Edit tour

Windows Analysis Report
http://42.231.79.7:51810/bin.sh

Overview

General Information

Sample URL:	http://42.231.79.7:51810/bin.sh
Analysis ID:	1587285
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

AI detected suspicious URL

Uses known network protocols on non-standard ports

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Queries the volume information (name, serial number etc) of a device

Stores files to the Windows start menu directory

Yara signature match

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3720 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5676 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1992,i,3651476395786432483,6869830452980313092,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5636 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://42.231.79.7:51810/bin.sh" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

OpenWith.exe (PID: 3944 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: E4A834784FA08C17D47A1E72429C5109)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\Downloads\33ae88e8-a002-46dd-8889-487f7479f3bd.tmp	Linux_Packer_Patched_UPX_62e11c64	unknown	unknown	0x78:$a: 55 50 58 21 0A 58 0D 89 00 00 00 00 00 00 00 00 00 00 00 00
C:\Users\user\Downloads\bin.sh.crdownload	Linux_Packer_Patched_UPX_62e11c64	unknown	unknown	0x78:$a: 55 50 58 21 0A 58 0D 89 00 00 00 00 00 00 00 00 00 00 00 00
dropped/chromecache_68	Linux_Packer_Patched_UPX_62e11c64	unknown	unknown	0x78:$a: 55 50 58 21 0A 58 0D 89 00 00 00 00 00 00 00 00 00 00 00 00

HTTP traffic detected: GET /bin.sh HTTP/1.1Host: 42.231.79.7:51810Connection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic

DNS traffic detected: DNS query: www.google.com

Source: bin.sh.crdownload.0.dr, chromecache_68.2.dr	String found in binary or memory: http://upx.sf.net
Source: sets.json.0.dr	String found in binary or memory: https://07c225f3.online
Source: sets.json.0.dr	String found in binary or memory: https://24.hu
Source: sets.json.0.dr	String found in binary or memory: https://aajtak.in
Source: sets.json.0.dr	String found in binary or memory: https://abczdrowie.pl
Source: sets.json.0.dr	String found in binary or memory: https://alice.tw
Source: sets.json.0.dr	String found in binary or memory: https://ambitionbox.com
Source: sets.json.0.dr	String found in binary or memory: https://autobild.de
Source: sets.json.0.dr	String found in binary or memory: https://baomoi.com
Source: sets.json.0.dr	String found in binary or memory: https://bild.de
Source: sets.json.0.dr	String found in binary or memory: https://blackrock.com
Source: sets.json.0.dr	String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.0.dr	String found in binary or memory: https://bluradio.com
Source: sets.json.0.dr	String found in binary or memory: https://bolasport.com
Source: sets.json.0.dr	String found in binary or memory: https://bonvivir.com
Source: sets.json.0.dr	String found in binary or memory: https://bumbox.com
Source: sets.json.0.dr	String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.0.dr	String found in binary or memory: https://businesstoday.in
Source: sets.json.0.dr	String found in binary or memory: https://cachematrix.com
Source: sets.json.0.dr	String found in binary or memory: https://cafemedia.com
Source: sets.json.0.dr	String found in binary or memory: https://caracoltv.com
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.be
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.com
Source: sets.json.0.dr	String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.0.dr	String found in binary or memory: https://cardsayings.net
Source: sets.json.0.dr	String found in binary or memory: https://chatbot.com
Source: sets.json.0.dr	String found in binary or memory: https://chennien.com
Source: sets.json.0.dr	String found in binary or memory: https://citybibleforum.org
Source: sets.json.0.dr	String found in binary or memory: https://clarosports.com
Source: sets.json.0.dr	String found in binary or memory: https://clmbtech.com
Source: sets.json.0.dr	String found in binary or memory: https://closeronline.co.uk
Source: sets.json.0.dr	String found in binary or memory: https://clubelpais.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://cmxd.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://cognitive-ai.ru
Source: sets.json.0.dr	String found in binary or memory: https://cognitiveai.ru
Source: sets.json.0.dr	String found in binary or memory: https://commentcamarche.com
Source: sets.json.0.dr	String found in binary or memory: https://commentcamarche.net
Source: sets.json.0.dr	String found in binary or memory: https://computerbild.de
Source: sets.json.0.dr	String found in binary or memory: https://content-loader.com
Source: sets.json.0.dr	String found in binary or memory: https://cookreactor.com
Source: sets.json.0.dr	String found in binary or memory: https://cricbuzz.com
Source: sets.json.0.dr	String found in binary or memory: https://css-load.com
Source: sets.json.0.dr	String found in binary or memory: https://deccoria.pl
Source: sets.json.0.dr	String found in binary or memory: https://deere.com
Source: sets.json.0.dr	String found in binary or memory: https://desimartini.com
Source: sets.json.0.dr	String found in binary or memory: https://dewarmsteweek.be
Source: sets.json.0.dr	String found in binary or memory: https://drimer.io
Source: sets.json.0.dr	String found in binary or memory: https://drimer.travel
Source: sets.json.0.dr	String found in binary or memory: https://economictimes.com
Source: sets.json.0.dr	String found in binary or memory: https://een.be
Source: sets.json.0.dr	String found in binary or memory: https://efront.com
Source: sets.json.0.dr	String found in binary or memory: https://eleconomista.net
Source: sets.json.0.dr	String found in binary or memory: https://elfinancierocr.com
Source: sets.json.0.dr	String found in binary or memory: https://elgrafico.com
Source: sets.json.0.dr	String found in binary or memory: https://ella.sv
Source: sets.json.0.dr	String found in binary or memory: https://elpais.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://elpais.uy
Source: sets.json.0.dr	String found in binary or memory: https://etfacademy.it
Source: sets.json.0.dr	String found in binary or memory: https://eworkbookcloud.com
Source: sets.json.0.dr	String found in binary or memory: https://eworkbookrequest.com
Source: sets.json.0.dr	String found in binary or memory: https://fakt.pl
Source: sets.json.0.dr	String found in binary or memory: https://finn.no
Source: sets.json.0.dr	String found in binary or memory: https://firstlook.biz
Source: sets.json.0.dr	String found in binary or memory: https://gallito.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://geforcenow.com
Source: sets.json.0.dr	String found in binary or memory: https://gettalkdesk.com
Source: sets.json.0.dr	String found in binary or memory: https://gliadomain.com
Source: sets.json.0.dr	String found in binary or memory: https://gnttv.com
Source: sets.json.0.dr	String found in binary or memory: https://graziadaily.co.uk
Source: sets.json.0.dr	String found in binary or memory: https://grid.id
Source: sets.json.0.dr	String found in binary or memory: https://gridgames.app
Source: sets.json.0.dr	String found in binary or memory: https://growthrx.in
Source: sets.json.0.dr	String found in binary or memory: https://grupolpg.sv
Source: sets.json.0.dr	String found in binary or memory: https://gujaratijagran.com
Source: sets.json.0.dr	String found in binary or memory: https://hapara.com
Source: sets.json.0.dr	String found in binary or memory: https://hazipatika.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1.global
Source: sets.json.0.dr	String found in binary or memory: https://hc1cas.com
Source: sets.json.0.dr	String found in binary or memory: https://hc1cas.global
Source: sets.json.0.dr	String found in binary or memory: https://healthshots.com
Source: sets.json.0.dr	String found in binary or memory: https://hearty.app
Source: sets.json.0.dr	String found in binary or memory: https://hearty.gift
Source: sets.json.0.dr	String found in binary or memory: https://hearty.me
Source: sets.json.0.dr	String found in binary or memory: https://heartymail.com
Source: sets.json.0.dr	String found in binary or memory: https://heatworld.com
Source: sets.json.0.dr	String found in binary or memory: https://helpdesk.com
Source: sets.json.0.dr	String found in binary or memory: https://hindustantimes.com
Source: sets.json.0.dr	String found in binary or memory: https://hj.rs
Source: sets.json.0.dr	String found in binary or memory: https://hjck.com
Source: sets.json.0.dr	String found in binary or memory: https://html-load.cc
Source: sets.json.0.dr	String found in binary or memory: https://html-load.com
Source: sets.json.0.dr	String found in binary or memory: https://human-talk.org
Source: sets.json.0.dr	String found in binary or memory: https://idbs-cloud.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-dev.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.0.dr	String found in binary or memory: https://idbs-staging.com
Source: sets.json.0.dr	String found in binary or memory: https://img-load.com
Source: sets.json.0.dr	String found in binary or memory: https://indiatimes.com
Source: sets.json.0.dr	String found in binary or memory: https://indiatoday.in
Source: sets.json.0.dr	String found in binary or memory: https://indiatodayne.in
Source: sets.json.0.dr	String found in binary or memory: https://infoedgeindia.com
Source: sets.json.0.dr	String found in binary or memory: https://interia.pl
Source: sets.json.0.dr	String found in binary or memory: https://intoday.in
Source: sets.json.0.dr	String found in binary or memory: https://iolam.it
Source: sets.json.0.dr	String found in binary or memory: https://ishares.com
Source: sets.json.0.dr	String found in binary or memory: https://jagran.com
Source: sets.json.0.dr	String found in binary or memory: https://johndeere.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldesfemmes.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.0.dr	String found in binary or memory: https://journaldunet.com
Source: sets.json.0.dr	String found in binary or memory: https://journaldunet.fr
Source: sets.json.0.dr	String found in binary or memory: https://joyreactor.cc
Source: sets.json.0.dr	String found in binary or memory: https://joyreactor.com
Source: sets.json.0.dr	String found in binary or memory: https://kaksya.in
Source: sets.json.0.dr	String found in binary or memory: https://knowledgebase.com
Source: sets.json.0.dr	String found in binary or memory: https://kompas.com
Source: sets.json.0.dr	String found in binary or memory: https://kompas.tv
Source: sets.json.0.dr	String found in binary or memory: https://kompasiana.com
Source: sets.json.0.dr	String found in binary or memory: https://lanacion.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://landyrev.com
Source: sets.json.0.dr	String found in binary or memory: https://landyrev.ru
Source: sets.json.0.dr	String found in binary or memory: https://laprensagrafica.com
Source: sets.json.0.dr	String found in binary or memory: https://lateja.cr
Source: sets.json.0.dr	String found in binary or memory: https://libero.it
Source: sets.json.0.dr	String found in binary or memory: https://linternaute.com
Source: sets.json.0.dr	String found in binary or memory: https://linternaute.fr
Source: sets.json.0.dr	String found in binary or memory: https://livechat.com
Source: sets.json.0.dr	String found in binary or memory: https://livechatinc.com
Source: sets.json.0.dr	String found in binary or memory: https://livehindustan.com
Source: sets.json.0.dr	String found in binary or memory: https://livemint.com
Source: sets.json.0.dr	String found in binary or memory: https://max.auto
Source: sets.json.0.dr	String found in binary or memory: https://medonet.pl
Source: sets.json.0.dr	String found in binary or memory: https://meo.pt
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.do
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.py
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://mercadolivre.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadolivre.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ec
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.pe
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://mercadopago.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.cl
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.br
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.co
Source: sets.json.0.dr	String found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.0.dr	String found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.0.dr	String found in binary or memory: https://mightytext.net
Source: sets.json.0.dr	String found in binary or memory: https://mittanbud.no
Source: sets.json.0.dr	String found in binary or memory: https://money.pl
Source: sets.json.0.dr	String found in binary or memory: https://motherandbaby.com
Source: sets.json.0.dr	String found in binary or memory: https://mystudentdashboard.com
Source: sets.json.0.dr	String found in binary or memory: https://nacion.com
Source: sets.json.0.dr	String found in binary or memory: https://naukri.com
Source: sets.json.0.dr	String found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.0.dr	String found in binary or memory: https://nien.co
Source: sets.json.0.dr	String found in binary or memory: https://nien.com
Source: sets.json.0.dr	String found in binary or memory: https://nien.org
Source: sets.json.0.dr	String found in binary or memory: https://nlc.hu
Source: sets.json.0.dr	String found in binary or memory: https://nosalty.hu
Source: sets.json.0.dr	String found in binary or memory: https://noticiascaracol.com
Source: sets.json.0.dr	String found in binary or memory: https://nourishingpursuits.com
Source: sets.json.0.dr	String found in binary or memory: https://nvidia.com
Source: sets.json.0.dr	String found in binary or memory: https://o2.pl
Source: sets.json.0.dr	String found in binary or memory: https://ocdn.eu
Source: sets.json.0.dr	String found in binary or memory: https://onet.pl
Source: sets.json.0.dr	String found in binary or memory: https://ottplay.com
Source: sets.json.0.dr	String found in binary or memory: https://p106.net
Source: sets.json.0.dr	String found in binary or memory: https://p24.hu
Source: sets.json.0.dr	String found in binary or memory: https://paula.com.uy
Source: sets.json.0.dr	String found in binary or memory: https://pdmp-apis.no
Source: sets.json.0.dr	String found in binary or memory: https://phonandroid.com
Source: sets.json.0.dr	String found in binary or memory: https://player.pl
Source: sets.json.0.dr	String found in binary or memory: https://plejada.pl
Source: sets.json.0.dr	String found in binary or memory: https://poalim.site
Source: sets.json.0.dr	String found in binary or memory: https://poalim.xyz
Source: sets.json.0.dr	String found in binary or memory: https://pomponik.pl
Source: sets.json.0.dr	String found in binary or memory: https://portalinmobiliario.com
Source: sets.json.0.dr	String found in binary or memory: https://prisjakt.no
Source: sets.json.0.dr	String found in binary or memory: https://pudelek.pl
Source: sets.json.0.dr	String found in binary or memory: https://punjabijagran.com
Source: sets.json.0.dr	String found in binary or memory: https://radio1.be
Source: sets.json.0.dr	String found in binary or memory: https://radio2.be
Source: sets.json.0.dr	String found in binary or memory: https://reactor.cc
Source: sets.json.0.dr	String found in binary or memory: https://repid.org
Source: sets.json.0.dr	String found in binary or memory: https://reshim.org
Source: sets.json.0.dr	String found in binary or memory: https://rws1nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://rws2nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://rws3nvtvt.com
Source: sets.json.0.dr	String found in binary or memory: https://sackrace.ai
Source: sets.json.0.dr	String found in binary or memory: https://salemoveadvisor.com
Source: sets.json.0.dr	String found in binary or memory: https://salemovefinancial.com
Source: sets.json.0.dr	String found in binary or memory: https://salemovetravel.com
Source: sets.json.0.dr	String found in binary or memory: https://samayam.com
Source: sets.json.0.dr	String found in binary or memory: https://sapo.io
Source: sets.json.0.dr	String found in binary or memory: https://sapo.pt
Source: sets.json.0.dr	String found in binary or memory: https://shock.co
Source: sets.json.0.dr	String found in binary or memory: https://smaker.pl
Source: sets.json.0.dr	String found in binary or memory: https://smoney.vn
Source: sets.json.0.dr	String found in binary or memory: https://smpn106jkt.sch.id
Source: sets.json.0.dr	String found in binary or memory: https://socket-to-me.vip
Source: sets.json.0.dr	String found in binary or memory: https://songshare.com
Source: sets.json.0.dr	String found in binary or memory: https://songstats.com
Source: sets.json.0.dr	String found in binary or memory: https://sporza.be
Source: sets.json.0.dr	String found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.0.dr	String found in binary or memory: https://startlap.hu
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.0.dr	String found in binary or memory: https://startupislandtaiwan.org
Source: sets.json.0.dr	String found in binary or memory: https://stripe.com
Source: sets.json.0.dr	String found in binary or memory: https://stripe.network
Source: sets.json.0.dr	String found in binary or memory: https://stripecdn.com
Source: sets.json.0.dr	String found in binary or memory: https://supereva.it
Source: sets.json.0.dr	String found in binary or memory: https://takeabreak.co.uk
Source: sets.json.0.dr	String found in binary or memory: https://talkdeskqaid.com
Source: sets.json.0.dr	String found in binary or memory: https://talkdeskstgid.com
Source: sets.json.0.dr	String found in binary or memory: https://teacherdashboard.com
Source: sets.json.0.dr	String found in binary or memory: https://technology-revealed.com
Source: sets.json.0.dr	String found in binary or memory: https://terazgotuje.pl
Source: sets.json.0.dr	String found in binary or memory: https://text.com
Source: sets.json.0.dr	String found in binary or memory: https://textyserver.appspot.com
Source: sets.json.0.dr	String found in binary or memory: https://the42.ie
Source: sets.json.0.dr	String found in binary or memory: https://thejournal.ie
Source: sets.json.0.dr	String found in binary or memory: https://thirdspace.org.au
Source: sets.json.0.dr	String found in binary or memory: https://timesinternet.in
Source: sets.json.0.dr	String found in binary or memory: https://timesofindia.com
Source: sets.json.0.dr	String found in binary or memory: https://tolteck.app
Source: sets.json.0.dr	String found in binary or memory: https://tolteck.com
Source: sets.json.0.dr	String found in binary or memory: https://top.pl
Source: sets.json.0.dr	String found in binary or memory: https://tribunnews.com
Source: sets.json.0.dr	String found in binary or memory: https://trytalkdesk.com
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com.co
Source: sets.json.0.dr	String found in binary or memory: https://tucarro.com.ve
Source: sets.json.0.dr	String found in binary or memory: https://tvid.in
Source: sets.json.0.dr	String found in binary or memory: https://tvn.pl
Source: sets.json.0.dr	String found in binary or memory: https://tvn24.pl
Source: sets.json.0.dr	String found in binary or memory: https://unotv.com
Source: sets.json.0.dr	String found in binary or memory: https://victorymedium.com
Source: sets.json.0.dr	String found in binary or memory: https://vrt.be
Source: sets.json.0.dr	String found in binary or memory: https://vwo.com
Source: sets.json.0.dr	String found in binary or memory: https://welt.de
Source: sets.json.0.dr	String found in binary or memory: https://wieistmeineip.de
Source: sets.json.0.dr	String found in binary or memory: https://wildix.com
Source: sets.json.0.dr	String found in binary or memory: https://wildixin.com
Source: sets.json.0.dr	String found in binary or memory: https://wingify.com
Source: sets.json.0.dr	String found in binary or memory: https://wordle.at
Source: sets.json.0.dr	String found in binary or memory: https://wp.pl
Source: sets.json.0.dr	String found in binary or memory: https://wpext.pl
Source: sets.json.0.dr	String found in binary or memory: https://www.asadcdn.com
Source: sets.json.0.dr	String found in binary or memory: https://ya.ru
Source: sets.json.0.dr	String found in binary or memory: https://yours.co.uk
Source: sets.json.0.dr	String found in binary or memory: https://zalo.me
Source: sets.json.0.dr	String found in binary or memory: https://zdrowietvn.pl
Source: sets.json.0.dr	String found in binary or memory: https://zingmp3.vn
Source: sets.json.0.dr	String found in binary or memory: https://zoom.com
Source: sets.json.0.dr	String found in binary or memory: https://zoom.us

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

System Summary

Malicious sample detected (through community Yara rule)

Source: C:\Users\user\Downloads\33ae88e8-a002-46dd-8889-487f7479f3bd.tmp, type: DROPPED	Matched rule: Linux_Packer_Patched_UPX_62e11c64 Author: unknown
Source: C:\Users\user\Downloads\bin.sh.crdownload, type: DROPPED	Matched rule: Linux_Packer_Patched_UPX_62e11c64 Author: unknown
Source: dropped/chromecache_68, type: DROPPED	Matched rule: Linux_Packer_Patched_UPX_62e11c64 Author: unknown

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3720_82846416	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3720_82846416\sets.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3720_82846416\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3720_82846416\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3720_82846416\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3720_82846416\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3720_82846416\manifest.fingerprint	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_3720_685751337

Jump to behavior

Source: C:\Users\user\Downloads\33ae88e8-a002-46dd-8889-487f7479f3bd.tmp, type: DROPPED	Matched rule: Linux_Packer_Patched_UPX_62e11c64 reference_sample = 02f81a1e1edcb9032a1d7256a002b11e1e864b2e9989f5d24ea1c9b507895669, os = linux, severity = x86, creation_date = 2021-06-08, scan_context = file, reference = https://cujo.com/upx-anti-unpacking-techniques-in-iot-malware/, license = Elastic License v2, threat_name = Linux.Packer.Patched_UPX, fingerprint = 3297b5c63e70c557e71b739428b453039b142e1e04c2ab15eea4627d023b686d, id = 62e11c64-fc7d-4a0a-9d72-ad53ec3987ff, last_modified = 2021-07-28
Source: C:\Users\user\Downloads\bin.sh.crdownload, type: DROPPED	Matched rule: Linux_Packer_Patched_UPX_62e11c64 reference_sample = 02f81a1e1edcb9032a1d7256a002b11e1e864b2e9989f5d24ea1c9b507895669, os = linux, severity = x86, creation_date = 2021-06-08, scan_context = file, reference = https://cujo.com/upx-anti-unpacking-techniques-in-iot-malware/, license = Elastic License v2, threat_name = Linux.Packer.Patched_UPX, fingerprint = 3297b5c63e70c557e71b739428b453039b142e1e04c2ab15eea4627d023b686d, id = 62e11c64-fc7d-4a0a-9d72-ad53ec3987ff, last_modified = 2021-07-28
Source: dropped/chromecache_68, type: DROPPED	Matched rule: Linux_Packer_Patched_UPX_62e11c64 reference_sample = 02f81a1e1edcb9032a1d7256a002b11e1e864b2e9989f5d24ea1c9b507895669, os = linux, severity = x86, creation_date = 2021-06-08, scan_context = file, reference = https://cujo.com/upx-anti-unpacking-techniques-in-iot-malware/, license = Elastic License v2, threat_name = Linux.Packer.Patched_UPX, fingerprint = 3297b5c63e70c557e71b739428b453039b142e1e04c2ab15eea4627d023b686d, id = 62e11c64-fc7d-4a0a-9d72-ad53ec3987ff, last_modified = 2021-07-28

Source: classification engine

Classification label: mal72.troj.win@19/16@2/4

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3944:120:WilError_03

Source: C:\Windows\System32\OpenWith.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1992,i,3651476395786432483,6869830452980313092,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://42.231.79.7:51810/bin.sh"
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1992,i,3651476395786432483,6869830452980313092,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 51810
Source: unknown	Network traffic detected: HTTP traffic on port 51810 -> 49714

Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	11 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	Security Account Manager	11 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://42.231.79.7:51810/bin.sh	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Downloads\bin.sh.crdownload	100%	Avira	EXP/ELF.Agent.L.26
/opt/package/joesandbox/database/analysis/1587285/temp/droppedscan/chromecache_68	100%	Avira	EXP/ELF.Agent.L.26
C:\Users\user\Downloads\bin.sh (copy)	74%	ReversingLabs	Linux.Trojan.Dakkatoni
C:\Users\user\Downloads\bin.sh.crdownload	74%	ReversingLabs	Linux.Trojan.Dakkatoni
Chrome Cache Entry: 68	74%	ReversingLabs	Linux.Trojan.Dakkatoni

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	142.250.186.100	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://wieistmeineip.de	sets.json.0.dr	false	high
https://mercadoshops.com.co	sets.json.0.dr	false	high
https://gliadomain.com	sets.json.0.dr	false	high
https://poalim.xyz	sets.json.0.dr	false	high
https://mercadolivre.com	sets.json.0.dr	false	high
https://reshim.org	sets.json.0.dr	false	high
https://nourishingpursuits.com	sets.json.0.dr	false	high
https://medonet.pl	sets.json.0.dr	false	high
https://unotv.com	sets.json.0.dr	false	high
https://mercadoshops.com.br	sets.json.0.dr	false	high
https://joyreactor.cc	sets.json.0.dr	false	high
https://zdrowietvn.pl	sets.json.0.dr	false	high
https://johndeere.com	sets.json.0.dr	false	high
https://songstats.com	sets.json.0.dr	false	high
https://baomoi.com	sets.json.0.dr	false	high
https://supereva.it	sets.json.0.dr	false	high
https://elfinancierocr.com	sets.json.0.dr	false	high
https://bolasport.com	sets.json.0.dr	false	high
https://rws1nvtvt.com	sets.json.0.dr	false	high
https://desimartini.com	sets.json.0.dr	false	high
https://hearty.app	sets.json.0.dr	false	high
https://hearty.gift	sets.json.0.dr	false	high
https://mercadoshops.com	sets.json.0.dr	false	high
https://heartymail.com	sets.json.0.dr	false	high
https://nlc.hu	sets.json.0.dr	false	high
https://p106.net	sets.json.0.dr	false	high
https://radio2.be	sets.json.0.dr	false	high
https://finn.no	sets.json.0.dr	false	high
https://hc1.com	sets.json.0.dr	false	high
https://kompas.tv	sets.json.0.dr	false	high
https://mystudentdashboard.com	sets.json.0.dr	false	high
https://songshare.com	sets.json.0.dr	false	high
https://smaker.pl	sets.json.0.dr	false	high
https://mercadopago.com.mx	sets.json.0.dr	false	high
https://p24.hu	sets.json.0.dr	false	high
https://talkdeskqaid.com	sets.json.0.dr	false	high
https://24.hu	sets.json.0.dr	false	high
https://mercadopago.com.pe	sets.json.0.dr	false	high
https://cardsayings.net	sets.json.0.dr	false	high
https://text.com	sets.json.0.dr	false	high
https://mightytext.net	sets.json.0.dr	false	high
https://pudelek.pl	sets.json.0.dr	false	high
https://hazipatika.com	sets.json.0.dr	false	high
https://joyreactor.com	sets.json.0.dr	false	high
https://cookreactor.com	sets.json.0.dr	false	high
https://wildixin.com	sets.json.0.dr	false	high
https://eworkbookcloud.com	sets.json.0.dr	false	high
https://cognitiveai.ru	sets.json.0.dr	false	high
https://nacion.com	sets.json.0.dr	false	high
https://chennien.com	sets.json.0.dr	false	high
https://drimer.travel	sets.json.0.dr	false	high
https://deccoria.pl	sets.json.0.dr	false	high
https://mercadopago.cl	sets.json.0.dr	false	high
https://talkdeskstgid.com	sets.json.0.dr	false	high
https://naukri.com	sets.json.0.dr	false	high
https://interia.pl	sets.json.0.dr	false	high
https://bonvivir.com	sets.json.0.dr	false	high
https://carcostadvisor.be	sets.json.0.dr	false	high
https://salemovetravel.com	sets.json.0.dr	false	high
https://sapo.io	sets.json.0.dr	false	high
https://wpext.pl	sets.json.0.dr	false	high
https://welt.de	sets.json.0.dr	false	high
https://poalim.site	sets.json.0.dr	false	high
https://drimer.io	sets.json.0.dr	false	high
https://infoedgeindia.com	sets.json.0.dr	false	high
https://blackrockadvisorelite.it	sets.json.0.dr	false	high
https://cognitive-ai.ru	sets.json.0.dr	false	high
https://cafemedia.com	sets.json.0.dr	false	high
https://graziadaily.co.uk	sets.json.0.dr	false	high
https://thirdspace.org.au	sets.json.0.dr	false	high
https://mercadoshops.com.ar	sets.json.0.dr	false	high
https://smpn106jkt.sch.id	sets.json.0.dr	false	high
https://elpais.uy	sets.json.0.dr	false	high
https://landyrev.com	sets.json.0.dr	false	high
https://the42.ie	sets.json.0.dr	false	high
https://commentcamarche.com	sets.json.0.dr	false	high
https://tucarro.com.ve	sets.json.0.dr	false	high
https://rws3nvtvt.com	sets.json.0.dr	false	high
https://eleconomista.net	sets.json.0.dr	false	high
https://helpdesk.com	sets.json.0.dr	false	high
https://mercadolivre.com.br	sets.json.0.dr	false	high
https://clmbtech.com	sets.json.0.dr	false	high
https://standardsandpraiserepurpose.com	sets.json.0.dr	false	high
https://07c225f3.online	sets.json.0.dr	false	high
https://salemovefinancial.com	sets.json.0.dr	false	high
https://mercadopago.com.br	sets.json.0.dr	false	high
https://zoom.us	sets.json.0.dr	false	high
https://commentcamarche.net	sets.json.0.dr	false	high
https://etfacademy.it	sets.json.0.dr	false	high
https://mighty-app.appspot.com	sets.json.0.dr	false	high
https://hj.rs	sets.json.0.dr	false	high
https://hearty.me	sets.json.0.dr	false	high
https://mercadolibre.com.gt	sets.json.0.dr	false	high
https://timesinternet.in	sets.json.0.dr	false	high
https://indiatodayne.in	sets.json.0.dr	false	high
https://idbs-staging.com	sets.json.0.dr	false	high
https://blackrock.com	sets.json.0.dr	false	high
https://idbs-eworkbook.com	sets.json.0.dr	false	high
https://motherandbaby.com	sets.json.0.dr	false	high
https://mercadolibre.co.cr	sets.json.0.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
42.231.79.7	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	true
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587285
Start date and time:	2025-01-10 04:01:36 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://42.231.79.7:51810/bin.sh
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.troj.win@19/16@2/4

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.67, 142.250.186.110, 64.233.184.84, 172.217.16.206, 142.250.186.78, 142.250.181.238, 199.232.214.172, 192.229.221.95, 142.250.185.206, 216.58.206.78, 142.250.184.206, 142.250.186.99, 172.217.18.14, 34.104.35.123, 2.23.242.162, 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: http://42.231.79.7:51810/bin.sh

Simulations

Behavior and APIs

Time	Type	Description
22:03:44	API Interceptor	1x Sleep call for process: OpenWith.exe modified

Input	Output
URL: http://42.231.79.7:51810 Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": true, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: http://42.231.79.7:51810

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 02:02:29 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9799000738313945
Encrypted:	false
SSDEEP:	48:8RWwdoTM8s1HxidAKZdA19ehwiZUklqehDy+3:8mvuoy
MD5:	3425DED89515BE7EBA4832443E353AE2
SHA1:	9DE34E7C76A9427969BCF3F7B04C0B8D5D49D15B
SHA-256:	B28B4B37B02B86DA6D2574D4A12C03856929CCF3EEA4B47636670F4E491D1897
SHA-512:	2C35F71E93C3CED1C42463EC4B89660B16D4867CE671FDA33EA12B9F8698A18D1D92329259370CE51E3168EA26DEEACF09FE670FC18E44E503C044A2C595217D
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IZM.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZM.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZM.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZM............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VZO............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........##.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 02:02:29 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9960264772574705
Encrypted:	false
SSDEEP:	48:8owdoTM8s1HxidAKZdA1weh/iZUkAQkqehYy+2:82vs9Qxy
MD5:	B6EC7919659D71A210A1AEBF478D4ABA
SHA1:	D40D5A6EF569C7236EEB2AD4420C430494AC4E84
SHA-256:	E40915764A2D38D03A473BED9F570E18886771352BB494109419764028E4F250
SHA-512:	071E7614E5B971109A3D17347B719810058C37C05BDC292DBCADF6B4D92D77AD3CBAE669A5697786A0C904C9C258AA91FDC3BC8C3DA30D37CE671883ADCC1C48
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....k....c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IZM.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZM.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZM.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZM............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VZO............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........##.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.009736386298069
Encrypted:	false
SSDEEP:	48:8xqwdoTM8sHxidAKZdA14tseh7sFiZUkmgqeh7sOy+BX:8xIvgnEy
MD5:	B19C29B139167B24EA4FE360F7E8E78A
SHA1:	D1C853A9CF2F1B7BA5939A5AD99F72C6E34CD259
SHA-256:	49BCBC100E49DAF1DDBFB21B3DADEA03C820B3D61AD85D9E80277867B5C5AF7C
SHA-512:	2C6FD3A9A61D05541237D8BF37B3526123B807515407880D1415FD84BEC87479BEB97E120C28756FB69E6CE15FA8F179C725B79E00C8E7B4F804F667A08C41DB
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IZM.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZM.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZM.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZM............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........##.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 02:02:28 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9961339160408906
Encrypted:	false
SSDEEP:	48:8awdoTM8s1HxidAKZdA1vehDiZUkwqehsy+R:8YvX2y
MD5:	CB8774B70EB7B566EC5EC81612B51277
SHA1:	C8BC39F99A78DBE3CB4E736D225B12C604DC0EC3
SHA-256:	A66B352B2A8BDDFA80919DF0F16739FA4027BE4E8E3E0F57F1857BD22BB69FBC
SHA-512:	B95A821F2BFD67E87DA785529EFBD2E04725F4FB6B5C66EDD6E7FD10677EC04E55A1DD2B04A65D8D0751FA21154523B5284AA4413C910F30D652E3465EE4000B
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IZM.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZM.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZM.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZM............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VZO............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........##.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 02:02:29 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9858150592756294
Encrypted:	false
SSDEEP:	48:8GwdoTM8s1HxidAKZdA1hehBiZUk1W1qehay+C:8Uvn96y
MD5:	6BFC9E2C38E147FDF44BE209BB158C0A
SHA1:	B8A55F1B206EBE38B16FEB012CB66389FDF947F0
SHA-256:	4B1FF7B502DBC88D25AEC89B94806FC30F22CDDB5CD7830AEF3F9B241770962D
SHA-512:	531C0A2EADC64DDA6197D52CC31BD1ADFA906555DAD9B7C6F2C8A366609796FD3321A73159F6DF565E0A426D24E7AE526A16A6F96E9B7E7084B3581C0007CA4C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IZM.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZM.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZM.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZM............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VZO............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........##.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Jan 10 02:02:28 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9971457677396836
Encrypted:	false
SSDEEP:	48:8twdoTM8s1HxidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbEy+yT+:8NvvT/TbxWOvTbEy7T
MD5:	7D197413D0DA495CEB5BD631C51E6188
SHA1:	B6463E6972F51DD46ACBE76970784FBE4E4FD8C0
SHA-256:	C5C8497A4EF4DB46F7E95B4AE760BE120B41EACD0C371CC2CB081D020A02C450
SHA-512:	03E6FD3A7226EBB968827C66906AA1D3B338B01E3C4FA16892EB95877F916F9A37C074CA7373D9442161E9E62A1494CCCFF92580E76C4259CF8C7CABD4FD35CA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......\|..c..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IZM.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZM.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZM.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZM............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VZO............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........##.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e..C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\33ae88e8-a002-46dd-8889-487f7479f3bd.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, no section header
Category:	dropped
Size (bytes):	8132
Entropy (8bit):	7.704654889473878
Encrypted:	false
SSDEEP:	192:fTu2PzRurki7SLDLVpVovt9SbVySN6TQ3JuGpymy/qD1t:flzEBkDOvTCZuQEkymy/Gt
MD5:	0FC8FF39AAF015028EEDCBFFF5F8FC88
SHA1:	0F6413CF9BF630231BAD3D327CC4006AD7C22744
SHA-256:	59AE7309B87C1578CC5920515EBE5B151D059C3794F50ABD8ED1D48ABF53180D
SHA-512:	2E24853A41D5AAB0D05BA0A440C1299310B15772B19AB0CA0C13535019CC699857D98E46EEE6F02686C6879C049A9DE4DFCE95D21A3C422768B575300193B5E8
Malicious:	true
Yara Hits:	Rule: Linux_Packer_Patched_UPX_62e11c64, Description: unknown, Source: C:\Users\user\Downloads\33ae88e8-a002-46dd-8889-487f7479f3bd.tmp, Author: unknown
Reputation:	low
Preview:	.ELF.....................B.....4.........4. ...(.............@...@...........................C...C......../...........UPX!.X.....................^....\|.$..ELF..........@.`....4...0... ...(......<...@......[v......H...`.t..;_...dt.Q.....].M................w...<...'.U....!'...............`.....#......$..s..'9... ....3./.'...(.`..;.g.....{. ....2p. ............/.".`..@..............Y.... ......$Bw...{./... ......O..$....o... ..;$......7..{....&y.`.(GT...}..K..c..S)...Kg.$..d....m+.#......./.nB..../o +.6...;.!..y!.T$......[.,...K$......$.....7..W..P3.............`......_.<..S..X-.......-...-...-...-...-...-...-......-.-.[_.....!0....X.8!$.......k..f(!w. .+...../..'.$....@..9@.P.O....B.#....-X.-,.._.(..MW......*B...4M.4.......L..w-.7......@.w.v3... !...=...oP[...9..h....!..3v...s...S.....G..4&D..m....(........-....C.#.W.!....C...~.#[,c.....!.....0..#.v...b..pk.P.#... .<...4c..c..+.[p.w.. 1...D.#,b.o7....(...'.....g..!./.\|.#...M/.?'...'H'...-\.x.4.t.8(..-`th...0]0.,

C:\Users\user\Downloads\bin.sh (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, no section header
Category:	dropped
Size (bytes):	135784
Entropy (8bit):	7.814832789965999
Encrypted:	false
SSDEEP:	3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioP:p3lOYoaja8xzx/0wsxzSi2
MD5:	59CE0BABA11893F90527FC951AC69912
SHA1:	5857A7DD621C4C3EBB0B5A3BEC915D409F70D39F
SHA-256:	4293C1D8574DC87C58360D6BAC3DAA182F64F7785C9D41DA5E0741D2B1817FC7
SHA-512:	C5B12797B477E5E5964A78766BB40B1C0D9FDFB8EEF1F9AEE3DF451E3441A40C61D325BF400BA51048811B68E1C70A95F15E4166B7A65A4ECA0C624864328647
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Reputation:	low
Preview:	.ELF.....................B.....4.........4. ...(.............@...@...........................C...C......../...........UPX!.X.....................^....\|.$..ELF..........@.`....4...0... ...(......<...@......[v......H...`.t..;_...dt.Q.....].M................w...<...'.U....!'...............`.....#......$..s..'9... ....3./.'...(.`..;.g.....{. ....2p. ............/.".`..@..............Y.... ......$Bw...{./... ......O..$....o... ..;$......7..{....&y.`.(GT...}..K..c..S)...Kg.$..d....m+.#......./.nB..../o +.6...;.!..y!.T$......[.,...K$......$.....7..W..P3.............`......_.<..S..X-.......-...-...-...-...-...-...-......-.-.[_.....!0....X.8!$.......k..f(!w. .+...../..'.$....@..9@.P.O....B.#....-X.-,.._.(..MW......*B...4M.4.......L..w-.7......@.w.v3... !...=...oP[...9..h....!..3v...s...S.....G..4&D..m....(........-....C.#.W.!....C...~.#[,c.....!.....0..#.v...b..pk.P.#... .<...4c..c..+.[p.w.. 1...D.#,b.o7....(...'.....g..!./.\|.#...M/.?'...'H'...-\.x.4.t.8(..-`th...0]0.,

C:\Users\user\Downloads\bin.sh.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, no section header
Category:	dropped
Size (bytes):	135784
Entropy (8bit):	7.814832789965999
Encrypted:	false
SSDEEP:	3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioP:p3lOYoaja8xzx/0wsxzSi2
MD5:	59CE0BABA11893F90527FC951AC69912
SHA1:	5857A7DD621C4C3EBB0B5A3BEC915D409F70D39F
SHA-256:	4293C1D8574DC87C58360D6BAC3DAA182F64F7785C9D41DA5E0741D2B1817FC7
SHA-512:	C5B12797B477E5E5964A78766BB40B1C0D9FDFB8EEF1F9AEE3DF451E3441A40C61D325BF400BA51048811B68E1C70A95F15E4166B7A65A4ECA0C624864328647
Malicious:	true
Yara Hits:	Rule: Linux_Packer_Patched_UPX_62e11c64, Description: unknown, Source: C:\Users\user\Downloads\bin.sh.crdownload, Author: unknown
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 74%
Reputation:	low
Preview:	.ELF.....................B.....4.........4. ...(.............@...@...........................C...C......../...........UPX!.X.....................^....\|.$..ELF..........@.`....4...0... ...(......<...@......[v......H...`.t..;_...dt.Q.....].M................w...<...'.U....!'...............`.....#......$..s..'9... ....3./.'...(.`..;.g.....{. ....2p. ............/.".`..@..............Y.... ......$Bw...{./... ......O..$....o... ..;$......7..{....&y.`.(GT...}..K..c..S)...Kg.$..d....m+.#......./.nB..../o +.6...;.!..y!.T$......[.,...K$......$.....7..W..P3.............`......_.<..S..X-.......-...-...-...-...-...-...-......-.-.[_.....!0....X.8!$.......k..f(!w. .+...../..'.$....@..9@.P.O....B.#....-X.-,.._.(..MW......*B...4M.4.......L..w-.7......@.w.v3... !...=...oP[...9..h....!..3v...s...S.....G..4&D..m....(........-....C.#.W.!....C...~.#[,c.....!.....0..#.v...b..pk.P.#... .<...4c..c..+.[p.w.. 1...D.#,b.o7....(...'.....g..!./.\|.#...M/.?'...'H'...-\.x.4.t.8(..-`th...0]0.,

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3720_82846416\LICENSE

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Reputation:	low
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3720_82846416\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	6.018989605004616
Encrypted:	false
SSDEEP:	48:p/hUI1OwEU3AdIq7ak68O40E2szOxxUJ8BPFkf31U4PrHfqY3J5D:RnOwtQIq7aZ40E2sYUJAYRr/qYZ5D
MD5:	C4709C1D483C9233A3A66A7E157624EA
SHA1:	99A000EB5FE5CC1E94E3155EE075CD6E43DC7582
SHA-256:	225243DC75352D63B0B9B2F48C8AAA09D55F3FB9E385741B12A1956A941880D9
SHA-512:	B45E1FD999D1340CC5EB5A49A4CD967DC736EA3F4EC8B02227577CC3D1E903341BE3217FBB0B74765C72085AC51C63EEF6DCB169D137BBAF3CC49E21EA6468D7
Malicious:	false
Reputation:	low
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJVczFpOUt3Zm5uMThTVVR1RVItRXBDTTMwVzFkNTc0cGJwUlJSdGJYM0JVIn0seyJwYXRoIjoic2V0cy5qc29uIiwicm9vdF9oYXNoIjoiM0hiWThLc3poeEF6UDVSUU9fZEpvZGNwbEtpRXR0RWh2UmZMZEtjSTdjZyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImdvbnBlbWRna2pjZWNkZ2JuYWFiaXBwcGJtZ2ZnZ2JlIiwiaXRlbV92ZXJzaW9uIjoiMjAyNC4xMS44LjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"lGxZ1-AH7F8MftKSBdZiFULmC8hZkIHy1_2XIoU81Z5mK0wHVwNV7-55CBTcuuvKjTje-AnKLDoG4S0A_Jeg4lSQK5V_Q4f6JVqp5Vj_ge86YkRZEv4m1bjKRY4N17SHobwuH8Hc_kAugFIlG1LIDHnrm1N7ZWIqo3fVlnVqgSstmvFXAhBazgs1UYRi3hPjPM6e1q1i2N1mIUbxLvG41frGo2QJ8W5J3buUjzs-0y250k-YkadKAR0

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3720_82846416\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.820000180714897
Encrypted:	false
SSDEEP:	3:SVzHL3phUmWRDNKydvgHVz:SBHLLUmWRbCp
MD5:	BBEC7670A2519FEB0627F17D0C0B5276
SHA1:	9C30B996F1B069F86EF7C0136DFAF7E614674DEA
SHA-256:	670A6F6BBADAB2C2BE63898525FCAF72E7454739E77C04D120BC1A46B6694CAC
SHA-512:	1ED4ED6AE2A2CBE86F9E8C6C7A2672EBB2F37DBE83D2BF09D875DB435ED63BF5F5CF60CA846865166F9A498095F6D61BD51B0A092E097430439E8A5A3A14CB15
Malicious:	false
Reputation:	low
Preview:	1.03cccbb22b17080279ea1707c9ab093c59f4f4dd09580c841cfa794cb372228d

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3720_82846416\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.462192586591686
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFCmMARWHJqS1kULJVPY:F6VlM8aRWpqS1kSJVg
MD5:	084E339C0C9FE898102815EAC9A7CDEA
SHA1:	6ABF7EAAA407D2EAB8706361E5A2E5F776D6C644
SHA-256:	52CD62F4AC1F9E7D7C4944EE111F84A42337D16D5DE7BE296E945146D6D7DC15
SHA-512:	0B67A89F3EBFF6FEC3796F481EC2AFBAC233CF64FDC618EC6BA1C12AE125F28B27EE09E8CD0FADB8F6C8785C83929EA6F751E0DDF592DD072AB2CF439BD28534
Malicious:	false
Reputation:	low
Preview:	{. "manifest_version": 2,. "name": "First Party Sets",. "version": "2024.11.8.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3720_82846416\sets.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	4.629347296880043
Encrypted:	false
SSDEEP:	96:Mon4mvC4qX19s1blbw/BNKLcxbdmf56MFJtRTGXvcxN43uP+8qJl:v5C4ql7BkIVmtRTGXvcxBsl
MD5:	8C702C686B703020BC0290BAFC90D7A0
SHA1:	EB08FF7885B4C1DE3EF3D61E40697C0C71903E27
SHA-256:	97D9E39021512305820F27B9662F0351E45639124F5BD29F0466E9072A9D0C62
SHA-512:	6137D0ED10E6A27924ED3AB6A0C5F9B21EB0E16A876447DADABD88338198F31BB9D89EF8F0630F4573EA34A24FB3FD3365D7EA78A97BA10028A0758E0A550739
Malicious:	false
Reputation:	low
Preview:	{"primary":"https://bild.de","associatedSites":["https://welt.de","https://autobild.de","https://computerbild.de","https://wieistmeineip.de"],"serviceSites":["https://www.asadcdn.com"]}.{"primary":"https://blackrock.com","associatedSites":["https://blackrockadvisorelite.it","https://cachematrix.com","https://efront.com","https://etfacademy.it","https://ishares.com"]}.{"primary":"https://cafemedia.com","associatedSites":["https://cardsayings.net","https://nourishingpursuits.com"]}.{"primary":"https://caracoltv.com","associatedSites":["https://noticiascaracol.com","https://bluradio.com","https://shock.co","https://bumbox.com","https://hjck.com"]}.{"primary":"https://carcostadvisor.com","ccTLDs":{"https://carcostadvisor.com":["https://carcostadvisor.be","https://carcostadvisor.fr"]}}.{"primary":"https://citybibleforum.org","associatedSites":["https://thirdspace.org.au"]}.{"primary":"https://cognitiveai.ru","associatedSites":["https://cognitive-ai.ru"]}.{"primary":"https://drimer.io","asso

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, no section header
Category:	downloaded
Size (bytes):	135784
Entropy (8bit):	7.814832789965999
Encrypted:	false
SSDEEP:	3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioP:p3lOYoaja8xzx/0wsxzSi2
MD5:	59CE0BABA11893F90527FC951AC69912
SHA1:	5857A7DD621C4C3EBB0B5A3BEC915D409F70D39F
SHA-256:	4293C1D8574DC87C58360D6BAC3DAA182F64F7785C9D41DA5E0741D2B1817FC7
SHA-512:	C5B12797B477E5E5964A78766BB40B1C0D9FDFB8EEF1F9AEE3DF451E3441A40C61D325BF400BA51048811B68E1C70A95F15E4166B7A65A4ECA0C624864328647
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Reputation:	low
URL:	http://42.231.79.7:51810/bin.sh
Preview:	.ELF.....................B.....4.........4. ...(.............@...@...........................C...C......../...........UPX!.X.....................^....\|.$..ELF..........@.`....4...0... ...(......<...@......[v......H...`.t..;_...dt.Q.....].M................w...<...'.U....!'...............`.....#......$..s..'9... ....3./.'...(.`..;.g.....{. ....2p. ............/.".`..@..............Y.... ......$Bw...{./... ......O..$....o... ..;$......7..{....&y.`.(GT...}..K..c..S)...Kg.$..d....m+.#......./.nB..../o +.6...;.!..y!.T$......[.,...K$......$.....7..W..P3.............`......_.<..S..X-.......-...-...-...-...-...-...-......-.-.[_.....!0....X.8!$.......k..f(!w. .+...../..'.$....@..9@.P.O....B.#....-X.-,.._.(..MW......*B...4M.4.......L..w-.7......@.w.v3... !...=...oP[...9..h....!..3v...s...S.....G..4&D..m....(........-....C.#.W.!....C...~.#[,c.....!.....0..#.v...b..pk.P.#... .<...4c..c..+.[p.w.. 1...D.#,b.o7....(...'.....g..!./.\|.#...M/.?'...'H'...-\.x.4.t.8(..-`th...0]0.,

Static File Info

⊘No static file info

File Icon


Icon Hash:	00b29a8e86828200

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 04:02:21.093709946 CET	49675	443	192.168.2.5	23.1.237.91
Jan 10, 2025 04:02:21.093713045 CET	49674	443	192.168.2.5	23.1.237.91
Jan 10, 2025 04:02:21.171883106 CET	49673	443	192.168.2.5	23.1.237.91
Jan 10, 2025 04:02:30.701411963 CET	49675	443	192.168.2.5	23.1.237.91
Jan 10, 2025 04:02:30.701412916 CET	49674	443	192.168.2.5	23.1.237.91
Jan 10, 2025 04:02:30.779536963 CET	49673	443	192.168.2.5	23.1.237.91
Jan 10, 2025 04:02:31.819282055 CET	49712	443	192.168.2.5	142.250.186.100
Jan 10, 2025 04:02:31.819338083 CET	443	49712	142.250.186.100	192.168.2.5
Jan 10, 2025 04:02:31.819421053 CET	49712	443	192.168.2.5	142.250.186.100
Jan 10, 2025 04:02:31.819657087 CET	49712	443	192.168.2.5	142.250.186.100
Jan 10, 2025 04:02:31.819683075 CET	443	49712	142.250.186.100	192.168.2.5
Jan 10, 2025 04:02:32.414586067 CET	443	49703	23.1.237.91	192.168.2.5
Jan 10, 2025 04:02:32.414800882 CET	49703	443	192.168.2.5	23.1.237.91
Jan 10, 2025 04:02:32.457524061 CET	443	49712	142.250.186.100	192.168.2.5
Jan 10, 2025 04:02:32.457940102 CET	49712	443	192.168.2.5	142.250.186.100
Jan 10, 2025 04:02:32.458007097 CET	443	49712	142.250.186.100	192.168.2.5
Jan 10, 2025 04:02:32.459695101 CET	443	49712	142.250.186.100	192.168.2.5
Jan 10, 2025 04:02:32.459768057 CET	49712	443	192.168.2.5	142.250.186.100
Jan 10, 2025 04:02:32.461333990 CET	49712	443	192.168.2.5	142.250.186.100
Jan 10, 2025 04:02:32.461432934 CET	443	49712	142.250.186.100	192.168.2.5
Jan 10, 2025 04:02:32.513541937 CET	49712	443	192.168.2.5	142.250.186.100
Jan 10, 2025 04:02:32.513571978 CET	443	49712	142.250.186.100	192.168.2.5
Jan 10, 2025 04:02:32.560591936 CET	49712	443	192.168.2.5	142.250.186.100
Jan 10, 2025 04:02:32.930692911 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:32.930927038 CET	49715	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:32.935581923 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:32.935652018 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:32.936336994 CET	51810	49715	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:32.936397076 CET	49715	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:32.963551998 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:32.968571901 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.097925901 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.098540068 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.098550081 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.098558903 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.098568916 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.098577976 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.098645926 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.098647118 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.098918915 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.098927975 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.098942041 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.098948002 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.100039005 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.103455067 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.103466034 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.103475094 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.103631020 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.157557011 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.189660072 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.189672947 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.190340042 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.448100090 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.448112965 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.448163986 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.448910952 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.448971033 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.448983908 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.449002028 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.449011087 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.449017048 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.449040890 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.449340105 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.449383020 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.449471951 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.449482918 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.449491978 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.449522018 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.450098991 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.450109005 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.450162888 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.450190067 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.450233936 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.450236082 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.451121092 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.451133013 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.451143026 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.451152086 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.451173067 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.451210976 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.451879978 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.451890945 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.451895952 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.451940060 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.452327967 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.452337980 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.452383995 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.452455997 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.453020096 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.453030109 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.453038931 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.453075886 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.453107119 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.538940907 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.538963079 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.539019108 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.799068928 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.799092054 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.799120903 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.799149990 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.799154043 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.799173117 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.799194098 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.799504042 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.799519062 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.799527884 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.799595118 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.799895048 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.799957991 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.799973011 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.799988985 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.799998045 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.800031900 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.800209045 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.800224066 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.800249100 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.800271034 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.800563097 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.800587893 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.800602913 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.800606012 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.800652027 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.800965071 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.800980091 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.800993919 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.801026106 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.803307056 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.803369999 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.803386927 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.803389072 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.803402901 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.803421974 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.803426027 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.803436995 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.803529978 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.803989887 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.804003954 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.804018021 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.804033995 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.804034948 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.804055929 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.804063082 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.804094076 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.804835081 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.804847956 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.804872990 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.804884911 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.804908991 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.804936886 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.805249929 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.805275917 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.805290937 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.805316925 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.806041956 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.806077003 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.806086063 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.806092024 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.806128979 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.806508064 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.806521893 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.806545019 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.806556940 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.806560040 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.806598902 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.807096958 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.807112932 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.807133913 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.807167053 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.807514906 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.807540894 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.807560921 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.807564020 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.807576895 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.807602882 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.808028936 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.808083057 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.808084011 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.808095932 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.808104038 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.808137894 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.808545113 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.808559895 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.808574915 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.808597088 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.808608055 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.809073925 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.809088945 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.809103012 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.809128046 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.858906031 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:34.892987013 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.893002033 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:34.893068075 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.149082899 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.149099112 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.149161100 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.149514914 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.149539948 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.149554014 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.149569988 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.149589062 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.149593115 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.149609089 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.150028944 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.150049925 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.150075912 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.150080919 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.150094986 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.150130033 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.150463104 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.150479078 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.150496960 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.150511026 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.150546074 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.150645018 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.150669098 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.150681973 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.150695086 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.150707960 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.150741100 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.151119947 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.151135921 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.151149988 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.151185036 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.151627064 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.151642084 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.151655912 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.151676893 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.151701927 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.152192116 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.152209044 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.152226925 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.152252913 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.153599024 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.153636932 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.153650045 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.153659105 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.153666019 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.153692007 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.155709982 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.155735970 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.155751944 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.155774117 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.155791044 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.157151937 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.157166004 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.157187939 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.157201052 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.157217026 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.157243967 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.158235073 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.158250093 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.158263922 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.158302069 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.159387112 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.159401894 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.159416914 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.159442902 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.159461975 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.159864902 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.159881115 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.159894943 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.159926891 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.160222054 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.161128044 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:35.161181927 CET	49714	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:02:35.164995909 CET	51810	49714	42.231.79.7	192.168.2.5
Jan 10, 2025 04:02:42.374804020 CET	443	49712	142.250.186.100	192.168.2.5
Jan 10, 2025 04:02:42.374965906 CET	443	49712	142.250.186.100	192.168.2.5
Jan 10, 2025 04:02:42.375164986 CET	49712	443	192.168.2.5	142.250.186.100
Jan 10, 2025 04:02:43.802361965 CET	49712	443	192.168.2.5	142.250.186.100
Jan 10, 2025 04:02:43.802433014 CET	443	49712	142.250.186.100	192.168.2.5
Jan 10, 2025 04:03:17.951351881 CET	49715	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:03:17.956171989 CET	51810	49715	42.231.79.7	192.168.2.5
Jan 10, 2025 04:03:31.877393007 CET	49990	443	192.168.2.5	142.250.186.100
Jan 10, 2025 04:03:31.877443075 CET	443	49990	142.250.186.100	192.168.2.5
Jan 10, 2025 04:03:31.881390095 CET	49990	443	192.168.2.5	142.250.186.100
Jan 10, 2025 04:03:31.881390095 CET	49990	443	192.168.2.5	142.250.186.100
Jan 10, 2025 04:03:31.881434917 CET	443	49990	142.250.186.100	192.168.2.5
Jan 10, 2025 04:03:32.536631107 CET	443	49990	142.250.186.100	192.168.2.5
Jan 10, 2025 04:03:32.536910057 CET	49990	443	192.168.2.5	142.250.186.100
Jan 10, 2025 04:03:32.536925077 CET	443	49990	142.250.186.100	192.168.2.5
Jan 10, 2025 04:03:32.537425041 CET	443	49990	142.250.186.100	192.168.2.5
Jan 10, 2025 04:03:32.537908077 CET	49990	443	192.168.2.5	142.250.186.100
Jan 10, 2025 04:03:32.538012981 CET	443	49990	142.250.186.100	192.168.2.5
Jan 10, 2025 04:03:32.592592001 CET	49990	443	192.168.2.5	142.250.186.100
Jan 10, 2025 04:03:33.797544003 CET	49715	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:03:33.803158998 CET	51810	49715	42.231.79.7	192.168.2.5
Jan 10, 2025 04:03:33.803276062 CET	49715	51810	192.168.2.5	42.231.79.7
Jan 10, 2025 04:03:36.883874893 CET	56560	53	192.168.2.5	1.1.1.1
Jan 10, 2025 04:03:36.889484882 CET	53	56560	1.1.1.1	192.168.2.5
Jan 10, 2025 04:03:36.889568090 CET	56560	53	192.168.2.5	1.1.1.1
Jan 10, 2025 04:03:36.895200968 CET	53	56560	1.1.1.1	192.168.2.5
Jan 10, 2025 04:03:37.367089033 CET	56560	53	192.168.2.5	1.1.1.1
Jan 10, 2025 04:03:37.372351885 CET	53	56560	1.1.1.1	192.168.2.5
Jan 10, 2025 04:03:37.372435093 CET	56560	53	192.168.2.5	1.1.1.1
Jan 10, 2025 04:03:42.438101053 CET	443	49990	142.250.186.100	192.168.2.5
Jan 10, 2025 04:03:42.438263893 CET	443	49990	142.250.186.100	192.168.2.5
Jan 10, 2025 04:03:42.438353062 CET	49990	443	192.168.2.5	142.250.186.100
Jan 10, 2025 04:03:43.798037052 CET	49990	443	192.168.2.5	142.250.186.100
Jan 10, 2025 04:03:43.798115015 CET	443	49990	142.250.186.100	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 04:02:27.257371902 CET	53	60146	1.1.1.1	192.168.2.5
Jan 10, 2025 04:02:27.559366941 CET	53	52768	1.1.1.1	192.168.2.5
Jan 10, 2025 04:02:28.600276947 CET	53	52358	1.1.1.1	192.168.2.5
Jan 10, 2025 04:02:31.811335087 CET	64049	53	192.168.2.5	1.1.1.1
Jan 10, 2025 04:02:31.811789989 CET	63493	53	192.168.2.5	1.1.1.1
Jan 10, 2025 04:02:31.818226099 CET	53	64049	1.1.1.1	192.168.2.5
Jan 10, 2025 04:02:31.818453074 CET	53	63493	1.1.1.1	192.168.2.5
Jan 10, 2025 04:02:45.709294081 CET	53	64033	1.1.1.1	192.168.2.5
Jan 10, 2025 04:03:04.757165909 CET	53	60901	1.1.1.1	192.168.2.5
Jan 10, 2025 04:03:27.149926901 CET	53	64702	1.1.1.1	192.168.2.5
Jan 10, 2025 04:03:28.411617994 CET	53	58663	1.1.1.1	192.168.2.5
Jan 10, 2025 04:03:36.883142948 CET	53	65478	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 04:02:31.811335087 CET	192.168.2.5	1.1.1.1	0xb942	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 04:02:31.811789989 CET	192.168.2.5	1.1.1.1	0x1287	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 04:02:31.818226099 CET	1.1.1.1	192.168.2.5	0xb942	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
Jan 10, 2025 04:02:31.818453074 CET	1.1.1.1	192.168.2.5	0x1287	No error (0)	www.google.com			65	IN (0x0001)	false

HTTP Request Dependency Graph

42.231.79.7:51810

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49714	42.231.79.7	51810	5676	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 04:02:32.963551998 CET	438	OUT	GET /bin.sh HTTP/1.1 Host: 42.231.79.7:51810 Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 10, 2025 04:02:34.097925901 CET	108	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 135784 Connection: close Content-Type: application/zip

Target ID:	0
Start time:	22:02:22
Start date:	09/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	22:02:26
Start date:	09/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1992,i,3651476395786432483,6869830452980313092,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	22:02:32
Start date:	09/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://42.231.79.7:51810/bin.sh"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:03:44
Start date:	09/01/2025
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff6f0350000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: C:\Users\user\Downloads\bin.sh.crdownload	Avira: detection malicious, Label: EXP/ELF.Agent.L.26
Source: /opt/package/joesandbox/database/analysis/1587285/temp/droppedscan/chromecache_68	Avira: detection malicious, Label: EXP/ELF.Agent.L.26

Source: C:\Users\user\Downloads\bin.sh (copy)	ReversingLabs: Detection: 73%
Source: C:\Users\user\Downloads\bin.sh.crdownload	ReversingLabs: Detection: 73%
Source: Chrome Cache Entry: 68	ReversingLabs: Detection: 73%

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7
Source: unknown	TCP traffic detected without corresponding DNS query: 42.231.79.7

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://42.231.79.7:51810/bin.sh

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Downloads\33ae88e8-a002-46dd-8889-487f7479f3bd.tmp

C:\Users\user\Downloads\bin.sh (copy)

C:\Users\user\Downloads\bin.sh.crdownload

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3720_82846416\LICENSE

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3720_82846416\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3720_82846416\manifest.fingerprint

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3720_82846416\manifest.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping3720_82846416\sets.json

Chrome Cache Entry: 68

Static File Info

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Windows Analysis Report
http://42.231.79.7:51810/bin.sh