VT] | United States |
N | 72.21.81.240 [VT] | United States |
N | 72.167.18.239 [VT] | United States |
N | 204.79.197.200 [VT] | United States |
N | 184.28.50.154 [VT] | United States |
Name | Response | Post-Analysis Lookup |
---|---|---|
bupamms.bethebrand.com [VT] | A 83.222.238.198 [VT] | |
www.bing.com [VT] |
CNAME a-0001.a-afdentry.net.trafficmanager.net
[VT]
A 204.79.197.200 [VT] CNAME a-0001.a-msedge.net [VT] A 13.107.21.200 [VT] |
|
www.download.windowsupdate.com [VT] |
CNAME cs11.wpc.v0cdn.net
[VT]
CNAME 2-01-3cf7-0009.cdx.cedexis.net [VT] CNAME wu.ec.azureedge.net [VT] CNAME hlb.apr-52dd2-0.edgecastdns.net [VT] A 72.21.81.240 [VT] CNAME wu.azureedge.net [VT] CNAME wu.wpc.apr-52dd2.edgecastdns.net [VT] |
|
ocsp.godaddy.com [VT] |
CNAME ocsp.godaddy.com.akadns.net
[VT]
A 72.167.18.239 [VT] |
|
crl.microsoft.com [VT] |
CNAME a1363.dscg.akamai.net
[VT]
A 184.28.50.154 [VT] CNAME crl.www.ms.akadns.net [VT] A 184.28.50.137 [VT] |
Direct | IP | Country Name |
---|---|---|
N | 83.222.238.198 [VT] | United Kingdom |
Y | 8.8.8.8 [VT] | United States |
N | 72.21.81.240 [VT] | United States |
N | 72.167.18.239 [VT] | United States |
N | 204.79.197.200 [VT] | United States |
N | 184.28.50.154 [VT] | United States |
Source | Source Port | Destination | Destination Port |
---|---|---|---|
192.168.35.21 | 49221 | 184.28.50.154 crl.microsoft.com | 80 |
192.168.35.21 | 49167 | 204.79.197.200 www.bing.com | 80 |
192.168.35.21 | 49174 | 72.167.18.239 ocsp.godaddy.com | 80 |
192.168.35.21 | 49177 | 72.167.18.239 ocsp.godaddy.com | 80 |
192.168.35.21 | 49171 | 72.21.81.240 www.download.windowsupdate.com | 80 |
192.168.35.21 | 49166 | 83.222.238.198 bupamms.bethebrand.com | 443 |
192.168.35.21 | 49180 | 83.222.238.198 bupamms.bethebrand.com | 443 |
192.168.35.21 | 49181 | 83.222.238.198 bupamms.bethebrand.com | 443 |
192.168.35.21 | 49182 | 83.222.238.198 bupamms.bethebrand.com | 443 |
192.168.35.21 | 49183 | 83.222.238.198 bupamms.bethebrand.com | 443 |
192.168.35.21 | 49184 | 83.222.238.198 bupamms.bethebrand.com | 443 |
Source | Source Port | Destination | Destination Port |
---|---|---|---|
192.168.35.21 | 53447 | 8.8.8.8 | 53 |
192.168.35.21 | 57255 | 8.8.8.8 | 53 |
192.168.35.21 | 58094 | 8.8.8.8 | 53 |
192.168.35.21 | 65365 | 8.8.8.8 | 53 |
192.168.35.21 | 65426 | 8.8.8.8 | 53 |
192.168.35.25 | 137 | 192.168.35.21 | 137 |
Name | Response | Post-Analysis Lookup |
---|---|---|
bupamms.bethebrand.com [VT] | A 83.222.238.198 [VT] | |
www.bing.com [VT] |
CNAME a-0001.a-afdentry.net.trafficmanager.net
[VT]
A 204.79.197.200 [VT] CNAME a-0001.a-msedge.net [VT] A 13.107.21.200 [VT] |
|
www.download.windowsupdate.com [VT] |
CNAME cs11.wpc.v0cdn.net
[VT]
CNAME 2-01-3cf7-0009.cdx.cedexis.net [VT] CNAME wu.ec.azureedge.net [VT] CNAME hlb.apr-52dd2-0.edgecastdns.net [VT] A 72.21.81.240 [VT] CNAME wu.azureedge.net [VT] CNAME wu.wpc.apr-52dd2.edgecastdns.net [VT] |
|
ocsp.godaddy.com [VT] |
CNAME ocsp.godaddy.com.akadns.net
[VT]
A 72.167.18.239 [VT] |
|
crl.microsoft.com [VT] |
CNAME a1363.dscg.akamai.net
[VT]
A 184.28.50.154 [VT] CNAME crl.www.ms.akadns.net [VT] A 184.28.50.137 [VT] |
URI | Data |
---|---|
http://www.bing.com/favicon.ico | GET /favicon.ico HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: www.bing.com Connection: Keep-Alive |
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1 Cache-Control: max-age = 86400 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 19 Apr 2017 22:43:31 GMT If-None-Match: "80ab755e5eb9d21:0" User-Agent: Microsoft-CryptoAPI/6.1 Host: www.download.windowsupdate.com |
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/47BEABC922EAE80E78783462A79F45C254FDE68B.crt | GET /msdownload/update/v3/static/trustedr/en/47BEABC922EAE80E78783462A79F45C254FDE68B.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: www.download.windowsupdate.com |
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D | GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1 Cache-Control: max-age = 120504 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 03 May 2017 12:57:43 GMT If-None-Match: "9a1a4185c83279f907f282559c099f2d67d10fb2" User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.godaddy.com |
http://ocsp.godaddy.com//MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQC%2BZvuvM3JDZA%3D%3D | GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQC%2BZvuvM3JDZA%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.godaddy.com |
http://crl.microsoft.com/pki/crl/products/WinPCA.crl | GET /pki/crl/products/WinPCA.crl HTTP/1.1 Cache-Control: max-age = 900 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 02 Dec 2015 18:30:06 GMT If-None-Match: "0cb60772f2dd11:0" User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.microsoft.com |
No SMTP traffic performed.
No IRC requests performed.
No ICMP traffic performed.
No CIF Results
No Suricata Alerts
No Suricata TLS
No Suricata HTTP
Source | Source Port | Destination | Destination Port | JA3 Hash | JA3 Description |
---|---|---|---|---|---|
192.168.35.21 | 49166 | 83.222.238.198 bupamms.bethebrand.com | 443 | 2201d8e006f8f005a6b415f61e677532 | MSIE 10.0 Trident/6.0, Malware Test FP: blackhole-ek-traffic, sweet-orange-ek-post-infection-traffic, sweet-orange-ek-traffic, styx-ek-traffic |
192.168.35.21 | 49180 | 83.222.238.198 bupamms.bethebrand.com | 443 | 2201d8e006f8f005a6b415f61e677532 | MSIE 10.0 Trident/6.0, Malware Test FP: blackhole-ek-traffic, sweet-orange-ek-post-infection-traffic, sweet-orange-ek-traffic, styx-ek-traffic |
192.168.35.21 | 49181 | 83.222.238.198 bupamms.bethebrand.com | 443 | 2201d8e006f8f005a6b415f61e677532 | MSIE 10.0 Trident/6.0, Malware Test FP: blackhole-ek-traffic, sweet-orange-ek-post-infection-traffic, sweet-orange-ek-traffic, styx-ek-traffic |
192.168.35.21 | 49182 | 83.222.238.198 bupamms.bethebrand.com | 443 | 2201d8e006f8f005a6b415f61e677532 | MSIE 10.0 Trident/6.0, Malware Test FP: blackhole-ek-traffic, sweet-orange-ek-post-infection-traffic, sweet-orange-ek-traffic, styx-ek-traffic |
192.168.35.21 | 49183 | 83.222.238.198 bupamms.bethebrand.com | 443 | 2201d8e006f8f005a6b415f61e677532 | MSIE 10.0 Trident/6.0, Malware Test FP: blackhole-ek-traffic, sweet-orange-ek-post-infection-traffic, sweet-orange-ek-traffic, styx-ek-traffic |
192.168.35.21 | 49184 | 83.222.238.198 bupamms.bethebrand.com | 443 | 2201d8e006f8f005a6b415f61e677532 | MSIE 10.0 Trident/6.0, Malware Test FP: blackhole-ek-traffic, sweet-orange-ek-post-infection-traffic, sweet-orange-ek-traffic, styx-ek-traffic |
File name | search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico |
---|---|
Associated Filenames |
C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
|
File Size | 237 bytes |
File Type | PNG image data, 16 x 16, 4-bit colormap, non-interlaced |
MD5 | 9fb559a691078558e77d6848202f6541 |
SHA1 | ea13848d33c2c7f4f4baa39348aeb1dbfad3df31 |
SHA256 | 6d8a01dc7647bc218d003b58fe04049e24a9359900b7e0cebae76edf85b8b914 |
CRC32 | FC87942A |
Ssdeep | 6:6v/lhPIF6R/C+u1fXNg1XQ3yslRtNO+cKvAElRApGCp:6v/7b/C1fm1ZslRTvAElR47 |
ClamAV | None |
Yara | None matched |
CAPE Yara | None matched |
VirusTotal | Search for Analysis |
Download Download ZIP Submit file |
File name | 94308059B57B3142E455B38A6EB92015 |
---|---|
Associated Filenames |
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
|
File Size | 56560 bytes |
File Type | Microsoft Cabinet archive data, 56560 bytes, 1 file |
MD5 | bb377df27a55c05bb3793cd1e125c869 |
SHA1 | 295d5a7cb802a8058059f6c29dc2491a15a7d55c |
SHA256 | 3c4ec495f17d21cc236bc7238bc02728bd945c07157fbf875cac340269afc207 |
CRC32 | 6CA26C04 |
Ssdeep | 1536:MRgbtIWi7VUJH6blTBWYMJ29/zaWzev3ixNVbxzLHy:jSW2UalTBWNixNBx+ |
ClamAV | None |
Yara | None matched |
CAPE Yara | None matched |
VirusTotal | Search for Analysis |
Download Download ZIP Submit file |
File name | 94308059B57B3142E455B38A6EB92015 |
---|---|
Associated Filenames |
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
|
File Size | 342 bytes |
File Type | data |
MD5 | b5461810c00ee6e16f344278cac53156 |
SHA1 | 79748025b21c998661ad9db4b04cdf4b0e2a3458 |
SHA256 | 8a3b36ecfc85dadcd7aa01b56b1fb98a812c02300affdd02aa48ad331d13d0e0 |
CRC32 | 2FD19B48 |
Ssdeep | 6:kK1x+gla4Y+SkQlPlEGYRMY9z+4KlDA3RUeYlUUHy:0okPlE99SNxAhUeYlUd |
ClamAV | None |
Yara | None matched |
CAPE Yara | None matched |
VirusTotal | Search for Analysis |
Download Download ZIP Submit file |
File name | 223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771 |
---|---|
Associated Filenames |
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
|
File Size | 1731 bytes |
File Type | data |
MD5 | 785af62772c004e90d8059163f6844da |
SHA1 | f6183456c8207e48b74dde6c7fab5c3bd988d992 |
SHA256 | 0da9057b7a79ae01df19ef81fa86f43f5a9dc667bd3f4acfb6c2a0e1fb184a21 |
CRC32 | CABE6153 |
Ssdeep | 48:panitqBdgY7ViZzKEElnita8plnitq1Lhu8lS5AE2Mq5va1i/:pWXViZBE8pz1LhuNR2yi/ |
ClamAV | None |
Yara | None matched |
CAPE Yara | None matched |
VirusTotal | Search for Analysis |
Download Download ZIP Submit file |
File name | 223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771 |
---|---|
Associated Filenames |
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
|
File Size | 450 bytes |
File Type | data |
MD5 | f3f174b61feb2a575c2ebf364b0bca7e |
SHA1 | 908531abd0fe96f6df39802c6d9976d88ab2a5c0 |
SHA256 | 0470b25ae0343d69fdac276359f93160175174f3072f2c4532aae26edd2217a8 |
CRC32 | 39D67742 |
Ssdeep | 12:qArQESIgsFFV13Mz1mySGqfqCocgqclwU/:xwyPV13MhmyFqfq/qcR |
ClamAV | None |
Yara | None matched |
CAPE Yara | None matched |
VirusTotal | Search for Analysis |
Download Download ZIP Submit file |
File name | 0F2D82807DB7A0B2F57243675E1AF199_EC9D7AE70D2C255239D33FE08E3EF3F7 |
---|---|
Associated Filenames |
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0F2D82807DB7A0B2F57243675E1AF199_EC9D7AE70D2C255239D33FE08E3EF3F7
|
File Size | 1778 bytes |
File Type | data |
MD5 | d483a4c70cd48019b79d8a5deeec2ce2 |
SHA1 | 74a47bd7cdec1ef273461ba5e5cf1ce996f906d5 |
SHA256 | 8804592017840581348e208314d723b1bb6a36c7b675e8a521eb4c300f15eb1e |
CRC32 | D47AFA5B |
Ssdeep | 48:+ni/0TB5+nitxpUni/1Lhu8lCd5PE/Bkh:90TJp/1LhuL2/Ch |
ClamAV | None |
Yara | None matched |
CAPE Yara | None matched |
VirusTotal | Search for Analysis |
Download Download ZIP Submit file |
File name | 0F2D82807DB7A0B2F57243675E1AF199_EC9D7AE70D2C255239D33FE08E3EF3F7 |
---|---|
Associated Filenames |
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0F2D82807DB7A0B2F57243675E1AF199_EC9D7AE70D2C255239D33FE08E3EF3F7
|
File Size | 478 bytes |
File Type | data |
MD5 | 0b16900ae43dbbc15040ccb3d698ebc4 |
SHA1 | 4f983f3d26ddb269849d4415d62f3df4a019340a |
SHA256 | 5a11254429837d03b68e945f1a4c16555d3fd453a0f2e83b4e17221c3ff77471 |
CRC32 | 3F573156 |
Ssdeep | 12:QRqGvrQFItpVksFXmB0tQpuNHS2Iu0R7pMGB6LSwP:QRr+Ihn8B0tQpusnuiiye |
ClamAV | None |
Yara | None matched |
CAPE Yara | None matched |
VirusTotal | Search for Analysis |
Download Download ZIP Submit file |
File name | Core[1] |
---|---|
Associated Filenames |
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4W7O9ARC\Core[1]
|
File Size | 9291 bytes |
File Type | exported SGML document, ASCII text, with very long lines, with CRLF line terminators |
MD5 | 45b18a3225c8b742c9e7451bb31e19e8 |
SHA1 | 708caf564b6dc7b02e72ba681ebc95d8bb099fad |
SHA256 | 9d77a1bcb1695ccf33ceaf2a2a069ee110d227cd7fe87d7e01ac51e5b16dd520 |
CRC32 | DA7AE23B |
Ssdeep | 96:wYTxZ4TU4xWEsMVuAsG4mXhvt0WmC90we/bvcx2xbvWZEcCX+IOuto4loF41vQv7:xgU2VMAe/Q2x6Z2rA4l84KnmIp |
ClamAV | None |
Yara | None matched |
CAPE Yara | None matched |
VirusTotal | Search for Analysis |
Download Download ZIP Submit file Display Text | |
infuser.store.storeTemplate("https://BupaMMS.bethebrand.com/Core/Templates/DashboardAddWidget", "<span data-bind=\"MyTick: { ticked: ApprovalsSelected }\"></span><div class=\"Widget\" data-bind=\"click: Click.bind($data, 'Approvals')\"><img src='/Core/images/widgets/AssetApprovals.png'/><div><h2>Asset Approvals</h2><p>You should have this widget if you are an asset administrator.</p></div></div><div class='clear'></div><span data-bind=\"MyTick: { ticked: RAGSelected }\"></span><div class=\"Widget\" data-bind=\"click: Click.bind($data, 'RAG')\"><img src='/Core/images/widgets/AssetRAG.png'/><div><h2>Asset Lifecycle</h2><p>You should have this widget if you own assets.</p></div></div><div class='clear'></div>"); infuser.store.storeTemplate("https://BupaMMS.bethebrand.com/Core/Templates/HoldToExecute", "<div class=\"executeTimer\" data-bind=\"style: { left: marginLeft, top: marginTop }\"><div data-bind=\"css: { visible: CountDownDecrementing }, style: { width: TimerBarPercentageCss }\" class=\"timerBar\"></div></div>"); infuser.store.storeTemplate("https://BupaMMS.bethebrand.com/Core/Templates/Localization", "<div style='width: 600px;'><p><label class='label'>Language</label><select class=\"input\" data-bind=\"selectmenu: {}, options: Cultures, optionsText: 'Name', optionsValue: 'ID', value: Culture\"></select></p><p><label class='label'>Date Format</label><select class=\"input\" data-bind=\"selectmenu: {}, options: DateFormats, optionsText: 'Name', optionsValue: 'ID', value: DateFormat\"></select></p><p><label class='label'>Time Zone</label><select class=\"input\" data-bind=\"selectmenu: { search: true }, value: TimeZone, foreach: TimeZones\"><option data-bind=\"attr: { value: ID }, html: TimeZoneNice\"></select></p></div>"); infuser.store.storeTemplate("https://BupaMMS.bethebrand.com/Core/Templates/MyListFooter", "<div class='clear'></div><!-- ko if: ShowNoRecords --><!-- ko if: ShowFakes() == true && HeaderTitles().length > 0 --><div data-bind=\"foreach: FakeRows\"><div data-bind=\"css: $parent.RowClasses\" class='Row MyListRow Fake-Row'><div data-bind=\"foreach: $parent.HeaderTitles\"><!-- ko if: clazz --><div class=\"Fake-Cell\" data-bind=\"css: clazz\"><div class=\"load-placeholder light full\" /></div><!-- /ko --></div></div></div><!-- /ko --><!-- ko if: ShowFakes() == false --><div class='NoRecords' data-bind='alert: { html: NoRecords }' /><!-- /ko --><!-- /ko --><div class='clear'></div><div class='MyListFooter-Paging'><!-- ko if: buttons().length > 1 --><!-- ko if: showLess() --><div class='PageButton' data-bind=\"click: less,css: { 'ui-color-lightblue': lesshovered(), 'ui-color-grey': !lesshovered() },event: { mouseover: lesshovered.bind(null, true), mouseout: lesshovered.bind(null, false) }\"><span class='ui-icon ui-icon-carat-1-w' /></div><!-- /ko --><!-- ko foreach: buttons --><div class='PageButton' data-bind=\"text: pageNum, css: { selected: selected() }, attr: { page: pageNum }, click: click.bind($data, pageNum)\"></div><!-- /ko --><!-- ko if: showMore() --><div class='PageButton ui-color-grey' data-bind=\"click: more,css: { 'ui-color-lightblue': morehovered(), 'ui-color-grey': !morehovered() },event: { mouseover: morehovered.bind(null, true), mouseout: morehovered.bind(null, false) }\"><span class='ui-icon ui-icon-carat-1-e' /></div><!-- /ko --><!-- /ko --></div>"); infuser.store.storeTemplate("https://BupaMMS.bethebrand.com/Core/Templates/MyListHeader", "<div data-bind=\"css: HeaderClass\" class='MyListHeader'><!-- ko if: Title != \"\" --><span class='Title' data-bind=\"text: Title\"></span><!-- /ko --><!-- ko if: TitleHtml != \"\" --><span class='Title' data-bind=\"html: TitleHtml\"></span><!-- /ko --><div data-bind=\"foreach: MyHeaderButtonSets\" class=\"ButtonSetWrapper\"><ul data-bind=\"foreach: Buttons\" class=\"Buttons\"><!-- ko if: type == 'select' --><li class=\"select\" data-bind=\"if: options().length > 0, css: css\"><span class=\"input\" data-bind=\"tipsy: { title: tooltip, gravity: tooltipGravity, offset: 10, delayIn: 0 }\"><!-- ko if: selectmenu.multi == true --><select multiple=\"multiple\" data-bind=\"attr: { id: name }, selectedOptions:value, options: options, optionsText: optionsText, optionsValue: optionsValue, selectmenu: selectmenu\"></select><!-- /ko --><!-- ko if: selectmenu.multi == false || selectmenu.multi == undefined --><select data-bind=\"attr: { id: name }, value:value, options: options, optionsText: optionsText, optionsValue: optionsValue, selectmenu: selectmenu\"></select><!-- /ko --></span></li><!-- /ko --><!-- ko if: type == 'button' --><li data-bind=\"html: text, click: click, css: css, tipsy: { title: tooltip, gravity: tooltipGravity, offset: 10, delayIn: 0 }\"></li><!-- /ko --><!-- ko if: typeof type == 'function' --><li data-bind=\"jquery: type()\"/><!-- /ko --></ul></div><span class='Menu' /><!-- ko if: ShowSearch --><div class='Search' data-bind=\"MyListSearch: {}\"><input type='text'></div><!-- /ko --><div class=\"clear\"></div></div><div class=\"clear\&q |