Windows Analysis Report
N1aqZIb7KG.exe

Machine Learning detection for dropped file

Source: Yara match	File source: N1aqZIb7KG.exe, type: SAMPLE
Source: Yara match	File source: 1.0.N1aqZIb7KG.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.2101338617.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: N1aqZIb7KG.exe PID: 1880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Explower.exe PID: 1616, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED

Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Explower.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: N1aqZIb7KG.exe

Joe Sandbox ML: detected

Source: N1aqZIb7KG.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Contains functionality to spread to USB devices (.Net source)

Source: N1aqZIb7KG.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Spreading

Source: N1aqZIb7KG.exe, Usb1.cs	.Net Code: infect
Source: Explower.exe.1.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe0.1.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe1.1.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe2.1.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe3.1.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe4.1.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe5.1.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe6.1.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe7.1.dr, Usb1.cs	.Net Code: infect
Source: Explower.exe8.1.dr, Usb1.cs	.Net Code: infect

Source: N1aqZIb7KG.exe, 00000001.00000000.2101338617.0000000000532000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: \autorun.inf
Source: N1aqZIb7KG.exe, 00000001.00000000.2101338617.0000000000532000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: N1aqZIb7KG.exe, 00000001.00000000.2101338617.0000000000532000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: N1aqZIb7KG.exe	Binary or memory string: \autorun.inf
Source: N1aqZIb7KG.exe	Binary or memory string: [autorun]
Source: N1aqZIb7KG.exe	Binary or memory string: autorun.inf
Source: Explower.exe4.1.dr	Binary or memory string: \autorun.inf
Source: Explower.exe4.1.dr	Binary or memory string: [autorun]
Source: Explower.exe4.1.dr	Binary or memory string: autorun.inf
Source: Explower.exe2.1.dr	Binary or memory string: \autorun.inf
Source: Explower.exe2.1.dr	Binary or memory string: [autorun]
Source: Explower.exe2.1.dr	Binary or memory string: autorun.inf
Source: Explower.exe1.1.dr	Binary or memory string: \autorun.inf
Source: Explower.exe1.1.dr	Binary or memory string: [autorun]
Source: Explower.exe1.1.dr	Binary or memory string: autorun.inf
Source: Explower.exe6.1.dr	Binary or memory string: \autorun.inf
Source: Explower.exe6.1.dr	Binary or memory string: [autorun]
Source: Explower.exe6.1.dr	Binary or memory string: autorun.inf
Source: Explower.exe.1.dr	Binary or memory string: \autorun.inf
Source: Explower.exe.1.dr	Binary or memory string: [autorun]
Source: Explower.exe.1.dr	Binary or memory string: autorun.inf
Source: Explower.exe3.1.dr	Binary or memory string: \autorun.inf
Source: Explower.exe3.1.dr	Binary or memory string: [autorun]
Source: Explower.exe3.1.dr	Binary or memory string: autorun.inf
Source: Explower.exe7.1.dr	Binary or memory string: \autorun.inf
Source: Explower.exe7.1.dr	Binary or memory string: [autorun]
Source: Explower.exe7.1.dr	Binary or memory string: autorun.inf
Source: Explower.exe8.1.dr	Binary or memory string: \autorun.inf
Source: Explower.exe8.1.dr	Binary or memory string: [autorun]
Source: Explower.exe8.1.dr	Binary or memory string: autorun.inf
Source: Explower.exe5.1.dr	Binary or memory string: \autorun.inf
Source: Explower.exe5.1.dr	Binary or memory string: [autorun]
Source: Explower.exe5.1.dr	Binary or memory string: autorun.inf
Source: svchost.exe.1.dr	Binary or memory string: \autorun.inf
Source: svchost.exe.1.dr	Binary or memory string: [autorun]
Source: svchost.exe.1.dr	Binary or memory string: autorun.inf
Source: Explower.exe0.1.dr	Binary or memory string: \autorun.inf
Source: Explower.exe0.1.dr	Binary or memory string: [autorun]
Source: Explower.exe0.1.dr	Binary or memory string: autorun.inf

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Network Connect: 18.197.239.109 13150			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Network Connect: 3.68.171.119 13150			Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.6:49709 -> 3.68.171.119:13150
Source: global traffic	TCP traffic: 192.168.2.6:49725 -> 18.197.239.109:13150
Source: global traffic	TCP traffic: 192.168.2.6:49739 -> 52.28.247.255:13150

Source: Joe Sandbox View	IP Address: 52.28.247.255 52.28.247.255
Source: Joe Sandbox View	IP Address: 18.197.239.109 18.197.239.109

Source: Joe Sandbox View

ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: 6.tcp.eu.ngrok.io

Source: SIHClient.exe, 00000010.00000003.2295775556.0000026001E2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros#
Source: SIHClient.exe, 00000010.00000002.2688090120.0000026002699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsofto

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: N1aqZIb7KG.exe, type: SAMPLE
Source: Yara match	File source: 1.0.N1aqZIb7KG.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.2101338617.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: N1aqZIb7KG.exe PID: 1880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Explower.exe PID: 1616, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED

System Summary

Source: N1aqZIb7KG.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: N1aqZIb7KG.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: N1aqZIb7KG.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: N1aqZIb7KG.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 1.0.N1aqZIb7KG.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 1.0.N1aqZIb7KG.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 1.0.N1aqZIb7KG.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.N1aqZIb7KG.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000001.00000000.2101338617.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000001.00000000.2101338617.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen

Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Code function: 1_2_055900F6 NtQuerySystemInformation,	1_2_055900F6
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Code function: 1_2_055900BB NtQuerySystemInformation,	1_2_055900BB
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_059F0032 NtQuerySystemInformation,	8_2_059F0032
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_059F0006 NtQuerySystemInformation,	8_2_059F0006

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe

File created: C:\Windows\SysWOW64\Explower.exe

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Code function: 1_2_00F64298	1_2_00F64298
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Code function: 1_2_00F64287	1_2_00F64287
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_05034298	8_2_05034298
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_05035000	8_2_05035000
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_0503470F	8_2_0503470F
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_05034F2F	8_2_05034F2F
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_05034630	8_2_05034630
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_05034936	8_2_05034936
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_05034544	8_2_05034544
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_05034B5B	8_2_05034B5B
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_05035459	8_2_05035459
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_0503505D	8_2_0503505D
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_0503536F	8_2_0503536F
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_0503428F	8_2_0503428F
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_05034C8F	8_2_05034C8F
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_0503499D	8_2_0503499D
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_05034F9D	8_2_05034F9D
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_050347D4	8_2_050347D4
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_050350E3	8_2_050350E3
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_050344F1	8_2_050344F1
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_050349F9	8_2_050349F9

Source: N1aqZIb7KG.exe, 00000001.00000002.2132625736.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamemscorwks.dllT vs N1aqZIb7KG.exe

Source: N1aqZIb7KG.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: N1aqZIb7KG.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: N1aqZIb7KG.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: N1aqZIb7KG.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: N1aqZIb7KG.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 1.0.N1aqZIb7KG.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 1.0.N1aqZIb7KG.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.0.N1aqZIb7KG.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 1.0.N1aqZIb7KG.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000001.00000000.2101338617.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000001.00000000.2101338617.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Program Files (x86)\Explower.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi

Source: classification engine

Classification label: mal100.spre.troj.adwa.evad.winEXE@23/37@6/3

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Code function: 1_2_00B0BE76 AdjustTokenPrivileges,	1_2_00B0BE76
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Code function: 1_2_00B0BE3F AdjustTokenPrivileges,	1_2_00B0BE3F
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_0272BD4E AdjustTokenPrivileges,	8_2_0272BD4E
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Code function: 8_2_0272BD17 AdjustTokenPrivileges,	8_2_0272BD17

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe

File created: C:\Program Files (x86)\Explower.exe

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe

File created: C:\Users\user\AppData\Roaming\app

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2992:120:WilError_03
Source: C:\Windows\System32\SIHClient.exe	Mutant created: {376155FF-95A0-46CA-8F57-ACB09EA70153}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5676:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3164:120:WilError_03
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\eafe3130af183c86c36221806d0c196a
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2664:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2528:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2120:120:WilError_03

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe

File created: C:\Users\user\AppData\Local\Temp\FransescoPast.txt

Source: N1aqZIb7KG.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: N1aqZIb7KG.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\276d7f4a20a3c21c3bf6fc9bfc1915a2\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\276d7f4a20a3c21c3bf6fc9bfc1915a2\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\276d7f4a20a3c21c3bf6fc9bfc1915a2\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\System32\SIHClient.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: N1aqZIb7KG.exe

ReversingLabs: Detection: 83%

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe

File read: C:\Users\user\Desktop\N1aqZIb7KG.exe

Source: unknown	Process created: C:\Users\user\Desktop\N1aqZIb7KG.exe C:\Users\user\Desktop\N1aqZIb7KG.exe
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\N1aqZIb7KG.exe" "N1aqZIb7KG.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall delete allowedprogram "C:\Users\user\Desktop\N1aqZIb7KG.exe"
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\N1aqZIb7KG.exe" "N1aqZIb7KG.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe "C:\Users\user\AppData\Roaming\Microsoft\svchost.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\Microsoft\svchost.exe" "svchost.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall delete allowedprogram "C:\Users\user\AppData\Roaming\Microsoft\svchost.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\Microsoft\svchost.exe" "svchost.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe"
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process created: C:\Windows\System32\SIHClient.exe C:\Windows\System32\sihclient.exe /cv 9rGOcCJ3NE2Fxvl5hzRMzQ.0.2
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\N1aqZIb7KG.exe" "N1aqZIb7KG.exe" ENABLE	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall delete allowedprogram "C:\Users\user\Desktop\N1aqZIb7KG.exe"	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\N1aqZIb7KG.exe" "N1aqZIb7KG.exe" ENABLE	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe "C:\Users\user\AppData\Roaming\Microsoft\svchost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\Microsoft\svchost.exe" "svchost.exe" ENABLE	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall delete allowedprogram "C:\Users\user\AppData\Roaming\Microsoft\svchost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\Microsoft\svchost.exe" "svchost.exe" ENABLE	Jump to behavior

Source: C:\Windows\System32\SIHClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07369A67-07A6-4608-ABEA-379491CB7C46}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Source: N1aqZIb7KG.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

.NET source code contains potential unpacker

Source: N1aqZIb7KG.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Source: N1aqZIb7KG.exe, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe.1.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe0.1.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe1.1.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe2.1.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe3.1.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe4.1.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe5.1.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe6.1.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe7.1.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Explower.exe8.1.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe

File created: C:\Users\user\Documents\Explower.exe

Drops PE files with benign system names

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	File created: C:\Users\user\Documents\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	File created: C:\Windows\SysWOW64\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	File created: C:\Users\user\Favorites\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	File created: C:\Users\user\AppData\Local\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	File created: C:\Program Files (x86)\Explower.exe	Jump to dropped file
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	File created: C:\Users\user\Desktop\Explower.exe	Jump to dropped file

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe

File created: C:\Program Files (x86)\Explower.exe

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe

File created: C:\Windows\SysWOW64\Explower.exe

Drops PE files to the startup folder

Boot Survival

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe

Deletes itself after installation

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe\:Zone.Identifier:$DATA	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe

File deleted: c:\users\user\desktop\n1aqzib7kg.exe

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Window / User API: threadDelayed 352	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Window / User API: threadDelayed 3815	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Window / User API: threadDelayed 4397	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Window / User API: foregroundWindowGot 603	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Window / User API: foregroundWindowGot 638	Jump to behavior

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe TID: 4568	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe TID: 3796	Thread sleep time: -35200s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe TID: 5056	Thread sleep time: -3815000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe TID: 5056	Thread sleep time: -4397000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe TID: 2612	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\SIHClient.exe TID: 5948	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\netsh.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\SysWOW64\netsh.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\SIHClient.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\SIHClient.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\SysWOW64\netsh.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\netsh.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\SIHClient.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\SIHClient.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Source: SIHClient.exe, 00000010.00000003.2295775556.0000026001E44000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000010.00000003.2295536340.0000026001E44000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000010.00000002.2687549306.0000026001E44000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000010.00000003.2685760234.0000026001E44000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000010.00000003.2293742121.0000026001E44000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000010.00000003.2294117374.0000026001E44000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000010.00000003.2296194778.0000026001E44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWa^
Source: N1aqZIb7KG.exe, 00000001.00000002.2132625736.0000000000BC9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\yLs7
Source: svchost.exe, 00000008.00000002.4566774931.0000000000894000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000010.00000003.2295775556.0000026001E44000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000010.00000003.2295536340.0000026001E44000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000010.00000002.2687549306.0000026001E44000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000010.00000003.2685760234.0000026001E44000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000010.00000003.2293742121.0000026001E44000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000010.00000003.2294117374.0000026001E44000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000010.00000003.2296194778.0000026001E44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: N1aqZIb7KG.exe, 00000001.00000002.2132625736.0000000000BC9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y%s
Source: netsh.exe, 00000002.00000002.2122124257.0000000003470000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000003.2133339661.0000000002DB1000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000005.00000003.2136693196.0000000003201000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4566746334.000000000087E000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000009.00000003.2151171294.0000000002B01000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000000B.00000003.2162104364.0000000003081000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 0000000C.00000003.2165459121.0000000002F21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: SIHClient.exe, 00000010.00000002.2687549306.0000026001DF5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWnt

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe

Memory allocated: page read and write | page guard

System process connects to network (likely due to code injection or exploit)

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Network Connect: 18.197.239.109 13150			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	Network Connect: 3.68.171.119 13150			Jump to behavior

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe

Process created: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe "C:\Users\user\AppData\Roaming\Microsoft\svchost.exe"

Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:25:00 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:26:08 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:14 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:29:12 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:40:43 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:22:18 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:28:49 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:38:35 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 17:20:40 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:28:40 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:18:10 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 21:27:51 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:29:48 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:19:19 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:16:13 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:33:54 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:42 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:28:41 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:00:10 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:17:10 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:28:47 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 19:00:16 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:14:41 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 21:50:20 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:13 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:18:54 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:43 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:29:49 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:35:09 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:24:00 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:22:33 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 01:49:44 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:17:41 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:22:04 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:44 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:49:22 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:03:44 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:13:58 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:18:46 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:28:48 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:16:49 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:17 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:24:04 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:19:58 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:30:50 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 23:21:06 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 22:40:17 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:20:21 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:29:17 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:17:45 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:21:38 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:59:40 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:07:55 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:00:43 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:24:07 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:28:10 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:14:17 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:58:19 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:18:44 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:20:31 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 13:33:59 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:21:30 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:19:44 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:45 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:23:19 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:27:48 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:28:44 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:17:19 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:12 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:04:23 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:28:42 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:30:55 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:15:15 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:20:38 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:10 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:29:00 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:39:39 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:17:47 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:40 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 01:15:31 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:19:14 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:12:18 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:11:11 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 00:25:55 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:17:17 - Program Manager
Source: N1aqZIb7KG.exe, 00000001.00000002.2133847996.0000000002C93000.00000004.00000800.00020000.00000000.sdmp, N1aqZIb7KG.exe, 00000001.00000002.2133847996.0000000002C61000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: -GledProgram Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:15:10 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:47 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 12:05:37 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 12:11:25 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:15:29 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:44:29 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:19:11 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:20:03 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:28:45 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:42:59 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:51:06 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 22:17:47 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:22:07 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:17:17 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:53:19 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:16:03 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 23:21:03 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 17:43:39 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:11:27 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:51:19 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:19:41 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:57:00 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 17:32:30 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 17:38:59 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:19:43 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:32:35 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:29:46 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program managerL.Glp~
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:27:45 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:56:44 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 13:42:16 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:55:43 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:29:02 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:18:40 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:17:44 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 23:07:53 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:28:45 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:31:50 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:22:20 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:19:54 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:16:44 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:24:46 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:20:53 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:28:41 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:29:03 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:16:02 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:58:49 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:18:28 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:49 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:28:01 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:32:22 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:19 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:22:08 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 15:38:01 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:16:43 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:21:35 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:16:33 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:19:42 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:11:02 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 23:45:23 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:20:24 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:18:59 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 21:25:50 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:27:16 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:24:17 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:21:48 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:16:06 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:16:19 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:22:04 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 12:38:12 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program managerL.Glp
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:41:26 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:52:57 - Program Manager
Source: N1aqZIb7KG.exe, 00000001.00000002.2133847996.0000000002CAC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program managerL.Gl\
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:38:20 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:27:42 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 17:27:21 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:50:46 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:16:11 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:28:34 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:18:43 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:12:30 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:23:31 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:39:35 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:17:41 - Program Manager
Source: N1aqZIb7KG.exe, Explower.exe4.1.dr, Explower.exe2.1.dr, Explower.exe1.1.dr, Explower.exe6.1.dr, Explower.exe.1.dr, Explower.exe3.1.dr, Explower.exe7.1.dr, Explower.exe8.1.dr, Explower.exe5.1.dr, svchost.exe.1.dr, Explower.exe0.1.dr	Binary or memory string: Shell_TrayWnd
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:18:25 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:16 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:29:16 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:28:58 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:28:44 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:17:13 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:26:47 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 00:54:28 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:39:53 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:47:45 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:28:04 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:46 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:25:35 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:18:03 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:20:07 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 23:21:00 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:28:28 - Program Manager
Source: svchost.exe, 00000008.00000002.4570696686.00000000051DB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: .mdProgram Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 23:21:07 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:21:09 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:21:22 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program managerL.Gl<
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:22:24 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:17:01 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:20:37 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:16:46 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:19:05 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:22:34 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 16:06:56 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:18:33 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 22:53:16 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:18:13 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:12:45 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:19:45 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 23:35:57 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:28:26 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:22:33 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:28:00 - Program Manager
Source: N1aqZIb7KG.exe, 00000001.00000002.2133847996.0000000002C93000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager\OGl
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 13:52:49 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:21:28 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:21:17 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:18:23 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:16:26 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:18:07 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:18:34 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:46:22 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:28:01 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:18:35 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:16:00 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:16:37 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:26:13 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:28:10 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:16:11 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:21:27 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:55:06 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:13:21 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 12:08:18 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:28:37 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 00:12:12 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 14:33:14 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:16:12 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:29:59 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 20:13:16 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:56:22 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:29:01 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:21:26 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:25:09 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:18:36 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:12:47 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:32:03 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:25:43 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:19:24 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:24:03 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:19:58 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:31:01 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:15:57 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:25:54 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:19:36 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:09:02 - Program Manager
Source: N1aqZIb7KG.exe, 00000001.00000002.2133847996.0000000002CAC000.00000004.00000800.00020000.00000000.sdmp, N1aqZIb7KG.exe, 00000001.00000002.2133847996.0000000002C93000.00000004.00000800.00020000.00000000.sdmp, N1aqZIb7KG.exe, 00000001.00000002.2137006723.0000000004F7B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 18:10:32 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:19:18 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:17:32 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:17:05 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:57:25 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:59:00 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 16:46:51 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:25 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:17:59 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:29:12 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 13:09:08 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 13:56:43 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:21:43 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:50:37 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:19:26 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:32 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:17:40 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:21:23 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:52 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:25:11 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:19:08 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:29:32 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:49:37 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:19:04 - Program Manager
Source: N1aqZIb7KG.exe, 00000001.00000002.2133847996.0000000002C93000.00000004.00000800.00020000.00000000.sdmp, N1aqZIb7KG.exe, 00000001.00000002.2133847996.0000000002C61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerH
Source: N1aqZIb7KG.exe, 00000001.00000002.2137006723.0000000004F7B000.00000004.00000010.00020000.00000000.sdmp, Explower.exe, 0000000F.00000002.2267862115.0000000004F6B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: dProgram Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:30 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:28:32 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:17:49 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:29:30 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:09:54 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:22:23 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:15:50 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:20:58 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:18:02 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:50 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:22:32 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:44:12 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:17:07 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:18:56 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 22:46:50 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:02:34 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:16:52 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:57 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:05:11 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:20:53 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:49:13 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 22:22:06 - Program Manager
Source: N1aqZIb7KG.exe, 00000001.00000002.2133847996.0000000002C93000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:26:55 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:24:14 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:18:01 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:26:32 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:21:08 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:10:54 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:48:01 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:28:43 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:28:20 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:18:41 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:16:57 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:28:19 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:16:33 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:28:56 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:21:48 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:18:30 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:28:06 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 13:48:08 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:20:52 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:28:03 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:30:44 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:18:55 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 15:32:08 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 23:20:57 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:33:17 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:18:17 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:18:04 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:23:09 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 23:39:33 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:18:28 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:20:12 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:28:07 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:41:46 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \| 23:20:57 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 16:03:42 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:21:07 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:28:47 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:32:22 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:16:58 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:21:47 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:27:39 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 00:32:57 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 20:18:53 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:46:28 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:21:49 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 17:10:57 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:35:29 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:28:42 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:22:26 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:32:00 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:37:23 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:03:21 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:15:44 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:29:04 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 14:43:28 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 13:03:49 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:25:03 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:19:30 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:19:43 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:13:00 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:17:55 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:29:24 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:24 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:19:23 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:20:19 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:57:56 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:27:14 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:29:11 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:21:20 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:25:41 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:11:30 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:21:00 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:45:26 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:25:57 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:38 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:27:07 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:20:39 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:50:09 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 00:35:43 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:25:37 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:19:57 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:17:53 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:29:18 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:17:06 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:17:33 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:25:55 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:25:28 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:43:18 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 00:16:00 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 23:08:47 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 20:39:00 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:20:16 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:31 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:29:31 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:29:51 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:51 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:55:51 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:32:50 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 20:27:44 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:16:51 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:15:52 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 01:42:51 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:28:50 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:23:28 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:10:08 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:21:15 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:27:24 - Program Manager
Source: svchost.exe, 00000008.00000002.4566707124.0000000000856000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Rh Program Manager,
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:11:20 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 16:51:32 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:36:12 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:48:48 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 18:26:18 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:18:22 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:29:39 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:37:11 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:17:50 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:30:17 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:24:56 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 18:57:27 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:20:15 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:19:09 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:29:23 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 19:31:00 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:39 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:16:52 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:26:54 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:28:51 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:19:21 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:20:43 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:28:21 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:21:45 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:16:53 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:19:22 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:18:08 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:26:24 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: -GledProgram ManagerP
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:15:51 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:27:26 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:27:50 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:28:52 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 20:07:12 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:14:34 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:30:00 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:18:39 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:18:24 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:22:17 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:53:36 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program managerL.Gl`=
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:28:53 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:21:46 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:24:21 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:21:18 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 13:38:07 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:15:55 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:20:13 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:51:29 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 18:26:44 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:31:19 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:26:41 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:18:52 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: -GledProgram Managerp
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:29:36 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:21:10 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:23:54 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:27:55 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:28:37 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:30:47 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:21:41 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:16:37 - Program Manager
Source: N1aqZIb7KG.exe, Explower.exe4.1.dr, Explower.exe2.1.dr, Explower.exe1.1.dr, Explower.exe6.1.dr, Explower.exe.1.dr, Explower.exe3.1.dr, Explower.exe7.1.dr, Explower.exe8.1.dr, Explower.exe5.1.dr, svchost.exe.1.dr, Explower.exe0.1.dr	Binary or memory string: Shell_traywnd+MostrarBarraDeTarefas
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:27:20 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:21:11 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:29:09 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:19:24 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 17:56:46 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:17:27 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 01:15:41 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:17:52 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:59:04 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:44:07 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:16:20 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 19:50:55 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:52:22 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:28:25 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:25:56 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:35:45 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:21:55 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:28:55 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:16:29 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 23:21:44 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 04:15:08 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:31:27 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 02:58:09 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:28:34 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:21:40 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program managerL.Gl
Source: svchost.exe, 00000008.00000002.4568319316.0000000003196000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000003156000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/07 \| 11:28:21 - Program Manager
Source: svchost.exe, 00000008.00000002.4568319316.0000000003090000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4568319316.000000000309C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/08 \| 03:25:21 - Program Manager

Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Contains functionality to disable the Task Manager (.Net Source)

Lowering of HIPS / PFW / Operating System Security Settings

Source: N1aqZIb7KG.exe, Fransesco.cs	.Net Code: INS
Source: Explower.exe.1.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe0.1.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe1.1.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe2.1.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe3.1.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe4.1.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe5.1.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe6.1.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe7.1.dr, Fransesco.cs	.Net Code: INS
Source: Explower.exe8.1.dr, Fransesco.cs	.Net Code: INS

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Modifies the windows firewall

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\N1aqZIb7KG.exe" "N1aqZIb7KG.exe" ENABLE

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\N1aqZIb7KG.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\N1aqZIb7KG.exe" "N1aqZIb7KG.exe" ENABLE

Stealing of Sensitive Information

Source: Yara match	File source: N1aqZIb7KG.exe, type: SAMPLE
Source: Yara match	File source: 1.0.N1aqZIb7KG.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.2101338617.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: N1aqZIb7KG.exe PID: 1880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Explower.exe PID: 1616, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED

Remote Access Functionality

Source: Yara match	File source: N1aqZIb7KG.exe, type: SAMPLE
Source: Yara match	File source: 1.0.N1aqZIb7KG.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.2101338617.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: N1aqZIb7KG.exe PID: 1880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Explower.exe PID: 1616, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Explower.exe, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
11 Replication Through Removable Media	2 Windows Management Instrumentation	12 Registry Run Keys / Startup Folder	1 Access Token Manipulation	132 Masquerading	OS Credential Dumping	111 Security Software Discovery	11 Replication Through Removable Media	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	112 Process Injection	41 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	Exfiltration Over Bluetooth	1 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	12 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	1 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	112 Process Injection	LSA Secrets	1 Peripheral Device Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	32 System Information Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
N1aqZIb7KG.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
N1aqZIb7KG.exe	100%	Avira	TR/Dropper.Gen
N1aqZIb7KG.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Avira	TR/Dropper.Gen
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Local\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Roaming\Microsoft\svchost.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\Desktop\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\Documents\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\Favorites\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Windows\SysWOW64\Explower.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi

Source	Detection	Scanner	Label	Link
http://crl.microsofto	0%	Avira URL Cloud	safe
http://crl.micros#	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
6.tcp.eu.ngrok.io	3.68.171.119	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.micros#	SIHClient.exe, 00000010.00000003.2295775556.0000026001E2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.microsofto	SIHClient.exe, 00000010.00000002.2688090120.0000026002699000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.28.247.255	unknown	United States	16509	AMAZON-02US	false
18.197.239.109	unknown	United States	16509	AMAZON-02US	true
3.68.171.119	6.tcp.eu.ngrok.io	United States	16509	AMAZON-02US	true

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1355317
Start date and time:	2023-12-07 11:26:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	N1aqZIb7KG.exe renamed because original name is a hash value
Original Sample Name:	5ffc76cfa5ade6017fff6b56c343f718.exe
Detection:	MAL
Classification:	mal100.spre.troj.adwa.evad.winEXE@23/37@6/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 230 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe
Excluded IPs from analysis (whitelisted): 40.127.169.103, 13.85.23.206, 20.166.126.56
Excluded domains from analysis (whitelisted): client.wns.windows.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: N1aqZIb7KG.exe

Simulations

Behavior and APIs

Time	Type	Description
11:26:55	API Interceptor	1x Sleep call for process: N1aqZIb7KG.exe modified
11:26:58	API Interceptor	90057x Sleep call for process: svchost.exe modified
11:26:59	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe
11:27:13	API Interceptor	2x Sleep call for process: SIHClient.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
52.28.247.255	QsKtlzYaKF.exe	Get hash	malicious	Njrat	Browse
	dKe1GfZOs1.exe	Get hash	malicious	Njrat	Browse
	X5eo58PPCB.exe	Get hash	malicious	Njrat	Browse
	ZuXcnAYgVp.exe	Get hash	malicious	Njrat	Browse
	wiUnP1h5Ex.exe	Get hash	malicious	Njrat	Browse
	BqFosj9Wcb.exe	Get hash	malicious	Njrat	Browse
	d09l64ZAW6.exe	Get hash	malicious	Njrat	Browse
	8AKGdJOQ8N.exe	Get hash	malicious	Njrat	Browse
	uPMGLG7QnV.exe	Get hash	malicious	Njrat	Browse
	X3vWrCoPG6.exe	Get hash	malicious	Njrat	Browse
	8fZNpRy9pN.exe	Get hash	malicious	Njrat	Browse
	2CVeP16GYU.exe	Get hash	malicious	Njrat	Browse
	QuX5A6qz9G.exe	Get hash	malicious	Njrat	Browse
	TdxWv8SpDq.exe	Get hash	malicious	Njrat	Browse
	OperaSetup.exe	Get hash	malicious	Quasar	Browse
	HR0Hh3FsOH.exe	Get hash	malicious	njRat	Browse
	r0EX1ZWE8C.exe	Get hash	malicious	Njrat	Browse
	Android_USB_Jailbreaker.exe	Get hash	malicious	Njrat	Browse
	NNUqIKtjza.exe	Get hash	malicious	Unknown	Browse
	CxVNNetrEI.exe	Get hash	malicious	Njrat	Browse
18.197.239.109	dKe1GfZOs1.exe	Get hash	malicious	Njrat	Browse
	bRxR.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
	ZuXcnAYgVp.exe	Get hash	malicious	Njrat	Browse
	d09l64ZAW6.exe	Get hash	malicious	Njrat	Browse
	8AKGdJOQ8N.exe	Get hash	malicious	Njrat	Browse
	uPMGLG7QnV.exe	Get hash	malicious	Njrat	Browse
	X3vWrCoPG6.exe	Get hash	malicious	Njrat	Browse
	KD9rMPUEBM.exe	Get hash	malicious	Njrat	Browse
	8fZNpRy9pN.exe	Get hash	malicious	Njrat	Browse
	2CVeP16GYU.exe	Get hash	malicious	Njrat	Browse
	64EithtAyN.exe	Get hash	malicious	Njrat	Browse
	QuX5A6qz9G.exe	Get hash	malicious	Njrat	Browse
	TdxWv8SpDq.exe	Get hash	malicious	Njrat	Browse
	OperaSetup.exe	Get hash	malicious	Quasar	Browse
	OperaSetup.exe	Get hash	malicious	Quasar	Browse
	887F546123CD59024356557175BD77FE1144BA5C56D93.exe	Get hash	malicious	Njrat	Browse
	r0EX1ZWE8C.exe	Get hash	malicious	Njrat	Browse
	Android_USB_Jailbreaker.exe	Get hash	malicious	Njrat	Browse
	CxVNNetrEI.exe	Get hash	malicious	Njrat	Browse
	bLtN.exe	Get hash	malicious	Njrat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
6.tcp.eu.ngrok.io	m5l9v13hIi.exe	Get hash	malicious	Njrat	Browse	3.66.38.117
	QsKtlzYaKF.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	xZLQ8X9Cxo.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	sCXwkZrcZ3.exe	Get hash	malicious	Njrat	Browse	3.68.171.119
	dKe1GfZOs1.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	bRxR.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	18.197.239.109
	X5eo58PPCB.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	ZuXcnAYgVp.exe	Get hash	malicious	Njrat	Browse	52.28.247.255
	wiUnP1h5Ex.exe	Get hash	malicious	Njrat	Browse	3.69.115.178
	BqFosj9Wcb.exe	Get hash	malicious	Njrat	Browse	52.28.247.255
	d09l64ZAW6.exe	Get hash	malicious	Njrat	Browse	52.28.247.255
	8AKGdJOQ8N.exe	Get hash	malicious	Njrat	Browse	3.68.171.119
	uPMGLG7QnV.exe	Get hash	malicious	Njrat	Browse	3.66.38.117
	X3vWrCoPG6.exe	Get hash	malicious	Njrat	Browse	3.68.171.119
	7U23YeVgmF.exe	Get hash	malicious	Njrat	Browse	3.69.115.178
	KD9rMPUEBM.exe	Get hash	malicious	Njrat	Browse	3.68.171.119
	8fZNpRy9pN.exe	Get hash	malicious	Njrat	Browse	52.28.247.255
	2CVeP16GYU.exe	Get hash	malicious	Njrat	Browse	3.66.38.117
	64EithtAyN.exe	Get hash	malicious	Njrat	Browse	3.68.171.119
	QuX5A6qz9G.exe	Get hash	malicious	Njrat	Browse	3.69.115.178

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	Ddpic6s7I6.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	https://customer76920g.musvc5.net/e/tr?q=0%3dCb7fCd%26m%3dX%26z%3dX%26p%3dXE%26P%3diQ6Kt_OcxQ_ZM_MRzb_WG_OcxQ_YRNf07MfA18vPuBo-OqQjB9.Kx_OcxQ_YR%269%3dnR5Qdb.z0u%26F5%3dY%26uP%3dDe3ZCWAcCV8m6bAbCd%26i%3d8EV5fI98cFb6bI0e8GA4aodbYmd6fDZ69C8cgqceAr0baIXABG69cIbfApcbeKa9&mupckp=mupAtu4m8OiX0wt	Get hash	malicious	Unknown	Browse	54.73.69.125
	TmZjZ9jzBA.elf	Get hash	malicious	Mirai	Browse	34.254.182.186
	mips.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	Reserva.xls	Get hash	malicious	RevengeRAT	Browse	108.156.172.89
	psjlubgMG8.exe	Get hash	malicious	Njrat	Browse	3.124.142.205
	https://supportelders.co/custom/themes/dsv/amexexpress.html	Get hash	malicious	HTMLPhisher	Browse	3.6.161.171
	https://2hb97.talxs.ru/491t	Get hash	malicious	HTMLPhisher	Browse	99.84.108.83
	gQyLMWRRx7.exe	Get hash	malicious	Njrat	Browse	18.158.249.75
	https://https.file-transfers.ancillarycheese.com/XYmpJek5GVXJOalpuVmpsMlpWZDFjWEZ5TkhZM1RYbDJOakpLY0VWNFZFZzNWM2h2ZW1kR01rZzFTV2xEVDBod1VqY3pOMWhSYUc1RVRFVktja0pEYVVVdlkxQnpNMWh3SzBOMk16aGFWWGhVYVVOMVIwNVFVemRLTlZoTE5WcHFjVXREZVVoQmR6Vm1Ta1J6Y1VsVWVteHlVbGROY2sxMkx6Qk5VRFp3TVc1WU5UaDBTemRXU0V4NGRGbzJWSEpMYjFOMlJraHpiamxxVEM4MlFYazFMM3BZYlhoSE5FWlBSVGxXUmtSSmQxSTRUM2hRTWpOaFRGVlpaRU16TkhCNE9XMXpObTlLU3pBMk5YbDFVVU5vVmpSTmNEWklRVDA5TFMxRWNYVTBZVU5YTDNkdFJtODJRVWxYVjFaT1dIRkJQVDA9LS0yODEzMzI4OTM5YmViMDMzNWFiZmQ1NzVjZmIzYzFiYTdiMmU5MDc5?cid=1824703302	Get hash	malicious	Unknown	Browse	52.217.118.128
	https://lovegemini.co.uk/fc.PDF	Get hash	malicious	HTMLPhisher	Browse	99.86.229.40
	https://runrun.it/share/form/jYulPVdeVffo1EA1	Get hash	malicious	HTMLPhisher	Browse	52.217.48.84
	https://lovegemini.co.uk/fc.PDF	Get hash	malicious	HTMLPhisher	Browse	99.86.229.16
	https://trk.klclick3.com/ls/click?upn=K0nieRRdrSJ-2FFWBTiZhIo3iXKh82ylx9MKlaEFUtlBZaZGkxnTtxLeUBYKLTdzUenM3G9yGXAvj79BuHueoC2DPHnFOwypRcfZOLWqmm0COzw4Wh0exi7NNgBTUSeVap83mphKwBekc4w1r8jRHCkw-3D-3Dv11M_4ZUHUMOrZND9wpJ4r4-2BdnkU1uDKv0Hu0aEK8kv7JA9pmX6mKfxuxw1yLduYNGVp0p7kEeH0T6NsaItmo-2FbQseFCtaMUqLwhSzamWV1A-2Bi9u9YENhza2bFH025xEhFRCzIXB5aSMJh2nt3xk61Mb3tKs4tbWSW0sff1cLfav4Myi0B4R7feMztjEhMY7DdbO0HxWtq5wf7lG8XNlAB-2FgSIa0RcIdNPw-2BstYtrtFNNOUhChEAjj4-2F5tyV-2FQ5hwxyzbITQJG1Yz7wCLAsJRMx8YrJF-2FWJKgZaofhwfR871yMBjo1U-2Bud23GWaAXATA2g-2BDk	Get hash	malicious	Fake Captcha	Browse	52.85.61.125
	https://customer76949g.musvc5.net/e/tr?q=4%3dOYCZRZ%26s%3dR%26B%3dT%26v%3dRQ%26M%3doKHHz_IouW_TY_JXtn_TM_IouW_Sd7zNyLlIGLvE3EvIH9h83.H4%265%3dAMzM1W.u6H%26Az%3dS%26HK%3d9aPU8SXX8YQb8T%266%3dUl2y3hRVbDW15CZU3DRUU864TEXQ5l5y6kZRXiVT30YXaiTP5jV4Uj6y7hVy8l4X3kYW&mupckp=mupAtu4m8OiX0wt	Get hash	malicious	HTMLPhisher	Browse	52.214.164.36
	https://app.vision6.com/em/message/email/view.php?id=10286&a=108385&k=lErs5We1GjgOrSGNrcjlMhohJ-iBOFWoNE1byhl7R0Y	Get hash	malicious	HTMLPhisher	Browse	35.155.47.205
	https://customer76920g.musvc5.net/e/tr?q=0%3dCb7fCd%26m%3dX%26z%3dX%26p%3dXE%26P%3diQ6Kt_OcxQ_ZM_MRzb_WG_OcxQ_YRNf07MfA18vPuBo-OqQjB9.Kx_OcxQ_YR%269%3dnR5Qdb.z0u%26F5%3dY%26uP%3dDe3ZCWAcCV8m6bAbCd%26i%3d8EV5fI98cFb6bI0e8GA4aodbYmd6fDZ69C8cgqceAr0baIXABG69cIbfApcbeKa9&mupckp=mupAtu4m8OiX0wt	Get hash	malicious	Unknown	Browse	54.73.69.125
	https://www.agfax.com/2023/12/05/usda-releases-map-showing-areas-approved-for-its-broadband-connection-program/	Get hash	malicious	Unknown	Browse	52.85.132.2
	https://indd.adobe.com/view/c3179703-3c89-45fc-937b-8dade90a5431	Get hash	malicious	Unknown	Browse	99.86.229.114
	https://indd.adobe.com/view/c3179703-3c89-45fc-937b-8dade90a5431	Get hash	malicious	Unknown	Browse	99.86.229.114
AMAZON-02US	Ddpic6s7I6.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	https://customer76920g.musvc5.net/e/tr?q=0%3dCb7fCd%26m%3dX%26z%3dX%26p%3dXE%26P%3diQ6Kt_OcxQ_ZM_MRzb_WG_OcxQ_YRNf07MfA18vPuBo-OqQjB9.Kx_OcxQ_YR%269%3dnR5Qdb.z0u%26F5%3dY%26uP%3dDe3ZCWAcCV8m6bAbCd%26i%3d8EV5fI98cFb6bI0e8GA4aodbYmd6fDZ69C8cgqceAr0baIXABG69cIbfApcbeKa9&mupckp=mupAtu4m8OiX0wt	Get hash	malicious	Unknown	Browse	54.73.69.125
	TmZjZ9jzBA.elf	Get hash	malicious	Mirai	Browse	34.254.182.186
	mips.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	Reserva.xls	Get hash	malicious	RevengeRAT	Browse	108.156.172.89
	psjlubgMG8.exe	Get hash	malicious	Njrat	Browse	3.124.142.205
	https://supportelders.co/custom/themes/dsv/amexexpress.html	Get hash	malicious	HTMLPhisher	Browse	3.6.161.171
	https://2hb97.talxs.ru/491t	Get hash	malicious	HTMLPhisher	Browse	99.84.108.83
	gQyLMWRRx7.exe	Get hash	malicious	Njrat	Browse	18.158.249.75
	https://https.file-transfers.ancillarycheese.com/XYmpJek5GVXJOalpuVmpsMlpWZDFjWEZ5TkhZM1RYbDJOakpLY0VWNFZFZzNWM2h2ZW1kR01rZzFTV2xEVDBod1VqY3pOMWhSYUc1RVRFVktja0pEYVVVdlkxQnpNMWh3SzBOMk16aGFWWGhVYVVOMVIwNVFVemRLTlZoTE5WcHFjVXREZVVoQmR6Vm1Ta1J6Y1VsVWVteHlVbGROY2sxMkx6Qk5VRFp3TVc1WU5UaDBTemRXU0V4NGRGbzJWSEpMYjFOMlJraHpiamxxVEM4MlFYazFMM3BZYlhoSE5FWlBSVGxXUmtSSmQxSTRUM2hRTWpOaFRGVlpaRU16TkhCNE9XMXpObTlLU3pBMk5YbDFVVU5vVmpSTmNEWklRVDA5TFMxRWNYVTBZVU5YTDNkdFJtODJRVWxYVjFaT1dIRkJQVDA9LS0yODEzMzI4OTM5YmViMDMzNWFiZmQ1NzVjZmIzYzFiYTdiMmU5MDc5?cid=1824703302	Get hash	malicious	Unknown	Browse	52.217.118.128
	https://lovegemini.co.uk/fc.PDF	Get hash	malicious	HTMLPhisher	Browse	99.86.229.40
	https://runrun.it/share/form/jYulPVdeVffo1EA1	Get hash	malicious	HTMLPhisher	Browse	52.217.48.84
	https://lovegemini.co.uk/fc.PDF	Get hash	malicious	HTMLPhisher	Browse	99.86.229.16
	https://trk.klclick3.com/ls/click?upn=K0nieRRdrSJ-2FFWBTiZhIo3iXKh82ylx9MKlaEFUtlBZaZGkxnTtxLeUBYKLTdzUenM3G9yGXAvj79BuHueoC2DPHnFOwypRcfZOLWqmm0COzw4Wh0exi7NNgBTUSeVap83mphKwBekc4w1r8jRHCkw-3D-3Dv11M_4ZUHUMOrZND9wpJ4r4-2BdnkU1uDKv0Hu0aEK8kv7JA9pmX6mKfxuxw1yLduYNGVp0p7kEeH0T6NsaItmo-2FbQseFCtaMUqLwhSzamWV1A-2Bi9u9YENhza2bFH025xEhFRCzIXB5aSMJh2nt3xk61Mb3tKs4tbWSW0sff1cLfav4Myi0B4R7feMztjEhMY7DdbO0HxWtq5wf7lG8XNlAB-2FgSIa0RcIdNPw-2BstYtrtFNNOUhChEAjj4-2F5tyV-2FQ5hwxyzbITQJG1Yz7wCLAsJRMx8YrJF-2FWJKgZaofhwfR871yMBjo1U-2Bud23GWaAXATA2g-2BDk	Get hash	malicious	Fake Captcha	Browse	52.85.61.125
	https://customer76949g.musvc5.net/e/tr?q=4%3dOYCZRZ%26s%3dR%26B%3dT%26v%3dRQ%26M%3doKHHz_IouW_TY_JXtn_TM_IouW_Sd7zNyLlIGLvE3EvIH9h83.H4%265%3dAMzM1W.u6H%26Az%3dS%26HK%3d9aPU8SXX8YQb8T%266%3dUl2y3hRVbDW15CZU3DRUU864TEXQ5l5y6kZRXiVT30YXaiTP5jV4Uj6y7hVy8l4X3kYW&mupckp=mupAtu4m8OiX0wt	Get hash	malicious	HTMLPhisher	Browse	52.214.164.36
	https://app.vision6.com/em/message/email/view.php?id=10286&a=108385&k=lErs5We1GjgOrSGNrcjlMhohJ-iBOFWoNE1byhl7R0Y	Get hash	malicious	HTMLPhisher	Browse	35.155.47.205
	https://customer76920g.musvc5.net/e/tr?q=0%3dCb7fCd%26m%3dX%26z%3dX%26p%3dXE%26P%3diQ6Kt_OcxQ_ZM_MRzb_WG_OcxQ_YRNf07MfA18vPuBo-OqQjB9.Kx_OcxQ_YR%269%3dnR5Qdb.z0u%26F5%3dY%26uP%3dDe3ZCWAcCV8m6bAbCd%26i%3d8EV5fI98cFb6bI0e8GA4aodbYmd6fDZ69C8cgqceAr0baIXABG69cIbfApcbeKa9&mupckp=mupAtu4m8OiX0wt	Get hash	malicious	Unknown	Browse	54.73.69.125
	https://www.agfax.com/2023/12/05/usda-releases-map-showing-areas-approved-for-its-broadband-connection-program/	Get hash	malicious	Unknown	Browse	52.85.132.2
	https://indd.adobe.com/view/c3179703-3c89-45fc-937b-8dade90a5431	Get hash	malicious	Unknown	Browse	99.86.229.114
	https://indd.adobe.com/view/c3179703-3c89-45fc-937b-8dade90a5431	Get hash	malicious	Unknown	Browse	99.86.229.114

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.558759879113321
Encrypted:	false
SSDEEP:	768:DY3r+tD9O/pBcxYsbae6GIXb9pDX2b9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3jsGP:m+nOx6baIa9RIj00ljEwzGi1dDPDTgS
MD5:	5FFC76CFA5ADE6017FFF6B56C343F718
SHA1:	AC5B3889AF5E488C26102B1B886C00AE0B15AEBC
SHA-256:	26B9F4E5AEAE4AA95E44A9A9D51D028B30BD6C9F329BBE8B52511C65BA294FB3
SHA-512:	9BE0F6DFF2F25493E54A7B26AD405E5AEF0EA3D4EEE8674A02E4C2407CA4F8126DEBD6BE26F3AE193E2B1FC459E667242D2380DD9F9522DDF2D01A378DB4FBA0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Program Files (x86)\Explower.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Program Files (x86)\Explower.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Program Files (x86)\Explower.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Program Files (x86)\Explower.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Program Files (x86)\Explower.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....je.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Program Files (x86)\Explower.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Explower.exe

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.558759879113321
Encrypted:	false
SSDEEP:	768:DY3r+tD9O/pBcxYsbae6GIXb9pDX2b9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3jsGP:m+nOx6baIa9RIj00ljEwzGi1dDPDTgS
MD5:	5FFC76CFA5ADE6017FFF6B56C343F718
SHA1:	AC5B3889AF5E488C26102B1B886C00AE0B15AEBC
SHA-256:	26B9F4E5AEAE4AA95E44A9A9D51D028B30BD6C9F329BBE8B52511C65BA294FB3
SHA-512:	9BE0F6DFF2F25493E54A7B26AD405E5AEF0EA3D4EEE8674A02E4C2407CA4F8126DEBD6BE26F3AE193E2B1FC459E667242D2380DD9F9522DDF2D01A378DB4FBA0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....je.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Explower.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Explower.exe.log

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\N1aqZIb7KG.exe.log

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.558759879113321
Encrypted:	false
SSDEEP:	768:DY3r+tD9O/pBcxYsbae6GIXb9pDX2b9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3jsGP:m+nOx6baIa9RIj00ljEwzGi1dDPDTgS
MD5:	5FFC76CFA5ADE6017FFF6B56C343F718
SHA1:	AC5B3889AF5E488C26102B1B886C00AE0B15AEBC
SHA-256:	26B9F4E5AEAE4AA95E44A9A9D51D028B30BD6C9F329BBE8B52511C65BA294FB3
SHA-512:	9BE0F6DFF2F25493E54A7B26AD405E5AEF0EA3D4EEE8674A02E4C2407CA4F8126DEBD6BE26F3AE193E2B1FC459E667242D2380DD9F9522DDF2D01A378DB4FBA0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....je.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Microsoft\Windows\History\Explower.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.558759879113321
Encrypted:	false
SSDEEP:	768:DY3r+tD9O/pBcxYsbae6GIXb9pDX2b9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3jsGP:m+nOx6baIa9RIj00ljEwzGi1dDPDTgS
MD5:	5FFC76CFA5ADE6017FFF6B56C343F718
SHA1:	AC5B3889AF5E488C26102B1B886C00AE0B15AEBC
SHA-256:	26B9F4E5AEAE4AA95E44A9A9D51D028B30BD6C9F329BBE8B52511C65BA294FB3
SHA-512:	9BE0F6DFF2F25493E54A7B26AD405E5AEF0EA3D4EEE8674A02E4C2407CA4F8126DEBD6BE26F3AE193E2B1FC459E667242D2380DD9F9522DDF2D01A378DB4FBA0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....je.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Explower.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.558759879113321
Encrypted:	false
SSDEEP:	768:DY3r+tD9O/pBcxYsbae6GIXb9pDX2b9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3jsGP:m+nOx6baIa9RIj00ljEwzGi1dDPDTgS
MD5:	5FFC76CFA5ADE6017FFF6B56C343F718
SHA1:	AC5B3889AF5E488C26102B1B886C00AE0B15AEBC
SHA-256:	26B9F4E5AEAE4AA95E44A9A9D51D028B30BD6C9F329BBE8B52511C65BA294FB3
SHA-512:	9BE0F6DFF2F25493E54A7B26AD405E5AEF0EA3D4EEE8674A02E4C2407CA4F8126DEBD6BE26F3AE193E2B1FC459E667242D2380DD9F9522DDF2D01A378DB4FBA0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....je.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Explower.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\melt.txt

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.411768795973194
Encrypted:	false
SSDEEP:	3:oNN2+WrUdYdA:oNN2RAKA
MD5:	40A507EA9016C2840699ABDD5CAF151C
SHA1:	7C2BA0566490934788C7C2F5E03F262BBD5D9CAB
SHA-256:	F5841A3371B99786E9590837703850F1141D15B8CC2EE741A02D486A8E13055E
SHA-512:	F786F67E0EFB483926E3F3D6AF4823DB577A58756486F659D4B0A0CF9D4630461A222932ED0F9309BBE629B072B04EE4B17E6F3211D2136B6E5CF9AD9103CA35
Malicious:	false
Preview:	C:\Users\user\Desktop\N1aqZIb7KG.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.558759879113321
Encrypted:	false
SSDEEP:	768:DY3r+tD9O/pBcxYsbae6GIXb9pDX2b9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3jsGP:m+nOx6baIa9RIj00ljEwzGi1dDPDTgS
MD5:	5FFC76CFA5ADE6017FFF6B56C343F718
SHA1:	AC5B3889AF5E488C26102B1B886C00AE0B15AEBC
SHA-256:	26B9F4E5AEAE4AA95E44A9A9D51D028B30BD6C9F329BBE8B52511C65BA294FB3
SHA-512:	9BE0F6DFF2F25493E54A7B26AD405E5AEF0EA3D4EEE8674A02E4C2407CA4F8126DEBD6BE26F3AE193E2B1FC459E667242D2380DD9F9522DDF2D01A378DB4FBA0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....je.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\svchost.exe

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.558759879113321
Encrypted:	false
SSDEEP:	768:DY3r+tD9O/pBcxYsbae6GIXb9pDX2b9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3jsGP:m+nOx6baIa9RIj00ljEwzGi1dDPDTgS
MD5:	5FFC76CFA5ADE6017FFF6B56C343F718
SHA1:	AC5B3889AF5E488C26102B1B886C00AE0B15AEBC
SHA-256:	26B9F4E5AEAE4AA95E44A9A9D51D028B30BD6C9F329BBE8B52511C65BA294FB3
SHA-512:	9BE0F6DFF2F25493E54A7B26AD405E5AEF0EA3D4EEE8674A02E4C2407CA4F8126DEBD6BE26F3AE193E2B1FC459E667242D2380DD9F9522DDF2D01A378DB4FBA0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....je.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\Microsoft\svchost.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\app

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:X:X
MD5:	FBA73CE50D8CFB469EC29A2333B22A85
SHA1:	4B7B6DFB36AF4A016301DC065870DD0829DB0A55
SHA-256:	56AE4E1144656432194C610E366FB556F7401A9993E75C0007F46397A5DDFA03
SHA-512:	B620D99E15C25E970A09738D14B493B2345EC1EB48737E2983565666A3C052D235712DB01A110C9948DC00D62A14FCCCF43CCC295F993D673334DC88497C77C7
Malicious:	false
Preview:	.7

C:\Users\user\Desktop\Explower.exe

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.558759879113321
Encrypted:	false
SSDEEP:	768:DY3r+tD9O/pBcxYsbae6GIXb9pDX2b9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3jsGP:m+nOx6baIa9RIj00ljEwzGi1dDPDTgS
MD5:	5FFC76CFA5ADE6017FFF6B56C343F718
SHA1:	AC5B3889AF5E488C26102B1B886C00AE0B15AEBC
SHA-256:	26B9F4E5AEAE4AA95E44A9A9D51D028B30BD6C9F329BBE8B52511C65BA294FB3
SHA-512:	9BE0F6DFF2F25493E54A7B26AD405E5AEF0EA3D4EEE8674A02E4C2407CA4F8126DEBD6BE26F3AE193E2B1FC459E667242D2380DD9F9522DDF2D01A378DB4FBA0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....je.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\Desktop\Explower.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Documents\Explower.exe

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.558759879113321
Encrypted:	false
SSDEEP:	768:DY3r+tD9O/pBcxYsbae6GIXb9pDX2b9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3jsGP:m+nOx6baIa9RIj00ljEwzGi1dDPDTgS
MD5:	5FFC76CFA5ADE6017FFF6B56C343F718
SHA1:	AC5B3889AF5E488C26102B1B886C00AE0B15AEBC
SHA-256:	26B9F4E5AEAE4AA95E44A9A9D51D028B30BD6C9F329BBE8B52511C65BA294FB3
SHA-512:	9BE0F6DFF2F25493E54A7B26AD405E5AEF0EA3D4EEE8674A02E4C2407CA4F8126DEBD6BE26F3AE193E2B1FC459E667242D2380DD9F9522DDF2D01A378DB4FBA0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....je.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\Documents\Explower.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Favorites\Explower.exe

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.558759879113321
Encrypted:	false
SSDEEP:	768:DY3r+tD9O/pBcxYsbae6GIXb9pDX2b9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3jsGP:m+nOx6baIa9RIj00ljEwzGi1dDPDTgS
MD5:	5FFC76CFA5ADE6017FFF6B56C343F718
SHA1:	AC5B3889AF5E488C26102B1B886C00AE0B15AEBC
SHA-256:	26B9F4E5AEAE4AA95E44A9A9D51D028B30BD6C9F329BBE8B52511C65BA294FB3
SHA-512:	9BE0F6DFF2F25493E54A7B26AD405E5AEF0EA3D4EEE8674A02E4C2407CA4F8126DEBD6BE26F3AE193E2B1FC459E667242D2380DD9F9522DDF2D01A378DB4FBA0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....je.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\Favorites\Explower.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Logs\SIH\SIH.20231207.112711.091.1.etl

Process:	C:\Windows\System32\SIHClient.exe
File Type:	data
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	3.172164411143602
Encrypted:	false
SSDEEP:	96:FpIIj65ZwH1+mwDsrRJxyYJ2Y9IcIkZ4+YcbIQSmlcyELJLIweJphx:Fpw5Zu1TaqJMiBazt+7bx1FELqxJphx
MD5:	09BEF03977B00035A3417F69EF409F32
SHA1:	0208620B89ACCE1375986B764AC04A3E25A9E684
SHA-256:	9743C3552A896DF4A882A80455C49EFCF8C4CBECD12E20F3DFF47E0138DDEB01
SHA-512:	8DD1E5E7EA4C640BB0B6F4AF725F83C2250ABC4AEE0A560E4F0FC9DE4B705AC26A7710168C64FDE359AB94CD7451466ED369464173EC8944BF498EDB747E15A2
Malicious:	false
Preview:	....P...P.......................................P...!...........................d...H...^i......................eJ..........(..Zb....... ..........................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1............................................................FpTW................(..........S.I.H._.t.r.a.c.e._.l.o.g...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.S.I.H.\.S.I.H...2.0.2.3.1.2.0.7...1.1.2.7.1.1...0.9.1...1...e.t.l.......P.P.d...H...^i......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\TMP435F.tmp

Process:	C:\Windows\System32\SIHClient.exe
File Type:	Microsoft Cabinet archive data, single, 462 bytes, 1 file, at 0x44 +Utf "environment.xml", flags 0x4, ID 31944, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	17126
Entropy (8bit):	7.3117215578334935
Encrypted:	false
SSDEEP:	192:D5X8WyNHDHFzqDHt8AxL5TKG+tJSdqnajapCNjFZYECUqY7oX9qhnJSdqnaja2Sl:qDlsHq4ThPdlmY9CUiqOdlm2W
MD5:	1B6460EE0273E97C251F7A67F49ACDB4
SHA1:	4A3FDFBB1865C3DAED996BDB5C634AA5164ABBB8
SHA-256:	3158032BAC1A6D278CCC2B7D91E2FBC9F01BEABF9C75D500A7F161E69F2C5F4A
SHA-512:	3D256D8AC917C6733BAB7CC4537A17D37810EFD690BCA0FA361CF44583476121C9BCCCD9C53994AE05E9F9DFF94FFAD1BB30C0F7AFF6DF68F73411703E3DF88A
Malicious:	false
Preview:	MSCF............D................\|...............A..........d.......................environment.xml.....b...CK..ao.0...J...&.q...-..;+.6+-i.......7.....=....g.P.RQ.#..#...QQ..p.kk..qX..)...T.....zL#<.4......\k..f..,.Q...`..K7.hP..".E.53.V.DW.X).z.=`.COO 8..8.......!$.P!`00....E.m..l .)".J.vC..J..&...5.5(.a..!..MIM.........z.;......t.<.o..\|CR.3>..n.;8dX....:....N.....U.......J.I(vT..3...N....$.._^.A<....&=._(N....m.u.1}.....Ax.b8....q~.i..0.A....H........A.0.@....1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". ...,..gK.........(...._`Oa..;%.010...`.H.e....... K...,.%@.b./.a...Q.:..E.7....V~....0...0..........3....!.G~&.9......0....H........0~1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1(0&..U....Microsoft Update Signing CA 2.20...190502214449Z..200502214449Z0o1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1.0...U....Microsoft Update0.."0...

C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\sls.cab

Process:	C:\Windows\System32\SIHClient.exe
File Type:	Microsoft Cabinet archive data, single, 7826 bytes, 1 file, at 0x44 +Utf "environment.cab", flags 0x4, ID 53283, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	24490
Entropy (8bit):	7.629144636744632
Encrypted:	false
SSDEEP:	384:iarwQcY8StpA7IQ6GCq30XPSIleI7lzCuqvfiSIleIx:iartHA7PCFP66Tqvfi6c
MD5:	ACD24F781C0C8F48A0BD86A0E9F2A154
SHA1:	93B2F4FBF96D15BE0766181AFACDB9FD9DD1B323
SHA-256:	5C0A296B3574D170D69C90B092611646FE8991B8D103D412499DBE7BFDCCCC49
SHA-512:	7B1D821CF1210947344FCF0F9C4927B42271669015DEA1C179B2BEAD9025941138C139C22C068CBD7219B853C80FA01A04E26790D8D76A38FB8BEBE20E0A2A4A
Malicious:	false
Preview:	MSCF............D...............#................A..........d........B..............environment.cab.x.\&..BCK.\.T...N.....;LB.JW.. .w!....$...U....."........ (.. E..........w...e.Jf.3gN.{...{V.M4.!.....hn. p(... .a...f..f..j.....Kh5..l.DB\}.=.0.>..X.....z..,'..LC/>....h.>.>.........,~mVI.....'EGD]^..\{....Q....f...4.F.....q..FF.1~...Q,.."g.qq.......}.....g%Zz.;m.9..z../2Jl.p8wGO......-V....FM......y.....Hy.xy......N.r;.@uV........Xa...b].`..F...y.Wd.e.8.[Z.s7].....=B.$...'.\|.-.sC....a_(..$..i.C.T.F}...]...m.R,y.1...'..j3.....ir..B..)sR.G...`-=.w....m..2y.....o...\{..C.4.:ZM..wL-$.I.x:?.!.....:..W.%&.....J.%.....~....E..T.d.Q{..p..J..pY...P../.."rp....`...#w.....'.\|n%Dy,.....i....."..x.....b._..\_.^.XOo..*:.&a.`..qA.?.@..t.R/...X3.nF.&........1Z.r.S...9x........?..aP..A...f..k:..\....L...t....Q...1..A..33A1.t..)...c....;......$.$..>._....A.!g`..t...b.H.L..&.....!......v~.n...uE.x...."5.h.4..B.R.d.4.%--.`.B..."..[....l......x(..5......@.zr....

C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\TMP506B.tmp

Process:	C:\Windows\System32\SIHClient.exe
File Type:	Microsoft Cabinet archive data, single, 283 bytes, 1 file, at 0x44 +Utf "environment.xml", flags 0x4, ID 18148, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	17395
Entropy (8bit):	7.297808060361236
Encrypted:	false
SSDEEP:	192:Y++BFO7SCP3yalzqDHt8Axz5GIqMvus/qnajBMWj6AkKFZYECUqY7S8Zuo1nqnaC:lCksHqzj0l9P6AnCUTZZl9lRo
MD5:	E97660B7AB6838D0D96B5C6BB4328753
SHA1:	AA104E62A8166E23D89C4769EC382EF345299D28
SHA-256:	2BA13EB8A2705B01E54067B2A4FFC17CA2EB376EE3F3BA8D9C5FACE8C5AC1279
SHA-512:	E867FE411239AD8EB66342C9522D48DBC9BB872210CD14B4C734661C4966AEC8CF022C510284B70736049E1F98C4EDA18651C7F7A3B7F6E1DEF782F4F89E8FB2
Malicious:	false
Preview:	MSCF............D................F...............B..........d.......................environment.xml.........CKu.]..0....8.K..:1..]d..A...... .F..9/.G.....hF.U....U.[....{F.D<(...T..h5.....Bz.=.a..6......Y...H..u...UY.......g.E...U...T.SM.%n..w......B.=.e....j.fZ.....YY....0.B....H........B.0.B....1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". D.!....(....i..#_..cZ...Ei?..ui010...`.H.e....... K.....:U...45%.sH&V.NpH..U.........0...0..........3......9...d.......0....H........0~1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1(0&..U....Microsoft Update Signing CA 2.20...180712201748Z..190808201748Z0o1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1.0...U....Microsoft Update0.."0....H.............0.........\|n.......Y..vx{<.4.......c[.......8f...4.e.#W................V.8.;.N....9$T..=..O~..c...r..B.f........z.$........"...PM8.Yo..;.u.T\....{T...&J.

C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\sls.cab

Process:	C:\Windows\System32\SIHClient.exe
File Type:	Microsoft Cabinet archive data, single, 8785 bytes, 1 file, at 0x44 +Utf "environment.cab", flags 0x4, ID 36571, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	25457
Entropy (8bit):	7.655665945183416
Encrypted:	false
SSDEEP:	384:i9eD3oXHzqAAteICxU2L/l/dVCmMMx2GCq3fQkclmIO+WccCuqvXolUjx2:3AhAteHq2L/l/dkMxjCgF+WcmqvS
MD5:	9D27F0ECE5019003D4415EB80973B81A
SHA1:	39C19D8842C0201FD203F6D1EA79CEBD2E880970
SHA-256:	331D51A091FFA84C2959F2A5971EEC6EC976F00B84473E4861D72CBED4C97203
SHA-512:	8DF4CBDF4248743F50DFB41B0E6CC94C61227505288B23742EA0E9C86A8FA71D2AA84621D094D867C91BA4B551256E7FDD28ADE5ABA6C23F68CD80A4768922E1
Malicious:	false
Preview:	MSCF....Q"......D..........................Q".. A..........d........C..............environment.cab...o..!.CCK.Z.8U[.?...)..).s.Jf2.2d.1..R8..Bf...2....Q...)S.JR.P.F...{..~.}.}....g.5...?........1@![?......B...d.l......X...g.^.....@...I......+F......4T..R...:J...C>.\.x.M$..9j._5#._.D=;....8-%<.JQ....R`D..D.0.2/....B.t........A,=.=..R.T..53.8........K..........>..m';^..#O3..h5\|h.U.......HP."[.'Sl.\|.c..Y.B....i.....Sx.O..r(d..J.K.)..UM0(.I....Y......0(........C.P....H.F....:.C....G.....x.tC.V..Q$....."...J.l...p..XZ/.E'.pX...^....%i.B....`.O.}=W..~NV...W..!n.1m.C.).FX.!.82.......?..aP..J.<...R=D.lon......%.7.$....F.\|.......,.R..X{:.].c.\.....J..};[.7W[$3..YCLE....p.t...y..yXc...^.{..N.......c.j.>....(..B..tdHI@..B.H.QI3.(.H.......>z.n{}.?...A.w..$=..%....0.(0.].IR..)rLcCN.......[./...l...gB..%..>0.v.p..Y.......o...76...".d..6>i.L...H&......2....q.{..h..WL...C.r..Z..n.L.T..^5..%.o.....u^.G.6...3.L.p......2A.*Im._Z......;.2.}z..2

C:\Windows\SysWOW64\Explower.exe

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.558759879113321
Encrypted:	false
SSDEEP:	768:DY3r+tD9O/pBcxYsbae6GIXb9pDX2b9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3jsGP:m+nOx6baIa9RIj00ljEwzGi1dDPDTgS
MD5:	5FFC76CFA5ADE6017FFF6B56C343F718
SHA1:	AC5B3889AF5E488C26102B1B886C00AE0B15AEBC
SHA-256:	26B9F4E5AEAE4AA95E44A9A9D51D028B30BD6C9F329BBE8B52511C65BA294FB3
SHA-512:	9BE0F6DFF2F25493E54A7B26AD405E5AEF0EA3D4EEE8674A02E4C2407CA4F8126DEBD6BE26F3AE193E2B1FC459E667242D2380DD9F9522DDF2D01A378DB4FBA0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....je.................p............... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Windows\SysWOW64\Explower.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\N1aqZIb7KG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

\Device\ConDrv

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.558759879113321
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	N1aqZIb7KG.exe
File size:	95'232 bytes
MD5:	5ffc76cfa5ade6017fff6b56c343f718
SHA1:	ac5b3889af5e488c26102b1b886c00ae0b15aebc
SHA256:	26b9f4e5aeae4aa95e44a9a9d51d028b30bd6c9f329bbe8b52511c65ba294fb3
SHA512:	9be0f6dff2f25493e54a7b26ad405e5aef0ea3d4eee8674a02e4c2407ca4f8126debd6be26f3ae193e2b1fc459e667242d2380dd9f9522ddf2d01a378db4fba0
SSDEEP:	768:DY3r+tD9O/pBcxYsbae6GIXb9pDX2b9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3jsGP:m+nOx6baIa9RIj00ljEwzGi1dDPDTgS
TLSH:	D293F84977E56524E4BF56F79871F2004E34B48B1602E39D48F219AA1B33AC44F89FEB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....je.................p............... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x418efe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x656AFFFA [Sat Dec 2 09:59:22 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18ea8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x16f04	0x17000	False	0.36799422554347827	data	5.59057945627049	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x1a000	0xc	0x200	False	0.041015625	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 7, 2023 11:27:02.760207891 CET	49709	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:03.000874996 CET	13150	49709	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:03.514019012 CET	49709	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:03.755883932 CET	13150	49709	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:04.263963938 CET	49709	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:04.504713058 CET	13150	49709	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:05.013861895 CET	49709	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:05.254458904 CET	13150	49709	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:05.763890982 CET	49709	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:06.004561901 CET	13150	49709	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:08.016773939 CET	49710	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:08.258879900 CET	13150	49710	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:08.763858080 CET	49710	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:09.007359028 CET	13150	49710	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:09.513842106 CET	49710	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:09.755705118 CET	13150	49710	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:10.263926983 CET	49710	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:10.506056070 CET	13150	49710	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:11.013844013 CET	49710	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:11.255867958 CET	13150	49710	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:13.265074015 CET	49712	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:13.506850958 CET	13150	49712	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:14.060777903 CET	49712	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:14.303186893 CET	13150	49712	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:14.966985941 CET	49712	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:15.209094048 CET	13150	49712	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:15.857625008 CET	49712	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:16.099520922 CET	13150	49712	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:16.670126915 CET	49712	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:16.912362099 CET	13150	49712	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:18.921901941 CET	49716	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:19.162403107 CET	13150	49716	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:19.670104027 CET	49716	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:19.910893917 CET	13150	49716	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:20.420144081 CET	49716	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:20.660815954 CET	13150	49716	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:21.170145988 CET	49716	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:21.410661936 CET	13150	49716	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:21.920099974 CET	49716	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:22.160636902 CET	13150	49716	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:24.172663927 CET	49717	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:24.412286997 CET	13150	49717	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:24.967077971 CET	49717	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:25.206934929 CET	13150	49717	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:25.717029095 CET	49717	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:25.956955910 CET	13150	49717	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:26.466995955 CET	49717	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:26.706645966 CET	13150	49717	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:27.217032909 CET	49717	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:27.457679987 CET	13150	49717	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:30.708045006 CET	49718	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:30.949693918 CET	13150	49718	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:31.514029980 CET	49718	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:31.755779028 CET	13150	49718	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:32.326395035 CET	49718	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:32.601434946 CET	13150	49718	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:33.217045069 CET	49718	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:33.458825111 CET	13150	49718	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:33.967102051 CET	49718	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:34.208681107 CET	13150	49718	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:36.218878031 CET	49719	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:36.464660883 CET	13150	49719	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:37.123272896 CET	49719	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:37.365746975 CET	13150	49719	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:37.935781956 CET	49719	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:38.178230047 CET	13150	49719	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:38.692079067 CET	49719	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:38.934611082 CET	13150	49719	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:39.529818058 CET	49719	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:39.772259951 CET	13150	49719	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:41.782221079 CET	49720	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:42.022597075 CET	13150	49720	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:42.529712915 CET	49720	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:42.769784927 CET	13150	49720	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:43.435796022 CET	49720	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:43.679711103 CET	13150	49720	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:44.232578993 CET	49720	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:44.472656012 CET	13150	49720	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:45.123224020 CET	49720	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:45.363274097 CET	13150	49720	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:48.031869888 CET	49721	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:48.273435116 CET	13150	49721	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:48.779472113 CET	49721	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:49.022285938 CET	13150	49721	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:49.529473066 CET	49721	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:49.771445990 CET	13150	49721	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:50.279454947 CET	49721	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:50.521564960 CET	13150	49721	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:51.029545069 CET	49721	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:51.271892071 CET	13150	49721	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:53.281203032 CET	49723	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:53.523261070 CET	13150	49723	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:54.029788017 CET	49723	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:54.271375895 CET	13150	49723	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:54.779506922 CET	49723	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:55.020881891 CET	13150	49723	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:55.529616117 CET	49723	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:55.783509970 CET	13150	49723	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:56.295104027 CET	49723	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:56.536765099 CET	13150	49723	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:58.547373056 CET	49724	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:58.787717104 CET	13150	49724	3.68.171.119	192.168.2.6
Dec 7, 2023 11:27:59.295087099 CET	49724	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:27:59.535813093 CET	13150	49724	3.68.171.119	192.168.2.6
Dec 7, 2023 11:28:00.045089006 CET	49724	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:28:00.292109013 CET	13150	49724	3.68.171.119	192.168.2.6
Dec 7, 2023 11:28:00.795181990 CET	49724	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:28:01.035677910 CET	13150	49724	3.68.171.119	192.168.2.6
Dec 7, 2023 11:28:01.545064926 CET	49724	13150	192.168.2.6	3.68.171.119
Dec 7, 2023 11:28:01.786005020 CET	13150	49724	3.68.171.119	192.168.2.6
Dec 7, 2023 11:28:05.189749956 CET	49725	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:06.192862988 CET	49725	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:08.201356888 CET	49725	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:08.443736076 CET	13150	49725	18.197.239.109	192.168.2.6
Dec 7, 2023 11:28:08.951419115 CET	49725	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:09.192461014 CET	13150	49725	18.197.239.109	192.168.2.6
Dec 7, 2023 11:28:09.701405048 CET	49725	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:09.946063042 CET	13150	49725	18.197.239.109	192.168.2.6
Dec 7, 2023 11:28:11.953439951 CET	49726	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:12.221470118 CET	13150	49726	18.197.239.109	192.168.2.6
Dec 7, 2023 11:28:12.888940096 CET	49726	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:13.129435062 CET	13150	49726	18.197.239.109	192.168.2.6
Dec 7, 2023 11:28:13.701360941 CET	49726	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:13.953275919 CET	13150	49726	18.197.239.109	192.168.2.6
Dec 7, 2023 11:28:14.498199940 CET	49726	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:22.498218060 CET	49726	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:22.739077091 CET	13150	49726	18.197.239.109	192.168.2.6
Dec 7, 2023 11:28:24.750402927 CET	49728	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:24.992784023 CET	13150	49728	18.197.239.109	192.168.2.6
Dec 7, 2023 11:28:25.498179913 CET	49728	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:25.740761995 CET	13150	49728	18.197.239.109	192.168.2.6
Dec 7, 2023 11:28:26.388803005 CET	49728	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:30.388808012 CET	49728	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:38.498214960 CET	49728	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:38.741029024 CET	13150	49728	18.197.239.109	192.168.2.6
Dec 7, 2023 11:28:40.781356096 CET	49729	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:41.022908926 CET	13150	49729	18.197.239.109	192.168.2.6
Dec 7, 2023 11:28:41.623265028 CET	49729	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:41.878560066 CET	13150	49729	18.197.239.109	192.168.2.6
Dec 7, 2023 11:28:42.513792038 CET	49729	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:42.755429029 CET	13150	49729	18.197.239.109	192.168.2.6
Dec 7, 2023 11:28:43.310664892 CET	49729	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:51.310657024 CET	49729	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:51.552495956 CET	13150	49729	18.197.239.109	192.168.2.6
Dec 7, 2023 11:28:53.562151909 CET	49730	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:53.841615915 CET	13150	49730	18.197.239.109	192.168.2.6
Dec 7, 2023 11:28:54.498224020 CET	49730	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:54.740861893 CET	13150	49730	18.197.239.109	192.168.2.6
Dec 7, 2023 11:28:55.388780117 CET	49730	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:55.635453939 CET	13150	49730	18.197.239.109	192.168.2.6
Dec 7, 2023 11:28:56.201291084 CET	49730	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:56.446083069 CET	13150	49730	18.197.239.109	192.168.2.6
Dec 7, 2023 11:28:56.998189926 CET	49730	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:28:57.240093946 CET	13150	49730	18.197.239.109	192.168.2.6
Dec 7, 2023 11:28:59.252034903 CET	49731	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:00.326291084 CET	49731	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:00.566843987 CET	13150	49731	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:01.123162031 CET	49731	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:01.369000912 CET	13150	49731	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:01.920037031 CET	49731	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:09.920085907 CET	49731	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:10.160228014 CET	13150	49731	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:13.294770002 CET	49732	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:13.544378042 CET	13150	49732	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:14.123123884 CET	49732	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:14.387597084 CET	13150	49732	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:14.919986963 CET	49732	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:15.163816929 CET	13150	49732	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:15.810652018 CET	49732	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:16.052262068 CET	13150	49732	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:16.623125076 CET	49732	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:24.379081964 CET	49733	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:24.621432066 CET	13150	49733	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:25.201186895 CET	49733	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:25.443959951 CET	13150	49733	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:25.998051882 CET	49733	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:26.252902031 CET	13150	49733	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:26.888672113 CET	49733	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:27.130868912 CET	13150	49733	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:27.701194048 CET	49733	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:27.943447113 CET	13150	49733	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:29.577816963 CET	49734	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:29.818592072 CET	13150	49734	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:30.326154947 CET	49734	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:30.566960096 CET	13150	49734	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:31.123051882 CET	49734	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:35.123002052 CET	49734	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:35.368854046 CET	13150	49734	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:35.999453068 CET	49734	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:36.244839907 CET	13150	49734	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:37.765369892 CET	49735	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:38.033879995 CET	13150	49735	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:38.701122046 CET	49735	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:38.947865009 CET	13150	49735	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:39.503825903 CET	49735	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:39.744777918 CET	13150	49735	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:40.388591051 CET	49735	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:48.389071941 CET	49735	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:48.630974054 CET	13150	49735	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:50.062503099 CET	49736	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:50.303009987 CET	13150	49736	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:50.888636112 CET	49736	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:51.134473085 CET	13150	49736	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:51.701035976 CET	49736	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:51.947658062 CET	13150	49736	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:52.497931004 CET	49736	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:52.753674030 CET	13150	49736	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:53.388623953 CET	49736	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:53.629429102 CET	13150	49736	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:54.968553066 CET	49737	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:55.209954023 CET	13150	49737	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:55.810399055 CET	49737	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:56.051841021 CET	13150	49737	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:56.622889042 CET	49737	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:29:56.864370108 CET	13150	49737	18.197.239.109	192.168.2.6
Dec 7, 2023 11:29:57.513546944 CET	49737	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:30:05.513447046 CET	49737	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:30:05.757586002 CET	13150	49737	18.197.239.109	192.168.2.6
Dec 7, 2023 11:30:07.004203081 CET	49738	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:30:07.244782925 CET	13150	49738	18.197.239.109	192.168.2.6
Dec 7, 2023 11:30:07.888648987 CET	49738	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:30:08.129292965 CET	13150	49738	18.197.239.109	192.168.2.6
Dec 7, 2023 11:30:08.700931072 CET	49738	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:30:12.700912952 CET	49738	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:30:12.943240881 CET	13150	49738	18.197.239.109	192.168.2.6
Dec 7, 2023 11:30:13.497781038 CET	49738	13150	192.168.2.6	18.197.239.109
Dec 7, 2023 11:30:13.739084005 CET	13150	49738	18.197.239.109	192.168.2.6
Dec 7, 2023 11:30:16.070504904 CET	49739	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:16.316828966 CET	13150	49739	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:16.919661045 CET	49739	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:17.162237883 CET	13150	49739	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:17.825895071 CET	49739	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:18.071270943 CET	13150	49739	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:18.622750998 CET	49739	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:18.874967098 CET	13150	49739	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:19.513375044 CET	49739	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:19.753776073 CET	13150	49739	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:20.842950106 CET	49740	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:21.094991922 CET	13150	49740	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:21.622821093 CET	49740	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:21.865662098 CET	13150	49740	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:22.513370991 CET	49740	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:22.756567955 CET	13150	49740	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:23.325870991 CET	49740	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:23.568541050 CET	13150	49740	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:24.122739077 CET	49740	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:24.367062092 CET	13150	49740	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:25.374149084 CET	49741	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:25.615274906 CET	13150	49741	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:26.294598103 CET	49741	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:26.535794973 CET	13150	49741	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:27.200839996 CET	49741	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:27.450433016 CET	13150	49741	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:27.997723103 CET	49741	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:28.238749027 CET	13150	49741	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:28.888324022 CET	49741	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:29.129796028 CET	13150	49741	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:30.077389002 CET	49742	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:30.319031954 CET	13150	49742	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:30.919605970 CET	49742	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:33.013330936 CET	49742	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:33.255265951 CET	13150	49742	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:33.810199976 CET	49742	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:41.810197115 CET	49742	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:42.051739931 CET	13150	49742	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:42.936562061 CET	49743	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:43.178148985 CET	13150	49743	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:43.700774908 CET	49743	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:43.942635059 CET	13150	49743	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:44.497618914 CET	49743	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:44.747111082 CET	13150	49743	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:45.294555902 CET	49743	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:45.535399914 CET	13150	49743	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:46.200947046 CET	49743	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:46.442183018 CET	13150	49743	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:47.264416933 CET	49744	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:47.514760017 CET	13150	49744	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:48.202721119 CET	49744	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:48.443877935 CET	13150	49744	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:48.997592926 CET	49744	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:49.238482952 CET	13150	49744	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:49.888221025 CET	49744	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:50.129312992 CET	13150	49744	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:50.700709105 CET	49744	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:57.467681885 CET	49745	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:57.724822998 CET	13150	49745	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:58.325764894 CET	49745	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:58.583530903 CET	13150	49745	52.28.247.255	192.168.2.6
Dec 7, 2023 11:30:59.122544050 CET	49745	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:30:59.372606039 CET	13150	49745	52.28.247.255	192.168.2.6
Dec 7, 2023 11:31:00.013171911 CET	49745	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:31:00.257734060 CET	13150	49745	52.28.247.255	192.168.2.6
Dec 7, 2023 11:31:00.810049057 CET	49745	13150	192.168.2.6	52.28.247.255
Dec 7, 2023 11:31:01.066489935 CET	13150	49745	52.28.247.255	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 7, 2023 11:27:02.614701033 CET	62223	53	192.168.2.6	1.1.1.1
Dec 7, 2023 11:27:02.757133961 CET	53	62223	1.1.1.1	192.168.2.6
Dec 7, 2023 11:28:04.015047073 CET	57634	53	192.168.2.6	1.1.1.1
Dec 7, 2023 11:28:05.014174938 CET	57634	53	192.168.2.6	1.1.1.1
Dec 7, 2023 11:28:05.188325882 CET	53	57634	1.1.1.1	192.168.2.6
Dec 7, 2023 11:29:12.139884949 CET	54350	53	192.168.2.6	1.1.1.1
Dec 7, 2023 11:29:13.139583111 CET	54350	53	192.168.2.6	1.1.1.1
Dec 7, 2023 11:29:13.291721106 CET	53	54350	1.1.1.1	192.168.2.6
Dec 7, 2023 11:30:15.237263918 CET	58434	53	192.168.2.6	1.1.1.1
Dec 7, 2023 11:30:15.409115076 CET	53	58434	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 7, 2023 11:27:02.614701033 CET	192.168.2.6	1.1.1.1	0xeea7	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Dec 7, 2023 11:28:04.015047073 CET	192.168.2.6	1.1.1.1	0xa643	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Dec 7, 2023 11:28:05.014174938 CET	192.168.2.6	1.1.1.1	0xa643	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Dec 7, 2023 11:29:12.139884949 CET	192.168.2.6	1.1.1.1	0xa465	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Dec 7, 2023 11:29:13.139583111 CET	192.168.2.6	1.1.1.1	0xa465	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Dec 7, 2023 11:30:15.237263918 CET	192.168.2.6	1.1.1.1	0xd8a1	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 7, 2023 11:27:02.757133961 CET	1.1.1.1	192.168.2.6	0xeea7	No error (0)	6.tcp.eu.ngrok.io	3.68.171.119	A (IP address)	IN (0x0001)	false
Dec 7, 2023 11:28:05.188325882 CET	1.1.1.1	192.168.2.6	0xa643	No error (0)	6.tcp.eu.ngrok.io	18.197.239.109	A (IP address)	IN (0x0001)	false
Dec 7, 2023 11:29:13.291721106 CET	1.1.1.1	192.168.2.6	0xa465	No error (0)	6.tcp.eu.ngrok.io	18.197.239.109	A (IP address)	IN (0x0001)	false
Dec 7, 2023 11:30:15.409115076 CET	1.1.1.1	192.168.2.6	0xd8a1	No error (0)	6.tcp.eu.ngrok.io	52.28.247.255	A (IP address)	IN (0x0001)	false

Target ID:	1
Start time:	11:26:53
Start date:	07/12/2023
Path:	C:\Users\user\Desktop\N1aqZIb7KG.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\N1aqZIb7KG.exe
Imagebase:	0x530000
File size:	95'232 bytes
MD5 hash:	5FFC76CFA5ADE6017FFF6B56C343F718
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000001.00000000.2101338617.0000000000532000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000001.00000000.2101338617.0000000000532000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000001.00000000.2101338617.0000000000532000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	11:26:55
Start date:	07/12/2023
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\Desktop\N1aqZIb7KG.exe" "N1aqZIb7KG.exe" ENABLE
Imagebase:	0xa60000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	3
Start time:	11:26:55
Start date:	07/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	11:26:56
Start date:	07/12/2023
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall delete allowedprogram "C:\Users\user\Desktop\N1aqZIb7KG.exe"
Imagebase:	0xa60000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	5
Start time:	11:26:56
Start date:	07/12/2023
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\Desktop\N1aqZIb7KG.exe" "N1aqZIb7KG.exe" ENABLE
Imagebase:	0xa60000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	6
Start time:	11:26:56
Start date:	07/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	7
Start time:	11:26:56
Start date:	07/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	11:26:56
Start date:	07/12/2023
Path:	C:\Users\user\AppData\Roaming\Microsoft\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\svchost.exe"
Imagebase:	0x30000
File size:	95'232 bytes
MD5 hash:	5FFC76CFA5ADE6017FFF6B56C343F718
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000008.00000002.4568319316.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\svchost.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 84%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	9
Start time:	11:26:58
Start date:	07/12/2023
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\Microsoft\svchost.exe" "svchost.exe" ENABLE
Imagebase:	0xa60000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	10
Start time:	11:26:58
Start date:	07/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	11
Start time:	11:26:59
Start date:	07/12/2023
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall delete allowedprogram "C:\Users\user\AppData\Roaming\Microsoft\svchost.exe"
Imagebase:	0xa60000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	12
Start time:	11:26:59
Start date:	07/12/2023
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\Microsoft\svchost.exe" "svchost.exe" ENABLE
Imagebase:	0xa60000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	13
Start time:	11:26:59
Start date:	07/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	14
Start time:	11:26:59
Start date:	07/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Target ID:	15
Start time:	11:27:08
Start date:	07/12/2023
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exe"
Imagebase:	0x590000
File size:	95'232 bytes
MD5 hash:	5FFC76CFA5ADE6017FFF6B56C343F718
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 84%, ReversingLabs
Has exited:	true

Target ID:	16
Start time:	11:27:11
Start date:	07/12/2023
Path:	C:\Windows\System32\SIHClient.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\sihclient.exe /cv 9rGOcCJ3NE2Fxvl5hzRMzQ.0.2
Imagebase:	0x7ff726e80000
File size:	380'720 bytes
MD5 hash:	8BE47315BF30475EEECE8E39599E9273
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true